Skip to main content
Glama
Sign In
mcp-reverse-engineering

mcp-reverse-engineering

by daedalus
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

mcp-reverse-engineering

A sandboxed MCP (Model Context Protocol) tool for reverse engineering that provides a unified interface to various reverse engineering tools with security restrictions.

PyPI Python RuffAsk DeepWiki

Purpose

This project provides a secure, sandboxed environment for executing reverse engineering tools via CLI or MCP protocol. It wraps common reverse engineering utilities (strings, objdump, readelf, binwalk, etc.) with safety features like filesystem isolation, timeouts, and argument validation.

Related MCP server: Esquie

Install

pip install mcp-reverse-engineering

Or for development:

pip install -e ".[dev]"

MCP Server Installation

To use as an MCP server with Claude Desktop:

mcp install src/mcp_reverse_engineering/server.py

Usage

CLI

# Extract strings from a binary
mcp-re --tool strings --file /path/to/binary

# Disassemble a binary
mcp-re --tool objdump --args "['-d']" --file /path/to/binary

# Analyze ELF headers
mcp-re --tool readelf --args "['-h', '-s']" --file /path/to/elf

# Run binwalk for firmware analysis
mcp-re --tool binwalk --file /path/to/firmware.bin

Python API

from mcp_reverse_engineering import ReverseEngineeringEngine

# Create engine with default config
engine = ReverseEngineeringEngine(
    workspace="./workspace",
    timeout=30,
)

# List available tools
print(engine.list_available_tools())

# Execute a tool
result = engine.execute_tool("strings", ["-n", "8"], "/path/to/binary")
print(result)

MCP Server

from mcp_reverse_engineering.server import mcp, strings, objdump, readelf, binwalk

# Run the server (stdio transport for Claude Desktop)
if __name__ == "__main__":
    mcp.run()

API

ReverseEngineeringEngine

Main class for executing reverse engineering tools.

engine = ReverseEngineeringEngine(
    workspace: str = "./workspace",  # Sandbox directory
    timeout: int = 30,               # Tool execution timeout
    config_path: str | Path | None = None,  # YAML config path
)

Methods:

  • execute_tool(tool_name: str, args: List[str], file_path: Optional[str] = None) -> str - Execute a tool

  • list_available_tools() -> List[str] - List enabled tools

  • get_tool_documentation(tool_name: str) -> Dict[str, Any] - Get tool docs

  • get_mcp_tools() -> List[Dict[str, Any]] - Get MCP tool schemas

Available Tools

Tool

Category

Description

file

file_tools

Determine file type

strings

file_tools

Extract printable strings

hexdump

file_tools

Hexadecimal dump

xxd

file_tools

Hexadecimal dump

objdump

binary_tools

Disassemble binary

readelf

binary_tools

Read ELF headers

binwalk

firmware_tools

Firmware analysis

Development

# Clone the repository
git clone https://github.com/daedalus/mcp_reverse_engineering.git
cd mcp_reverse_engineering

# Install dependencies
pip install -e ".[test]"

# Run tests
pytest

# Format code
ruff format src/ tests/

# Lint
ruff check src/ tests/

# Type check
mypy src/

# Install pre-commit hooks
pip install pre-commit
pre-commit install

MCP Server Configuration

mcp-name: io.github.daedalus/mcp-reverse-engineering

Requirements

  • Python 3.11+

  • External tools: binwalk, radare2, ghidra, etc. (must be installed separately)

License

MIT

Available Tools

8 tools
binwalkA

Run binwalk to find embedded files and code in a binary.

Binwalk is a tool for analyzing binary files to find embedded files and executable code. It uses entropy analysis and signature matching to identify compressed data, file systems, archives, and other embedded content.

Inputs: args (required), file. Returns: result

file_cmdA

Run the file command to determine file type.

The file command performs a series of tests to identify the type of a file. It can detect file formats like ELF, PE, archives, images, and many others based on magic bytes and file structure.

Inputs: args (required), file. Returns: result

hexdumpA

Run hexdump on a file to display its contents in hexadecimal format.

The hexdump utility displays the contents of a file in hex and ASCII, useful for analyzing binary file formats, identifying file headers, and inspecting raw file contents.

Inputs: args (required), file. Returns: result

list_toolsA

List all available reverse engineering tools.

This function returns a list of all tools that are currently enabled in the configuration and available for use through the MCP server.

Returns: List[str]: List of available tool names.

Example: >>> list_tools() ['strings', 'hexdump', 'objdump', 'readelf', 'binwalk']

Inputs: no named parameters. Returns: result

objdumpB

Run objdump to disassemble and analyze binary files.

The objdump utility displays information about object files, including disassembly, symbol tables, section headers, and relocation information. Essential for reverse engineering and analyzing compiled binaries.

Inputs: args (required), file. Returns: result

readelfA

Run readelf to display ELF binary information.

The readelf utility displays information about ELF (Executable and Linkable Format) files, including headers, sections, symbols, dynamic linking information, and more. Specific to Linux/Unix ELF binaries.

Inputs: args (required), file. Returns: result

stringsA

Run the strings command on a binary file to extract printable strings.

The strings utility searches for printable strings in a binary file and outputs them. This is useful for extracting embedded strings, URLs, function names, and other text from compiled binaries.

Inputs: args (required), file. Returns: result

xxdA

Run xxd on a file to create a hex dump.

The xxd utility creates a hexadecimal representation of a file, similar to hexdump but with additional features like reverse conversion (hex to binary).

Inputs: args (required), file. Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.8/5.0

    Scored across 8 tools

    Disambiguation5/5

    Each tool targets a distinct reverse engineering task: file type identification, hex dump, disassembly, ELF analysis, string extraction, and tool listing. No overlapping descriptions.

    Naming Consistency5/5

    All tool names follow a consistent snake_case convention, directly derived from the underlying Unix utilities (e.g., binwalk, file_cmd, hexdump, objdump, readelf, strings, xxd) plus a descriptive list_tools.

    Tool Count5/5

    8 tools is well-scoped for a reverse engineering server covering core analysis tasks without being overwhelming.

    Completeness3/5

    Covers basic file analysis, hex viewing, disassembly, and ELF-specific info, but notably missing decompilation, debugging, support for non-ELF formats (PE, Mach-O), and a hex editor.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • Esquie

      wellingtonlee
      F
      license
      A
      quality
      D
      maintenance
      MCP server providing computation, encoding, and note-taking tools for AI-assisted reverse engineering, including Python scripting in a sandboxed Docker container.
      18
      -

    • rea

      morluto
      A
      license
      Not graded
      quality
      B
      maintenance
      MCP server that enables agents to reverse engineer applications, from high-level behavior down to native binaries, using tools like Hopper and Ghidra.
      369,596 npm
      457,297
      MIT