"Decompile the main function of this malware sample, extract all network IOCs,
 map the behavior to MITRE ATT&CK, and generate a triage report."

AI Client (Claude / Cursor / any MCP-compatible client)
        │  MCP Protocol (stdio or HTTP/SSE)
        ▼
┌──────────────────────────────────────────────────────┐
│                   FastMCP Server                     │
│            50+ registered tools · Async              │
│                  Python 3.10–3.12                    │
├────────────────────┬─────────────────────────────────┤
│   Guided Prompts   │  Dynamic Resources              │
│  (5 expert modes)  │  (workspace, metrics, health)   │
├────────────────────┴─────────────────────────────────┤
│                  Core Infrastructure                 │
│  Config · Security · Validators · Exception Hierarchy│
│  R2 Pool · Metrics · Memory (SQLite) · Task Queue   │
│  MITRE Mapper · Evidence Engine · Resilience Layer  │
├──────────────────────────────────────────────────────┤
│                 Analysis Engines                     │
│  Radare2 + r2ghidra  │  YARA · LIEF · Capstone      │
│  CAPA (Mandiant)     │  angr (Symbolic Execution)   │
│  Volatility3 · Scapy │  DIE · Qiling · Binwalk      │
└──────────────────────────────────────────────────────┘

docker run -i --rm \
  -v /path/to/your/samples:/app/workspace \
  -e REVERSECORE_WORKSPACE=/app/workspace \
  -e MCP_TRANSPORT=stdio \
  ghcr.io/sjkim1127/reversecore_mcp:latest

git clone https://github.com/sjkim1127/Reversecore_MCP.git
cd Reversecore_MCP
./scripts/run-docker.sh        # auto-detects Intel / Apple Silicon

docker compose --profile x86 up -d    # Intel/AMD
docker compose --profile arm64 up -d  # Apple Silicon (M1/M2/M3)

git clone https://github.com/sjkim1127/Reversecore_MCP.git
cd Reversecore_MCP
python -m venv venv && source venv/bin/activate
pip install -r requirements.txt
python server.py

{
  "mcpServers": {
    "Reversecore_MCP": {
      "command": "docker",
      "args": [
        "exec",
        "-i",
        "-e",
        "MCP_TRANSPORT=stdio",
        "reversecore-mcp-arm64",
        "python",
        "server.py"
      ]
    }
  }
}

{
  "mcpServers": {
    "Reversecore_MCP": {
      "url": "http://localhost:8000/mcp/sse"
    }
  }
}

{
  "mcpServers": {
    "reversecore": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "/Users/YOUR_USERNAME/samples:/app/workspace",
        "-e", "REVERSECORE_WORKSPACE=/app/workspace",
        "-e", "MCP_TRANSPORT=stdio",
        "ghcr.io/sjkim1127/reversecore_mcp:latest"
      ]
    }
  }
}

{
  "mcpServers": {
    "reversecore": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "/home/YOUR_USERNAME/samples:/app/workspace",
        "-e", "REVERSECORE_WORKSPACE=/app/workspace",
        "-e", "MCP_TRANSPORT=stdio",
        "ghcr.io/sjkim1127/reversecore_mcp:latest"
      ]
    }
  }
}

{
  "mcpServers": {
    "reversecore": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "C:/samples:/app/workspace",
        "-e", "REVERSECORE_WORKSPACE=/app/workspace",
        "-e", "MCP_TRANSPORT=stdio",
        "ghcr.io/sjkim1127/reversecore_mcp:latest"
      ]
    }
  }
}

git clone https://github.com/sjkim1127/Reversecore_MCP.git
cd Reversecore_MCP
python -m venv venv && source venv/bin/activate
pip install -r requirements.txt
pip install -r requirements-dev.txt
pre-commit install   # installs Gitleaks, Ruff, Bandit hooks

# Full test suite with coverage report
pytest tests/ -v

# Unit tests only (fast, no external dependencies)
pytest tests/unit/ -v

# Integration tests (requires Docker)
pytest tests/integration/ -v

# Run with coverage threshold enforcement
pytest tests/unit/ --cov=reversecore_mcp --cov-fail-under=80

# Run a specific test
pytest tests/unit/test_cli_tools.py::TestRunFile::test_success -v

ruff check reversecore_mcp/      # Lint (E, W, F, I, B, C4, UP rules)
ruff format reversecore_mcp/     # Format
mypy reversecore_mcp/            # Type check (0 errors across 87 files)
bandit -r reversecore_mcp/       # Security scan (all severities)
pip-audit                        # Dependency CVE scan

