# Reverse Engineering MCP

**18 reverse-engineering and binary-analysis tools over one MCP endpoint.**

A production MCP server that exposes the [REA](https://github.com/morluto/rea) reverse-engineering
agent as a set of typed MCP tools. Every tool drives a real static-analysis engine (Ghidra,
evmole, apktool, WABT, TShark, Rizin) inside a hardened container and returns **signed,
verifiable evidence** — an `evidence_id`, the provider that produced the result, a SHA-256 digest
of the subject artifact, and explicit limitations.

Built for **security research, malware analysis, forensics, incident response, CTF work and
vulnerability assessment**.

[![MCP Server](https://img.shields.io/badge/MCP-Server-blue)](https://modelcontextprotocol.io)
[![18 Tools](https://img.shields.io/badge/Tools-18-green)](#tools)
[![Apify](https://img.shields.io/badge/Live-Apify-orange)](https://apify.com/saleck/rea-reverse-engineering-mcp)

---

## Tools

### Binary analysis & decompilation

| Tool | What it does | Engine |
|---|---|---|
| `binary_decompile` | Decompile a procedure into readable pseudocode | Ghidra |
| `go_binary_inspect` | Go compiler version, module graph, build settings | REA Go |
| `rust_binary_inspect` | cargo-auditable dependency list | REA Rust |
| `macho_inspect` | Mach-O load commands, segments, symbols | REA Mach-O |
| `pe_resources_inspect` | PE resources, payload ranges, hashes | REA PE |
| `dotnet_inspect` | .NET identity, target framework, members | REA managed |
| `signature_inspect` | Code-signing identity, entitlements | REA signature |

### Smart contracts & blockchain

| Tool | What it does | Engine |
|---|---|---|
| `evm_contract_scan` | Selectors, proxy patterns, callable interface | evmole |

### Mobile

| Tool | What it does | Engine |
|---|---|---|
| `apk_audit` | Permissions, activities, services, receivers | apktool |
| `dart_aot_inspect` | Flutter Dart AOT snapshot | REA Dart |
| `plist_inspect` | Bundle id, permissions, URL schemes | REA plist |

### Network

| Tool | What it does | Engine |
|---|---|---|
| `pcap_analyze` | Endpoints, protocols, DNS, TLS SNI, HTTP URIs | TShark |

### Documents, data & packages

| Tool | What it does | Engine |
|---|---|---|
| `wasm_inspect` | WebAssembly sections, exports, WAT | WABT |
| `sqlite_inspect` | SQLite schema, tables, rows | REA SQLite |
| `archive_inspect` | Archive structure plus next probes | REA artifact |

### Applications & firmware

| Tool | What it does | Engine |
|---|---|---|
| `electron_audit` | Electron modules, IPC, context bridge | REA JS analyzer |
| `firmware_regions_inspect` | Firmware regions, signature candidates | REA firmware |
| `crash_report_inspect` | Faulting thread, exception, frames | REA crash |

---

## Usage

### Connect an MCP client

```
https://saleck--rea-reverse-engineering-mcp.apify.actor/sse
```

### Call a tool

```json
{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "evm_contract_scan",
    "arguments": { "bytecode": "6080604052600436101561001057600080fd5b50" }
  }
}
```

### Response

```json
{
  "evidence_id": "ev_539e262747811055fbe77064f796b0577a0ce46d74456d0262a3920fad190dd7",
  "subject": {
    "name": "evm_1792458621289.hex",
    "digest": { "sha256": "6a9e7e82ba185df8dd6902a14166f88735cb81766e90977bb21..." }
  },
  "provider": { "id": "evmole-interface", "name": "REA EVM interface adapter", "version": "evmole@0.9.3" },
  "operation": "inspect_evm_interface"
}
```

---

## Architecture

```
MCP client → Apify standby → HTTP/SSE (Express)
                                   ↓
                     McpServer (18 tools, validated)
                                   ↓
                       shell out to `rea <command>`
                                   ↓
     REA container — Ghidra · JDK 21 · WABT · apktool · TShark · evmole · Rizin
```

### Security controls

| Control | Behaviour |
|---|---|
| Path traversal | rejected (`..` in a path) |
| Shell metacharacters | rejected in paths |
| Bytecode input | hex only, even length, ≤ 512 KB |
| Timeouts | per-tool, 3–5 minutes |
| Concurrency | 64 concurrent sessions |
| Session lifetime | 30-minute TTL, pruned every minute |
| Errors | structured `{ "error": "..." }` with `isError` |
| Health | `GET /health` — version, uptime, sessions, calls charged |

---

## Deployment

The Actor runs in Apify standby mode. Deploy with the Apify CLI:

```bash
apify login
apify push
```

Requires Docker. The image bundles Ghidra 12.1.4, JDK 21, WABT 1.0.42, apktool 2.11.1,
TShark 4.2.2 and REA 6.7.0.

---

## Licence

MIT. The underlying tools retain their own licences — Ghidra, WABT and apktool are Apache-2.0;
TShark is GPL-2.0; REA and evmole are MIT.

---

## Responsible use

This server performs reverse engineering and binary analysis, which is dual-use. It is intended
for security research, malware analysis, forensics, incident response, and auditing artifacts you
own or are authorised to examine. Ensure your use complies with the laws of your jurisdiction and
the terms of the artifacts involved.