Reverse Engineering MCP
About
Production grade MCP for Reverse Engineering (includes almost all necessary tools)
Explore
Setup
Install Reverse Engineering MCP in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/president-xd/revula
Follow the installation instructions in the repository README, then restart your MCP client.
Production-grade MCP server for universal reverse engineering automation.
Connect Claude Desktop, MCP-compatible IDEs, or custom tooling to a broad reverse engineering backend through theModel Context Protocol.
- How It Connects (Important)
- Claude Desktop
- Claude Code (CLI)
- VS Code (GitHub Copilot)
- Cursor
- Windsurf (Codeium)
- Continue.dev
- Zed
- Custom / Other Clients
- Universal Setup Script
- Binary Parsing:PE/ELF/Mach-O via LIEF with hash computation and suspicious indicator detection
- Disassembly:Multi-backend support including Capstone (always available), radare2, and objdump for x86/x64/ARM/MIPS/RISC-V
- String Extraction:FLOSS integration, regex fallback, 17 classifier patterns (URLs, IPs, crypto, registry keys)
- Entropy Analysis:Shannon entropy with sliding window, per-section analysis, and packing detection
- Symbol Extraction:DWARF, PDB, LIEF universal; function prologue scanning for stripped binaries
- YARA Scanning:Inline rules, file/directory rules, and community rules support
- Capa Integration:ATT&CK mapping, MBC behaviors, capability enumeration
- Decompilation:Ghidra (headless), RetDec, Binary Ninja with caching
- GDB Adapter:Full GDB/MI protocol with breakpoints, stepping, registers, memory, backtrace, and heap inspection
- LLDB Adapter:Native SB API integration for macOS/Linux debugging
- Frida Adapter:Spawn/attach, script injection, function interception, memory scan/dump, and RPC exports
- Code Coverage:DynamoRIO drcov, Frida Stalker block tracing, and coverage analysis
- APK Parsing:Manifest extraction, permission analysis, component enumeration, and resource inspection
- DEX Analysis:Class/method listing, bytecode stats, and string extraction
- Decompilation:jadx/apktool integration, smali disassembly/assembly/patching
- Native Binary Analysis:ARM/AArch64 .so analysis with JNI detection
- Device Interaction:ADB bridge with 12 actions (logcat, install, shell, dumpsys, screenshot)
- Frida for Android:Root bypass, crypto hooking, SSL pinning bypass, API tracing, and memory dump
- Traffic Interception:tcpdump/mitmproxy integration with SSL key extraction
- Repack and Sign:APK rebuild with smali patches, zipalign + apksigner
- Security Scanners:MobSF, Quark-Engine, Semgrep, and manifest vulnerability detection
- Rizin/r2:Automated analysis with 13 actions and binary diffing
- GDB Enhanced:Heap analysis, ROP gadget finding, exploit helpers (pattern create/find, checksec)
- QEMU:User-mode emulation (4 actions) and full system emulation (5 actions)
- ROP Chain Builder:Multi-architecture gadget finding (x86/x64/ARM/ARM64) with semantic classification, automatic chain generation for execve/mprotect/syscalls, bad-char avoidance, and pwntools script generation
- Heap Exploitation:Malloc chunk analysis, bin classification (tcache/fastbin/smallbin/largebin), fake chunk generation, safe-linking encode/decode for glibc 2.32+, and technique templates (House of Force, Tcache Poisoning, Fastbin Dup, Unsafe Unlink)
- Libc Database:Symbol/offset extraction, libc identification from leaked addresses, ASLR defeat helpers (base calculation, GOT-to-libc, PLT-to-GOT), and one-gadget RCE finder
- Shellcode:Generation, encoding, bad-char analysis, extraction, and emulation testing
- Format String:Offset calculation, write payload generation, GOT overwrite, and address leaking
- Detection:Scan for anti-debug, anti-VM, anti-tamper, and packing indicators
- Bypass Generation:Frida/GDB/patch/LD_PRELOAD scripts for ptrace, IsDebuggerPresent, timing, and VM checks
- Triage:Multi-hash, IoC extraction, suspicious import scoring, and risk assessment
- Sandbox Queries:VirusTotal, Hybrid Analysis, and MalwareBazaar API integration