Lint & Security Gate            Unit Tests (Python Matrix)
  ├─ Gitleaks (secret scan)       ├─ pytest 3.10 --cov-fail-under=80
  ├─ Hadolint (Dockerfile)        ├─ pytest 3.11 --cov-fail-under=80
  ├─ Ruff check + format          └─ pytest 3.12 --cov-fail-under=80
  ├─ Mypy type check (87 files)
  ├─ Bandit (all severities)    Docker Verification
  └─ pip-audit (zero CVE)         ├─ Build multi-arch image (amd64/arm64)
                                  ├─ Trivy container scan (LOW→CRITICAL)
CodeQL Analysis                   ├─ Integration tests (inside container)
  └─ Python SAST                  └─ E2E MCP tool invocation

Deploy (main branch only)
  └─ Push to GHCR + Trivy rescan on published image

reversecore_mcp/
├── core/                      # Infrastructure layer
│   ├── config.py              # Centralized configuration
│   ├── exceptions.py          # Exception hierarchy (RCMCP-E* codes)
│   ├── security.py            # Input sanitization & path validation
│   ├── validators.py          # File & binary path validators
│   ├── r2_pool.py             # Thread-safe Radare2 connection pool
│   ├── r2_helpers.py          # Structured Radare2 output utilities
│   ├── metrics.py             # Tool execution metrics
│   ├── decorators.py          # @log_execution, @track_metrics
│   ├── error_handling.py      # @handle_tool_errors decorator
│   ├── memory.py              # Async SQLite AI memory store
│   ├── mitre_mapper.py        # MITRE ATT&CK mapping engine
│   ├── evidence.py            # Evidence classification system
│   ├── resilience.py          # Retry, circuit-breaker, timeout
│   ├── task_queue.py          # Background task queue (Redis/arq)
│   ├── extension_registry.py  # Plugin registration system
│   └── sast/                  # Python AST + C/C++ scanners
│
├── tools/                     # MCP tool implementations
│   ├── analysis/              # Static analysis
│   │   ├── static_analysis.py # file, strings, binwalk
│   │   ├── lief_tools.py      # LIEF binary parser
│   │   ├── capa_tools.py      # CAPA capability detection
│   │   ├── die_tools.py       # DIE packer/compiler detection
│   │   ├── diff_tools.py      # Binary diffing
│   │   ├── emulation_tools.py # ESIL emulation
│   │   ├── fuzz_tools.py      # Fuzzing harness generator
│   │   ├── symbolic_analysis.py # angr symbolic execution
│   │   ├── signature_tools.py # Library signature matching
│   │   └── source_auditor.py  # SAST (Python + C/C++)
│   │
│   ├── radare2/               # Radare2 & decompilation
│   │   ├── radare2_mcp_tools.py # Core r2 tool set
│   │   ├── r2ghidra_tools.py  # Ghidra decompiler (r2ghidra)
│   │   ├── r2_analysis.py     # Deep function analysis
│   │   ├── r2_db.py           # SQLite annotation database
│   │   └── r2_session.py      # Stateful analysis sessions
│   │
│   ├── malware/               # Threat detection & defense
│   │   ├── dormant_detector.py # Backdoor/logic bomb detection
│   │   ├── ioc_tools.py       # IOC extraction
│   │   ├── yara_tools.py      # YARA scanning
│   │   ├── adaptive_vaccine.py # YARA rule + patch generation
│   │   └── vulnerability_hunter.py # Vuln pattern detection
│   │
│   ├── forensics/             # Digital forensics
│   │   ├── memory.py          # Volatility3 memory forensics
│   │   ├── network.py         # Scapy PCAP analysis
│   │   ├── disk.py            # Sleuth Kit disk forensics
│   │   └── artifact.py        # Browser/registry/event log
│   │
│   ├── report/                # Report generation
│   └── common/                # File ops, server health
│
├── prompts/                   # AI reasoning prompts (5 modes)
├── resources.py               # Dynamic MCP resources
└── server.py                  # FastMCP server entrypoint (50+ tools registered)

# reversecore_mcp/tools/analysis/my_tool.py
from reversecore_mcp.core.decorators import log_execution
from reversecore_mcp.core.result import ToolResult, success, failure
from reversecore_mcp.core.security import validate_file_path

@log_execution()
async def my_analysis_tool(file_path: str, option: str | None = None) -> ToolResult:
    """Analyze a binary for X.

    Args:
        file_path: Path to the binary file (relative to workspace).
        option: Optional analysis option.

    Returns:
        ToolResult with status='success' and structured content.
    """
    try:
        safe_path = validate_file_path(file_path)
        result = await perform_analysis(safe_path)
        return success({"result": result})
    except Exception as e:
        return failure(str(e))