sandboxed-re-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| REMCP_GHIDRA_HEADLESS | No | Path to the Ghidra headless analyzer executable, e.g. /opt/ghidra/support/analyzeHeadless. Backend paths otherwise auto-discover from PATH and common install locations; override any via REMCP_* environment variables. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| re_capabilitiesA | Health-Check: welche RE-Backends sind verfügbar (Ghidra/r2/capa/floss/angr/jadx/apktool/bwrap)
|
| analyze_binaryA | Volle statische Triage eines nativen Binaries (ELF/PE/Mach-O/.so) HOST-seitig via re_triage.py: Ghidra-Dekompilat -> capa-Capabilities -> floss-Strings (opt) -> Sink-Rang -> angr (opt). Liefert strukturiertes JSON (Top-verdächtige Funktionen, Capabilities, Strings). READ-ONLY. Für EIGENE / in-scope / CTF-Binaries. Fremde/untrusted Samples -> sandbox_analyze_binary. Kann mehrere Minuten dauern (Ghidra-Analyse). |
| sandbox_analyze_binaryA | Wie analyze_binary, aber ISOLIERT in einer bubblewrap-Wegwerfkammer: --unshare-all (KEIN Netz -> Egress strukturell unmöglich), keine Capabilities, cgroup Mem/PID/CPU-Limits, Host read-only, kein Host-Secret. Für UNTRUSTED / fremde Samples. Braucht bwrap (bubblewrap). READ-ONLY, Ziel wird NIE ausgeführt. |
| sandbox_selftestA | Beweist LIVE die Isolations-Garantien der AUSGELIEFERTEN Sandbox (keine Analyse eines Ziels): ruft exakt engine/sandbox_analyze.sh --selftest auf — denselben bwrap-Aufbau (inkl. --unshare-all) wie die echte Analyse. (1) Netz-Zugriff schlägt fehl, (2) Host-Schreiben scheitert. PASS/FAIL je Check. |
| decompile_functionA | Dekompiliert GENAU EINE Funktion (nach Name oder Entry-Adresse 0x...) via Ghidra-headless -> C-Text + Signatur. 'function' z.B. 'main', 'check_license' oder '0x401160'. READ-ONLY. Kann einige Minuten dauern. |
| list_symbolsA | Schnelles Inventar via r2/rizin (ohne Ghidra, Sekunden). kind = 'functions' | 'imports' | 'strings'. Gut für den ersten Überblick / um Ziele für decompile_function zu finden. READ-ONLY. |
| analyze_apkA | Android-APK-Triage: zieht native Libs (lib//.so) und jagt jede durch re_triage.py (Ghidra-Dekompilat -> capa/floss -> Sink-Rang). Deckt die native Schicht ab, die jadx/apktool nicht sehen. 'arch' optional, z.B. 'arm64-v8a' (sonst alle). 'sandbox' (Default True): läuft in der bwrap-Kammer (keine Ausführung, kein Netz). READ-ONLY, entpackt nur, führt NICHTS aus der APK aus. Eigene / in-scope APKs. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Most tools target clearly distinct operations (capability check, symbol inventory, single-function decompile, full triage, APK triage, sandbox selftest). The main ambiguity is analyze_binary vs sandbox_analyze_binary, whose names are nearly identical, but descriptions strongly disambiguate them via the host-vs-untrusted-sample rule. decompile_function also overlaps with the decompilation phase inside analyze_binary, though its single-target scope keeps it separable.
Names follow a mostly predictable snake_case verb_noun pattern (decompile_function, list_symbols, analyze_binary, analyze_apk, sandbox_selftest). The sandbox_ prefix is used consistently as a qualifier. The only deviation is re_capabilities, which is a noun phrase with a domain prefix rather than a verb_noun action.
Seven tools is well-scoped for a reverse-engineering server: each covers a distinct stage (backend discovery, fast inventory, targeted decompile, full host triage, sandboxed triage, sandbox verification, APK triage). No obvious redundancy or filler tools.
The surface covers the core static RE workflow: discover backends, inventory symbols, decompile a function, run full triage, and do so safely in a sandbox for untrusted samples including APKs. Minor gaps remain, e.g. no explicit cross-reference/call-graph query, no disassembly view, and no dynamic execution, but these are reasonable omissions for a static, read-only toolset.