MCP RE Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GHIDRA_PATH | No | Ghidra installation path | /opt/ghidra |
| YARA_RULES_PATH | No | Custom YARA rules directory | ./rules |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| analyze_projectC | Analyze project structure and provide architectural feedback |
| review_securityC | Review code for security vulnerabilities |
| analyze_apiC | Analyze API endpoints in the project |
| validate_api_structureC | Validate API follows REST best practices |
| get_architecture_adviceC | Get architectural advice based on requirements |
| scaffold_projectC | Generate project scaffold with Docker and tests |
| add_dockerC | Add Docker configuration to existing project |
| add_testsC | Add unit and integration tests |
| execute_commandC | Execute a shell command |
| read_fileD | Read a file |
| write_fileC | Write content to a file |
| list_directoryC | List directory contents |
| ghidra_analyzeC | Analyze binary with Ghidra (headless mode) |
| ghidra_decompileB | Decompile binary functions with Ghidra |
| yara_scanC | Scan file with YARA rules for malware indicators |
| analyze_binaryA | Static analysis: extract strings, check security (checksec), binary info |
| radare2_analyzeA | Analyze binary with Radare2 (functions, imports, strings) |
| pestudio_analyzeC | Analyze PE (Windows) file with PE Studio features |
| dynamic_analysisB | Run dynamic/behavioral analysis on suspicious file |
| network_analysisB | Analyze network capture (pcap) for IOCs and traffic |
| memory_forensicsC | Analyze memory dump - provides Volatility commands and quick wins |
| gdb_debugA | Debug binary with GDB (set breakpoint, run, inspect) |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 22 tools
Most tools target distinct resource+action pairs, but there is some overlap among binary analysis tools (analyze_binary, ghidra_analyze, radare2_analyze, pestudio_analyze) and between analyze_project and get_architecture_advice. Descriptions help differentiate them, so ambiguity is limited.
Naming conventions are inconsistent: verb_noun (analyze_project, execute_command), tool_prefix_action (ghidra_analyze, yara_scan), and noun_phrase (network_analysis, memory_forensics) are mixed. While tool_prefix is consistent within the RE tools, overall there is no single predictable pattern.
With 22 tools, the server is on the heavy side, and the mix of project development tools (scaffold_project, add_docker) with reverse engineering tools makes the scope feel broad. The count is within the 16-25 range but feels over-scoped for a supposed 'RE Server'.
The reverse engineering domain is well-covered: static analysis, dynamic analysis, memory forensics, network analysis, YARA scanning, and debugging. Minor gaps exist (e.g., no dedicated disassembly tool), but Ghidra/Radare2 handle that. The extra non-RE tools don't detract from RE completeness.