Reversecore MCP

Findings (7)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  network issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  dnspython@2.8.0: 4 known vulnerabilities

  GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m

  requirements-core.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  docs/getting-started/configuration.md:95
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  tests/adversarial/test_m4_transport_resources_adversarial.py:450
• lowLow. Minor, or common in normal tools. Shown for information.
  mako@1.3.12: 4 known vulnerabilities

  PYSEC-2026-4243, PYSEC-2026-4243, PYSEC-2026-4243, PYSEC-2026-4243

  requirements-core.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  REVERSECORE_CLANG_PATH, _ENV_PLUGIN_DIRS, _ENV_R2_EXTENSIONS, _ENV_GHIDRA_EXTENSIONS, REVERSECORE_REDIS_URL, ALLOWED_ORIGINS, REVERSECORE_RATE_LIMIT_STRICT, R2GHIDRA_DB_PATH, REPORT_SMTP_SERVER, REPORT_SMTP_PORT, REPORT_SMTP_USERNAME, REPORT_SMTP_PASSWORD, REPORT_SMTP_USE_TLS, REPORT_SENDER_NAME, RE…

Network activity

Tools exposed (135)

• audit_source_code

  Perform a security audit on a source code file (SAST). This tool analyzes source code (C, C++, Python, Go, etc.) to identify potential security vulnerabilities such as buffer overflows, injection flaws, and weak cryptography. It provides a structured breakdown of dangerous patterns found in the cod

• run_file

  Identify file metadata using the ``file`` CLI utility.

• copy_to_workspace

  Copy any accessible file to the workspace directory. This tool allows copying files from any location (including AI agent upload directories) to the workspace where other reverse engineering tools can access them. Supports files from: - Claude Desktop uploads (/mnt/user-data/uploads) - Cursor uplo

• create_directory

  Create a new sub-directory within the workspace. This tool allows AI agents to dynamically create isolated sub-workspaces for different tasks or sessions.

• list_workspace

  List all files in the workspace directory. Returns: ToolResult with list of files in workspace

• scan_workspace

  Batch scan all files in the workspace using multiple tools in parallel. This tool performs a comprehensive scan of the workspace to identify files, analyze binaries, and detect threats. It runs 'run_file', 'parse_binary_with_lief', and 'run_yara' (if rules exist) on all matching files concurrently.

• retrieve_truncated_output

  Retrieve a continuation slice of a truncated output artifact from the workspace. Enables AI agents to recover the omitted tail of large tool outputs without using lossy head/tail commands or causing response budget overflows.

• batch_execute

  Execute a batch of repeated or heterogeneous analysis operations within bounded resources. Enables AI agents to perform bulk decompilations, cross-reference searches, tagging, and static analysis sweeps in a single MCP request, eliminating round-trips while isolating individual item failures and en

• transaction_begin

  Begin a new state mutation transaction. Checkpoints current Reversecore state (annotation database, memory sessions, report sessions, and reversible workspace artifacts). Subsequent mutations can be committed atomically or rolled back cleanly to this checkpoint.

• transaction_commit

  Commit the active transaction and persist changes into the undo history. Atomically commits all mutations executed since transaction_begin, records affected objects in the security audit trail, and adds the transaction to the undo stack.

• transaction_rollback

  Roll back the active transaction and restore pre-transaction Reversecore state. Restores the SQLite annotation database, memory sessions, report session metadata, and tracked workspace artifacts to their exact pre-transaction state.

• transaction_status

  Inspect current transaction state, uncommitted mutations, and undo/redo history. Provides visibility into active transaction status, affected resources, whether non-reversible actions have occurred, and available undo/redo steps.

• transaction_undo

  Undo the last committed transaction(s). Restores Reversecore state to the checkpoint prior to the committed transaction, and moves the undone transaction to the redo stack.

• transaction_redo

  Redo the last undone transaction(s). Re-applies the committed state of previously undone transactions.

• recommend_analysis_plan

  Recommend a goal-aware, depth-tiered analysis plan composed of existing MCP tools. Given a file, objective, and depth tier, evaluates tool availability, active profile constraints, and external dependencies to synthesize a sequential tool pipeline with conditional branches, stop conditions, and rat

• create_case_state

  Create a persistent machine-readable analysis case bound to sample SHA-256 integrity.

• get_case_state

  Retrieve persistent analysis case state by ID or sample path.

