Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@BinSight what is this download.exe, and is it packed or signed?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Offline · cross-platform · with evidence. It never runs the file.
Built on REA (morluto/rea) · MIT
Most files are black boxes: an .exe you downloaded, a firmware dump, a driver,
a game, an ECU calibration, an app update. BinSight opens the box — statically,
on your own machine, without ever running the file — and answers the three
questions that matter, in plain language and with the evidence to back them up.
You: What is this file? Is it hiding anything? And what changed vs the old version?
BinSight: PE/Windows x64, compiled with MSVC, UPX-packed (entropy 7.9),
imports consistent with network + process injection, Authenticode
signature present, and vs the previous build 3 regions changed —
here are the offsets. All static, all offline, with evidence.triage_file and inspect_executable read ELF, PE/Windows and Mach-O (and raw
blobs) and tell you the type, architecture, entry point, imports/exports,
sections, hashes, and a compiler/packer fingerprint — without starting Ghidra
or IDA, on macOS, Windows or Linux.
detect_binary_toolchain, measure_binary_entropy, classify_import_capabilities,
identify_crypto_constants, extract_binary_strings, inspect_code_signature
and scan_embedded_content surface packing, high-entropy regions, imported
capabilities (network, process, crypto…), IOC strings, embedded files, and
whether a signature is real — reported as evidence and inference, never as a
verdict.
compare_binaries diffs any two files byte-for-byte and explains the change
— which regions moved, what was zeroed or maxed out, the before/after values.
Works on app updates, drivers, firmware and ECU calibration dumps alike.
compare_executables adds import/export/section/hardening deltas for executables.
Related MCP server: REA
Tool | What it answers |
| One call: type, hashes, structure, entropy, packing, capabilities, signature, strings, next steps |
| A shareable Markdown triage report |
| Diff any two files and explain what changed (firmware, ECU dumps, updates) |
| Diff two executables: imports, exports, sections, hardening, entropy |
| Sections, imports, exports, libraries, symbols, entry point, overlay — ELF/PE/Mach-O |
| checksec for every OS: PIE, canary, NX, RELRO, CFG, ASLR, hardened runtime |
| File / section / block Shannon entropy + chi-square |
| Compiler, packer, installer, language (UPX, MSVC, PyInstaller, Go…) |
| ASCII/UTF-16 strings classified into IOCs (URL, IP, path, registry…) |
| AES S-box, SHA/MD5, CRC32, ChaCha, curve parameters… |
| Capabilities inferred from imports ("consistent with", never a verdict) |
| Byte / hex-wildcard / text / regex search, no provider needed |
| imphash, Rich hash, symhash, telfhash, ssdeep, TLSH |
| Authenticode + Mach-O code signature — on any host |
| binwalk-style embedded-file identification (offsets only) |
| CycloneDX / SPDX component inventory from embedded metadata |
| Function names from a stripped Go |
Every result separates observations, inferences and unknowns, carries file offsets, and states its limitations. Detection only — nothing is unpacked, decrypted, cracked or executed.
npx binsight triage-file /path/to/file --json
npx binsight compare-binaries /path/to/old /path/to/new --json
npx binsight generate-triage-report /path/to/file --jsonRegister BinSight as an MCP server for your AI agent, then just ask it in plain language ("what is this file, what does it hide, what changed?"):
npx binsight setupBinSight supports the same agents as REA — see supported agents; other clients can use manual MCP registration.
BinSight's parsers and hashes are checked against the tools analysts already
trust: imphash matches pefile byte-for-byte, structure matches LIEF /
readelf / otool, and hardening and packing results match checksec and
Detect It Easy on a real corpus of ELF, PE and Mach-O binaries.
Static intelligence suite: the 17 tools, with CLI and MCP examples.
Tool catalog: generated inventory of tools, providers and CLI commands.
Installation and setup: providers, agents and manual registration.
BinSight builds on REA and adds the static intelligence suite above. REA is MIT-licensed; this project keeps that license and attribution. This is not an official REA release — for REA itself, go to morluto/rea.
MIT. See LICENSE. Portions © the REA authors.
This server cannot be deployed
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Browser-local and CLI static evidence for deployed AI model artifacts.
Signed sandbox verdicts on any artifact, plus an agent marketplace. No key, no signup, no payment.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
