Provides tools for inspecting Dart AOT snapshots, enabling analysis of compiled Dart/Flutter mobile application artifacts and their embedded metadata.
Provides tools to audit Electron applications, revealing modules, IPC channels, and context bridge configurations.
Provides tools for inspecting Flutter Dart AOT snapshots, allowing analysis of Flutter mobile application binaries and related build artifacts.
Provides tools to inspect .NET managed binaries, extracting identity, target framework, and member information.
Provides tools to inspect Rust binaries, extracting cargo-auditable dependency lists and build metadata.
Provides tools to inspect SQLite databases, extracting schema, tables, and row data.
Provides tools to inspect WebAssembly modules, extracting sections, exports, and WAT representation.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Reverse Engineering MCP decompile main from this stripped ELF and give me the evidence ID"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
18 reverse-engineering and binary-analysis tools over one MCP endpoint.
A production MCP server that exposes the REA reverse-engineering
agent as a set of typed MCP tools. Every tool drives a real static-analysis engine (Ghidra,
evmole, apktool, WABT, TShark, Rizin) inside a hardened container and returns signed,
verifiable evidence — an evidence_id, the provider that produced the result, a SHA-256 digest
of the subject artifact, and explicit limitations.
Built for security research, malware analysis, forensics, incident response, CTF work and vulnerability assessment.
Tool | What it does | Engine |
| Decompile a procedure into readable pseudocode | Ghidra |
| Go compiler version, module graph, build settings | REA Go |
| cargo-auditable dependency list | REA Rust |
| Mach-O load commands, segments, symbols | REA Mach-O |
| PE resources, payload ranges, hashes | REA PE |
| .NET identity, target framework, members | REA managed |
| Code-signing identity, entitlements | REA signature |
Tool | What it does | Engine |
| Selectors, proxy patterns, callable interface | evmole |
Tool | What it does | Engine |
| Permissions, activities, services, receivers | apktool |
| Flutter Dart AOT snapshot | REA Dart |
| Bundle id, permissions, URL schemes | REA plist |
Tool | What it does | Engine |
| Endpoints, protocols, DNS, TLS SNI, HTTP URIs | TShark |
Tool | What it does | Engine |
| WebAssembly sections, exports, WAT | WABT |
| SQLite schema, tables, rows | REA SQLite |
| Archive structure plus next probes | REA artifact |
Tool | What it does | Engine |
| Electron modules, IPC, context bridge | REA JS analyzer |
| Firmware regions, signature candidates | REA firmware |
| Faulting thread, exception, frames | REA crash |
Related MCP server: Reverence
https://saleck--rea-reverse-engineering-mcp.apify.actor/sse{
"jsonrpc": "2.0",
"id": 3,
"method": "tools/call",
"params": {
"name": "evm_contract_scan",
"arguments": { "bytecode": "6080604052600436101561001057600080fd5b50" }
}
}{
"evidence_id": "ev_539e262747811055fbe77064f796b0577a0ce46d74456d0262a3920fad190dd7",
"subject": {
"name": "evm_1792458621289.hex",
"digest": { "sha256": "6a9e7e82ba185df8dd6902a14166f88735cb81766e90977bb21..." }
},
"provider": { "id": "evmole-interface", "name": "REA EVM interface adapter", "version": "evmole@0.9.3" },
"operation": "inspect_evm_interface"
}MCP client → Apify standby → HTTP/SSE (Express)
↓
McpServer (18 tools, validated)
↓
shell out to `rea <command>`
↓
REA container — Ghidra · JDK 21 · WABT · apktool · TShark · evmole · RizinControl | Behaviour |
Path traversal | rejected ( |
Shell metacharacters | rejected in paths |
Bytecode input | hex only, even length, ≤ 512 KB |
Timeouts | per-tool, 3–5 minutes |
Concurrency | 64 concurrent sessions |
Session lifetime | 30-minute TTL, pruned every minute |
Errors | structured |
Health |
|
The Actor runs in Apify standby mode. Deploy with the Apify CLI:
apify login
apify pushRequires Docker. The image bundles Ghidra 12.1.4, JDK 21, WABT 1.0.42, apktool 2.11.1, TShark 4.2.2 and REA 6.7.0.
MIT. The underlying tools retain their own licences — Ghidra, WABT and apktool are Apache-2.0; TShark is GPL-2.0; REA and evmole are MIT.
This server performs reverse engineering and binary analysis, which is dual-use. It is intended for security research, malware analysis, forensics, incident response, and auditing artifacts you own or are authorised to examine. Ensure your use complies with the laws of your jurisdiction and the terms of the artifacts involved.
This server cannot be deployed
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Read-only verifier for 25 ProofRelay MCP tools and non-confidential evidence bundles.
Free MCP server of security & dev API tools -- supply-chain, CVE, DNS, WHOIS, OFAC, Cosmos SDK.
EVM audit (Slither + source + security.txt + MCP-probe + wallet-exposure). 6 tools + /trace.