• update_case_state

  Incrementally update case state, phase, hypotheses, targets, blockers, or artifacts.

• resume_case_state

  Resume an existing analysis case with hash verification and actionable guidance.

• list_case_states

  List persistent analysis cases.

• export_handoff_bundle

  Export a portable analyst handoff bundle for a sample. The bundle records sample identity, scope and tool provenance, what is established vs. unresolved, relevant annotations, and integrity digests for every section and artifact reference.

• import_handoff_bundle

  Verify and import an analyst handoff bundle. Integrity digests are checked first, then the sample hash, and only then is state written. Existing local cases and annotations are never overwritten: an already-known case is imported under a new ID and conflicting annotations are reported and left as-i

• plan_next_analysis_targets

  Generate an evidence-ranked next-analysis plan for an active case. Ranks inspection targets deterministically based on evidence references, priority level, active hypotheses, and blocker readiness. Provides concrete recommended tools and next steps.

• populate_case_queue_from_triage

  Extract prioritized inspection leads from triage results and populate the case queue. Parses suspicious APIs, high-entropy sections, anti-analysis checks, diff changes, and network/memory IOCs into prioritized targets with rationale and evidence links. Skips targets that are already completed.

• add_priority_target

  Manually add an evidence-driven analysis target to the active case queue.

• update_priority_target

  Update a target's lifecycle status, unblock dependent targets on completion, and record findings.

• resolve_target_blocker

  Resolve an explicit blocking dependency for a target, transitioning it to pending status.

• explain_patch

  Analyze differences between two binaries and explain changes in natural language. This tool combines binary diffing with decompilation to help understand security patches. It identifies changed functions, decompiles them, and uses heuristics to explain the nature of the changes (e.g., "Added bounds

• assemble_instructions

  Assemble assembly instruction strings into raw machine byte values using Keystone.

• create_memory_session

  Create a new memory session to store memories. Use this when starting a new reverse engineering analysis. The session name should be descriptive and follow a template format like 'malware_analysis_2024_001' or 'game_cheat_detection'.

• save_memory_item

  Save important information to long-term memory. Use this to remember: - Function addresses and their purposes - Vulnerability patterns discovered - API call sequences - User instructions and preferences - Interesting strings or structures

• recall_memory_item

  Search and recall memories from past analyses. Use this when you need to remember something from earlier, or when the user asks about previous findings.

• list_memory_sessions

  List all analysis sessions with timestamps and status. Use this to see what analyses have been done before, or to find a session to resume.

• get_memory_session_detail

  Get complete details and context for a specific session. Use this when resuming an analysis or reviewing past work. Returns all memories and patterns associated with the session.

• resume_memory_session

  Resume a previous analysis session with full context restoration. Use this when the user says "continue where we left off" or "resume yesterday's analysis".

• complete_memory_session

  Mark an analysis session as completed with a summary. Use this when finishing an analysis to save a summary for future reference.

• save_pattern

  Save a code/behavior pattern for cross-session similarity search. Use this when you discover a notable pattern that might appear in other samples. This enables "Hey, this looks similar to before!"

• find_similar_patterns

  Find similar patterns from previous analyses. Use this to check if current findings match anything from past analyses. Enables knowledge transfer across projects.

• get_relevant_context

  Get relevant context from past analyses for current work. Use this proactively when analyzing something new to check if there's relevant knowledge from previous sessions.

• update_memory_session_time

  Update the cumulative analysis time for a session. Call this periodically to track how long an analysis takes.

• get_server_health

  Get the current health status and resource usage of the MCP server. Use this to monitor the server's uptime, memory consumption, and tool execution statistics. Returns: ToolResult containing: - uptime_seconds: Server uptime - memory_usage_mb: Current memory usage in MB - status: 'h

• get_tool_metrics

  Get detailed execution metrics for specific or all tools.

• cve_synthesize_harness

  Synthesize LibFuzzer/AFL++ C/C++ test harness and format dictionary (.dict) for target parser. Analyzes target headers, exports, and sample files to extract candidate parser functions, magic byte signatures, and generate ready-to-compile LLVMFuzzerTestOneInput harness code.

• cve_fuzz_target

  Execute hybrid fuzzing campaign with Sanitizer tracking and angr concolic seed solver. Runs target fuzzer binary with AddressSanitizer, detects coverage stalls, and uses angr symbolic execution to solve magic byte constraints.

