Reversecore MCP

Tools Reversecore MCP exposes (135)

Listed by the server itself during our scan of commit ce5b8ce.

• audit_source_code

  Perform a security audit on a source code file (SAST). This tool analyzes source code (C, C++, Python, Go, etc.) to identify potential security vulnerabilities such as buffer overflows, injection flaws, and weak cryptography. It provides a structured breakdown of dangerous patterns found in the cod

• run_file

  Identify file metadata using the ``file`` CLI utility.

• copy_to_workspace

  Copy any accessible file to the workspace directory. This tool allows copying files from any location (including AI agent upload directories) to the workspace where other reverse engineering tools can access them. Supports files from: - Claude Desktop uploads (/mnt/user-data/uploads) - Cursor uplo

• create_directory

  Create a new sub-directory within the workspace. This tool allows AI agents to dynamically create isolated sub-workspaces for different tasks or sessions.

• list_workspace

  List all files in the workspace directory. Returns: ToolResult with list of files in workspace

• scan_workspace

  Batch scan all files in the workspace using multiple tools in parallel. This tool performs a comprehensive scan of the workspace to identify files, analyze binaries, and detect threats. It runs 'run_file', 'parse_binary_with_lief', and 'run_yara' (if rules exist) on all matching files concurrently.

• retrieve_truncated_output

  Retrieve a continuation slice of a truncated output artifact from the workspace. Enables AI agents to recover the omitted tail of large tool outputs without using lossy head/tail commands or causing response budget overflows.

• batch_execute

  Execute a batch of repeated or heterogeneous analysis operations within bounded resources. Enables AI agents to perform bulk decompilations, cross-reference searches, tagging, and static analysis sweeps in a single MCP request, eliminating round-trips while isolating individual item failures and en

• transaction_begin

  Begin a new state mutation transaction. Checkpoints current Reversecore state (annotation database, memory sessions, report sessions, and reversible workspace artifacts). Subsequent mutations can be committed atomically or rolled back cleanly to this checkpoint.

• transaction_commit

  Commit the active transaction and persist changes into the undo history. Atomically commits all mutations executed since transaction_begin, records affected objects in the security audit trail, and adds the transaction to the undo stack.

• transaction_rollback

  Roll back the active transaction and restore pre-transaction Reversecore state. Restores the SQLite annotation database, memory sessions, report session metadata, and tracked workspace artifacts to their exact pre-transaction state.

• transaction_status

  Inspect current transaction state, uncommitted mutations, and undo/redo history. Provides visibility into active transaction status, affected resources, whether non-reversible actions have occurred, and available undo/redo steps.

• transaction_undo

  Undo the last committed transaction(s). Restores Reversecore state to the checkpoint prior to the committed transaction, and moves the undone transaction to the redo stack.

• transaction_redo

  Redo the last undone transaction(s). Re-applies the committed state of previously undone transactions.

• recommend_analysis_plan

  Recommend a goal-aware, depth-tiered analysis plan composed of existing MCP tools. Given a file, objective, and depth tier, evaluates tool availability, active profile constraints, and external dependencies to synthesize a sequential tool pipeline with conditional branches, stop conditions, and rat

• create_case_state

  Create a persistent machine-readable analysis case bound to sample SHA-256 integrity.

• get_case_state

  Retrieve persistent analysis case state by ID or sample path.

• update_case_state

  Incrementally update case state, phase, hypotheses, targets, blockers, or artifacts.

• resume_case_state

  Resume an existing analysis case with hash verification and actionable guidance.

• list_case_states

  List persistent analysis cases.

• export_handoff_bundle

  Export a portable analyst handoff bundle for a sample. The bundle records sample identity, scope and tool provenance, what is established vs. unresolved, relevant annotations, and integrity digests for every section and artifact reference.

• import_handoff_bundle

  Verify and import an analyst handoff bundle. Integrity digests are checked first, then the sample hash, and only then is state written. Existing local cases and annotations are never overwritten: an already-known case is imported under a new ID and conflicting annotations are reported and left as-i

• plan_next_analysis_targets

  Generate an evidence-ranked next-analysis plan for an active case. Ranks inspection targets deterministically based on evidence references, priority level, active hypotheses, and blocker readiness. Provides concrete recommended tools and next steps.

• populate_case_queue_from_triage

  Extract prioritized inspection leads from triage results and populate the case queue. Parses suspicious APIs, high-entropy sections, anti-analysis checks, diff changes, and network/memory IOCs into prioritized targets with rationale and evidence links. Skips targets that are already completed.

• add_priority_target

  Manually add an evidence-driven analysis target to the active case queue.

• update_priority_target

  Update a target's lifecycle status, unblock dependent targets on completion, and record findings.

• resolve_target_blocker

  Resolve an explicit blocking dependency for a target, transitioning it to pending status.

• explain_patch

  Analyze differences between two binaries and explain changes in natural language. This tool combines binary diffing with decompilation to help understand security patches. It identifies changed functions, decompiles them, and uses heuristics to explain the nature of the changes (e.g., "Added bounds

• assemble_instructions

  Assemble assembly instruction strings into raw machine byte values using Keystone.

• create_memory_session

  Create a new memory session to store memories. Use this when starting a new reverse engineering analysis. The session name should be descriptive and follow a template format like 'malware_analysis_2024_001' or 'game_cheat_detection'.

• save_memory_item

  Save important information to long-term memory. Use this to remember: - Function addresses and their purposes - Vulnerability patterns discovered - API call sequences - User instructions and preferences - Interesting strings or structures

• recall_memory_item

  Search and recall memories from past analyses. Use this when you need to remember something from earlier, or when the user asks about previous findings.

• list_memory_sessions

  List all analysis sessions with timestamps and status. Use this to see what analyses have been done before, or to find a session to resume.

• get_memory_session_detail

  Get complete details and context for a specific session. Use this when resuming an analysis or reviewing past work. Returns all memories and patterns associated with the session.

• resume_memory_session

  Resume a previous analysis session with full context restoration. Use this when the user says "continue where we left off" or "resume yesterday's analysis".

• complete_memory_session

  Mark an analysis session as completed with a summary. Use this when finishing an analysis to save a summary for future reference.

• save_pattern

  Save a code/behavior pattern for cross-session similarity search. Use this when you discover a notable pattern that might appear in other samples. This enables "Hey, this looks similar to before!"

• find_similar_patterns

  Find similar patterns from previous analyses. Use this to check if current findings match anything from past analyses. Enables knowledge transfer across projects.

• get_relevant_context

  Get relevant context from past analyses for current work. Use this proactively when analyzing something new to check if there's relevant knowledge from previous sessions.

• update_memory_session_time

  Update the cumulative analysis time for a session. Call this periodically to track how long an analysis takes.

Hosts it contacted while running

At a glance

Stars

215

Forks

25

Language

Python

License

MIT

Created

Nov 2025

Last update

Oct 29, 2026

Type

MCP Server

Price

Free

Topics

Questions about Reversecore MCP

Guides

• How to Install an MCP Server in Claude, Cursor and VS Code
• MCP Server Security: How to Vet a Server Before You Use It
• MCP Tool Poisoning: Malicious Descriptions and Rug Pulls
• Glossary of MCP, skills and agent security terms
• More Security & Testing agents, MCP servers & skills