"Reverse engineering or reverse direction search" matching MCP servers:

Exposes 18 typed tools that drive real static-analysis engines (Ghidra, apktool, WABT, TShark, evmole, Rizin) over a single MCP endpoint to decompile binaries, audit APKs, scan EVM contracts, inspect WebAssembly, firmware, SQLite, and pcap data. Every call returns signed, verifiable evidence with an evidence_id, provider identity, SHA-256 artifact digest, and explicit limitations for security research, malware analysis, forensics, and CTF work.

Chrome browser JS reverse engineering MCP tool for CTF/Web security, enabling dynamic analysis and restoration of login encryption logic.

A Python MCP server that decompiles Android APK/XAPK/JAR/AAR files and extracts HTTP APIs used by the app.

A JavaScript reverse engineering MCP server that enables AI coding assistants to debug and analyze JavaScript code in web pages.

A Model Context Protocol (MCP) server that detects cryptographic algorithms, identifies obfuscation, reconstructs standalone implementations, generates SDKs, and bypasses anti-debugging.

Enables AI agents to inspect and decompile software they have no source for — Android APKs, Electron bundles, .NET assemblies, and Go, Rust or WASM binaries — plus adb device interaction, through a token-guarded Streamable HTTP MCP endpoint, stdio MCP, or a CLI. Ghidra-powered native binary decompilation can be opted in at startup for ELF, PE and Mach-O targets.

Enables searching and analyzing CVEs and vulnerabilities from multiple sources, optimized for PR review scenarios to help developers identify the latest security issues.

Unified vulnerability search MCP server for penetration testing agents, integrating 5 data sources (NVD, OSV, EPSS, CISA KEV, Exploit-DB+GitHub) and 10 MCP tools for CVE query, keyword search, batch query, EPSS scoring, KEV checking, exploit search, and comprehensive assessment with Chinese output.

Production-grade MCP server for universal reverse engineering automation.

Enables users to query the CVE-Search API to browse vendors and products, retrieve vulnerabilities by vendor/product or CVE ID, list recent CVEs with CAPEC, CWE, and CPE expansions, and inspect database status.

Enables users to browse vendors and products, retrieve CVEs by ID, fetch the latest updated CVEs with CAPEC/CWE/CPE expansions, and inspect database update information via the CVE-Search API.

Enables users to browse vendors and their associated products, look up vulnerabilities by vendor/product or specific CVE ID, retrieve the latest CVEs with CAPEC, CWE and CPE expansions, and inspect current database information and update times.

Enables querying the CVE-Search API to browse vendors and products, retrieve vulnerabilities by vendor/product or CVE ID, fetch the latest updated CVEs with CAPEC/CWE/CPE expansions, and check current database information. It provides these capabilities through MCP tools for use in compatible clients.

Enables users to query vulnerability data, browse vendors and products, retrieve CVEs by ID or product, fetch recent CVEs with CAPEC/CWE/CPE details, and inspect database status.

Enables users to query the CVE-Search API by browsing vendors and products, retrieving vulnerabilities per vendor/product or CVE-ID, getting the latest 30 CVEs with CAPEC/CWE/CPE expansions, and checking database update information.

Enables querying the CVE-Search API to browse vendors and their products, look up vulnerabilities by vendor/product or CVE ID, and retrieve the latest CVEs with CAPEC, CWE, and CPE expansions. It also reports which databases are in use and when they were last updated.

Enables users to query the CVE-Search API to retrieve vendors, products, vulnerabilities by vendor/product, specific CVE IDs, recent CVEs with CAPEC/CWE/CPE expansions, and database update information.

Enables querying the CVE-Search API for vendors, products, vulnerabilities by vendor and product, specific CVE IDs, recent CVEs with CAPEC/CWE/CPE expansions, and database update information.

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

MCP server integrating Rizin reverse engineering, RzGhidra decompiler, and capa for binary analysis, enabling LLMs to open binaries, identify capabilities, extract function addresses, and decompile to C pseudocode.