• cve_triage_crash

  Triage AddressSanitizer/UBSan crash log and compute CWE and CVSS v3.1 rating. Extracts bug class (heap-buffer-overflow, UAF, double-free), faulting PC, memory access type, allocation/free/crash callstacks, and calculates CVSS score and vector.

• cve_minimize_poc

  Minimize crash testcase payload via delta-debugging and generate standalone PoC scripts. Bsects crash input to find the smallest reproducible byte sequence, and generates standalone Python (subprocess/pwntools) and C reproduction code.

• hunt_cve_vulnerabilities

  Run one-click CVE hunting against a compiled LibFuzzer target executable. This pipeline does not compile source or header files. Generate and compile a harness for those targets separately, then pass the resulting executable here. Performs end-to-end vulnerability discovery: 1. Hybrid fuzzing and

• deobfuscate_strings

  Recover dynamically constructed stack strings and emulated loop strings in a binary. Scans function basic blocks for stack stores (byte/word/dword constants) and micro-emulates tight loops (XOR/additive/rolling ciphers) to capture decrypted strings.

• resolve_api_hashes

  Detect dynamic PEB/TEB walking and resolve 32-bit API hashes to Windows export symbols. Matches constants found in instructions or data sections against precomputed hash tables (ROR13, CRC32, MurmurHash3, FNV-1a, DJB2, SDBM) for standard Windows libraries (ntdll, kernel32, user32, advapi32, ws2_32,

• eliminate_dead_code

  Analyze opaque predicates and identify unreachable basic blocks in a function CFG. Detects algebraic/constant opaque predicates (e.g. zero-flag tests, constant comparisons, redundant jumps) and computes effective reachable blocks to simplify control flow analysis.

• run_deobfuscation_pipeline

  Run all deobfuscation engines concurrently and assemble a unified intelligence report. Executes stack string recovery, emulated loop decryption, API hash resolution, and opaque predicate dead code elimination, producing a comprehensive report with threat tags and detected malware capabilities.

• memory_list_symbols

  List available Volatility3 symbol tables for a memory dump. Volatility3 requires OS-specific symbol tables (ISF files) to run most plugins. Use this tool to inspect which symbol tables are currently available, then load the appropriate one using ``memory_load_symbols`` before running analysis plugi

• memory_analyze

  Run a Volatility3 plugin against a memory dump file. Supports Windows, Linux, and macOS memory dumps. Heavy plugin operations (malfind, psscan, netscan) are queued via ARQ for non-blocking execution.

• memory_list_processes

  List Windows processes from a memory dump.

• memory_detect_injections

  Detect Windows process injection using the Volatility3 windows.malfind plugin. Uses the ``malfind`` plugin to identify memory regions with executable permissions that contain suspicious patterns (MZ headers, shellcode signatures).

• memory_extract_strings

  Extract ASCII and Unicode strings from a memory dump.

• memory_dump_module

  Dump a Windows module or DLL from a memory dump via Volatility3.

• disk_list_partition

  List partition layout of a disk image using Sleuth Kit mmls.

• disk_list_files

  List all files and directories in a disk/filesystem image.

• disk_recover_deleted

  Recover a deleted file from a disk/filesystem image by inode number. Use ``disk_list_files`` with ``include_deleted=True`` first to find the inode number of the deleted file, then pass it to this tool.

• disk_analyze_mft

  Analyze the NTFS Master File Table (MFT) for file timeline and metadata. Provides full filesystem metadata including file creation/modification/access times, which is critical for establishing a forensic timeline.

• disk_extract_file

  Extract a live (non-deleted) file from a disk image by inode number.

• disk_hash_verify

  Compute and verify the integrity hash of a disk image or recovered file. Essential for forensic chain of custody — verifies that an image has not been tampered with since acquisition.

• pcap_analyze

  Summarize sessions, protocols, and packet statistics from a PCAP file. Provides a high-level overview including total packets, unique hosts, protocol distribution, top talkers, and session summary — ideal as a first-pass triage of a PCAP capture.

• pcap_list_connections

  List all unique IP/port connections observed in a PCAP capture.

• pcap_extract_dns

  Extract DNS queries and responses from a PCAP capture. Useful for identifying C2 domain lookups, DGA patterns, DNS tunneling, and suspicious resolution activity.

• pcap_extract_c2

  Detect potential C2 traffic patterns in a PCAP capture. Detects: - Beaconing behavior (periodic connections to same host) - Connections to known suspicious ports - Unusually long/persistent connections - DNS-over-HTTPS (DoH) patterns

• pcap_reconstruct_stream

  Reconstruct TCP stream payload from a PCAP capture. Selects one TCP flow using its four endpoint values and reassembles each direction independently by TCP sequence number. Gaps remain explicit, and retransmissions or conflicting overlaps are counted rather than duplicated.

• artifact_collect

  Collect and normalize forensic artifacts from analysis results. Use this tool to register artifacts discovered during memory, disk, or network analysis. Artifacts are normalized and stored for subsequent correlation with ``artifact_correlate_ioc`` and YARA rule generation via ``artifact_generate_ya

• artifact_correlate_ioc

  Correlate collected forensic artifacts against IoC patterns. Runs IoC extraction patterns (IP, URL, hash, CVE, registry) against all artifact values to automatically enrich them with threat intelligence signals. Uses the existing ``extract_iocs`` infrastructure from the malware module.

• artifact_generate_yara

  Auto-generate YARA rules from collected forensic artifacts. Integrates with the adaptive vaccine pipeline to create detection signatures from suspicious strings, process names, network indicators, and injection patterns found during forensics analysis.

• artifact_timeline

  Build a chronological event timeline from multi-source forensic artifacts. Aggregates artifacts from memory, disk (MFT timestamps), and network captures into a single unified timeline, sorted by timestamp.

• artifact_report

  Export a comprehensive forensics investigation report. Combines artifact collection summary, IoC correlation results, timeline, and optionally auto-generated YARA rules into a structured Markdown report.

• Radare2_open_file

  Opens a binary file with radare2 for analysis. Call this tool before any other r2mcp tool. Use an absolute file_path.

• Radare2_close_file

  Close the currently open radare2 session for a file.

• Radare2_analyze

  Run binary analysis with optional depth level.

• Radare2_run_command

  Execute a raw radare2 command directly. NOTE: Only analysis commands are allowed. Write and shell commands are blocked.

• Radare2_calculate

  Evaluate a math expression using radare2's number parser. Useful for: 64-bit math, resolving addresses for symbols, avoiding hallucinated results.

• Radare2_list_functions

  List all functions discovered during analysis.

• Radare2_list_functions_tree

  List functions and their successors (call tree).

• Radare2_show_function_details

  Display detailed information about a function.

• Radare2_get_current_address

  Show the current seek position and function name.

• Radare2_get_function_prototype

  Retrieve the function signature at the specified address.

• Radare2_set_function_prototype

  Set the function signature (return type, name, arguments).

• Radare2_show_headers

  Display binary headers and file information.

• Radare2_list_sections

  Display memory sections and segments from the binary.

• Radare2_list_imports

  List imported symbols. Note: Use list_symbols for addresses with sym.imp. prefix.

• Radare2_list_symbols

  Show all symbols (functions, variables, imports) with addresses.

• Radare2_list_entrypoints

  Display program entrypoints, constructors and main function.

• Radare2_list_libraries

  List all shared libraries linked to the binary.

• Radare2_list_strings

  List strings from data sections with optional regex filter.

• Radare2_list_all_strings

  Scan the entire binary for strings with optional regex filter. More thorough than list_strings, but slower.

• Radare2_list_classes

  List class names from various languages (C++, ObjC, Swift, Java, Dalvik).

• Radare2_list_methods

  List all methods belonging to the specified class.

• Radare2_disassemble

  Disassemble a specific number of instructions from an address. Use this to inspect a portion of memory as code without depending on function analysis boundaries.

• Radare2_disassemble_function

  Show assembly listing of the function at the specified address.

• Radare2_decompile_function

  Show C-like pseudocode of the function at the given address. Use this to inspect code in a function. Do not run multiple times on the same offset. Includes smart line windowing and function summary header.

• Radare2_list_decompilers

  Show all available decompiler backends.

• Radare2_use_decompiler

  Select which decompiler backend to use.

• Radare2_xrefs_to

  Find all code references TO the specified address.

• Radare2_rename_function

  Rename the function at the specified address.

• Radare2_rename_flag

  Rename a flag (variable or data reference) at the specified address.

• Radare2_set_comment

  Add a comment at the specified address.

• run_radare2

  Execute vetted radare2 commands for binary triage.

• trace_execution_path

  Trace function calls backwards from a target function (Sink) to find potential execution paths. This tool helps identify "Exploit Paths" by finding which functions call a dangerous target function (like 'system', 'strcpy', 'execve'). It performs a recursive cross-reference analysis (backtrace) to m

• generate_function_graph

  Generate a Control Flow Graph (CFG) for a specific function. This tool uses radare2 to analyze the function structure and returns a visualization code (Mermaid by default) or PNG image that helps AI understand the code flow without reading thousands of lines of assembly.

• analyze_xrefs

  Analyze cross-references (xrefs) for a specific address using radare2. Cross-references show the relationships between code blocks - who calls this function (callers) and what it calls (callees). This is essential for: - Understanding program flow - Tracing data dependencies - Identifying attack su

• r2_decompile

  Decompile a binary function to pseudo-C using the r2ghidra plugin. Uses the ``pdg`` command which invokes the embedded Ghidra decompiler engine inside radare2 — no separate Ghidra or JDK installation required. Includes smart line windowing and function summary header for token efficiency.

• r2_recover_structures

  Recover C struct layouts from a function's memory access patterns. Analyses local variables (``afvf``), function arguments (``afvj``), and cross-references (``axtj``) to infer struct field offsets and types.

• r2_analyze_function

  Return full metadata for a binary function via radare2. Retrieves name, size, cyclomatic complexity, arguments, local variables, call targets, and cross-references using radare2's JSON APIs.

• r2_get_call_graph

  Generate a caller/callee call graph for a function. Uses radare2's ``agCd`` (call-graph dot) and ``axtj`` (cross-reference JSON) commands to build a structured graph.

• r2_simulate_patch

  Simulate a byte-level patch at an address and re-decompile. Copies the binary to a temporary workspace cache file, opens that copy in write mode, applies ``patch_bytes`` at ``address``, then runs r2ghidra's ``pdg``. The original file remains read-only throughout the simulation.

• r2_list_structures

  List all saved C struct definitions for a binary.

• r2_get_structure

  Retrieve a single saved struct definition by name.

• r2_create_structure

  Save (or replace) a C struct definition in the annotation DB.

• r2_list_types

  List all custom type definitions saved for a binary.

• r2_list_bookmarks

  List all saved bookmarks / address annotations for a binary.

• r2_add_bookmark

  Add (or update) an annotated bookmark at a binary address.

• r2_read_memory

  Read raw bytes from a binary at a given virtual address.

• emulate_machine_code

  Emulate machine code execution using radare2 ESIL (Evaluable Strings Intermediate Language). This tool provides safe, sandboxed emulation of binary code without actual execution. Perfect for analyzing obfuscated code, understanding register states, and predicting execution outcomes without security

• get_system_time

  Get accurate system timestamp from the server. Returns OS-level time data to prevent AI date hallucination. Includes multiple formats (ISO, Unix, human-readable) and timezone info. Returns: JSON with report_id, date formats, time formats, timezone info

• set_timezone

  Set the default timezone for timestamps.

• get_timezone_info

  Get current timezone configuration and available options. Returns: JSON with current timezone, offset, and all available timezones

• start_report_session

  Start a new malware analysis session. Automatically tracks start time, sample hashes, IOCs, and MITRE techniques.

• end_report_session

  End the current analysis session.

• get_report_session_status

  Get current session information and collected data.

• list_report_sessions

  List all analysis sessions with their status and duration. Returns: List of all sessions with summary information

• add_ioc

  Add an Indicator of Compromise to the current session.

• add_analysis_note

  Add a timestamped note to the analysis session.

• add_mitre_technique

  Add a MITRE ATT&CK technique to the session.

• set_severity

  Update the severity level of the analysis.

• create_analysis_report

  Generate a comprehensive analysis report.

• generate_vex_report

  Generate a CSAF 2.0 VEX JSON report from vulnerability findings. VEX (Vulnerability Exploitability eXchange) is a format for sharing the exploitability status of a software product in a machine-readable way.

• generate_sigma_rule

  Generate a Sigma rule (YAML) for SIEM integration based on extracted IOCs or API calls.

• get_job_result

  Retrieve the status and result of a background job from the task queue.