- YARA Generation:Auto-generate YARA rules from binary artifacts
- Config Extraction:C2 URLs, IPs, domains, encryption keys, and mutexes
- Extraction:binwalk scan/extract, entropy analysis, and filesystem identification
- Vulnerability Scanning:Hardcoded credentials, known CVEs, unsafe functions, and weak crypto
- Base Address Detection:String reference analysis for firmware base address recovery
- PCAP Analysis:tshark-based with 8 actions (summary, flows, DNS, HTTP, TLS, filter, export, IoC)
- Protocol Dissection:Binary structure inference, field boundary detection, and pattern analysis
- Protocol Fuzzing:Mutation-based, boundary testing, field-specific, and template fuzzing
- Packer Detection:UPX, Themida, VMProtect, ASPack, PECompact, MPRESS, and more
- UPX Unpacking:Static unpacking with automatic backup
- Dynamic Unpacking:Frida-based memory dump with OEP detection
- PE Rebuild:Fix section alignments, imports, and entry point after memory dump
- String Deobfuscation:XOR brute force, ROT variants, Base64, RC4, and stack string reconstruction
- Control Flow Flattening Detection:OLLVM-style CFF pattern identification
- Opaque Predicate Detection:Always-true/false branch identification
- angr Integration:Path exploration, constraint solving, CFG generation, and vulnerability scanning
- Triton DSE:Dynamic symbolic execution with concrete and symbolic state
- APK/DEX:Android analysis including manifest, permissions, native libs, and DEX parsing
- .NET IL:Assembly metadata, type/method listing, and IL disassembly
- Java Class:Class file parsing, javap integration, and bytecode disassembly
- WebAssembly:WASM section parsing, import/export extraction, and disassembly
- Hex Tools:Hexdump, pattern search (IDA-style wildcards), and binary diff
- Crypto:Hashing (MD5/SHA/TLSH/ssdeep), XOR analysis, and crypto constant scanning
- Patching:Binary patching with backup and NOP-sled support
- Network:PCAP analysis with protocol stats, DNS extraction, and C2 beacon detection
- Server Status:Version, tool count, cache stats, rate limit stats, and available tools
- Cache Management:View stats, clear cache, and invalidate specific entries
- Python 3.11 or later
- Linux recommended (macOS and WSL2 supported)
- pip(oruv/pipxfor isolated installs)
# Clone git clone https://github.com/president-xd/revula.git cd revula # Option 1: Automated install (recommended) bash scripts/install/install_all.sh # Option 2: Manual install pip install -e . # Option 3: Install with all optional dependencies pip install -e ".[full]" # Verify installation python scripts/test/validate_install.py
The automated installer handles Python version checks, dependency installation, external tool detection, and configuration file generation.
python -c "from revula.config import get_config, format_availability_report; print(format_availability_report(get_config()))"
This prints a table showing which external tools and Python modules are detected on your system.
Revula can be run in Docker for an isolated, stdio-only environment with core and common optional dependencies pre-configured:
# Build the Docker image docker build -t revula:latest . # Quick test docker run --rm --entrypoint python revula:latest -c "import revula; print(revula.__version__)" docker run --rm --entrypoint python revula:latest -c "from revula.server import _register_all_tools; from revula.tools import TOOL_REGISTRY; _register_all_tools(); print(TOOL_REGISTRY.count())" # Run in stdio mode (for local MCP clients) docker run -i --rm -v $(pwd)/workspace:/workspace -v revula-data:/root/.revula revula:latest # Revula transport is stdio-only (no HTTP/SSE mode) # Run it attached to your MCP client process # (for Docker usage, run your MCP client inside the same container/environment)
What's included in the Docker image:
- All core Python dependencies (capstone, LIEF, pefile, yara)
- angr symbolic execution engine
- Frida dynamic instrumentation
- Ghidra headless analyzer
- GDB/LLDB, radare2, rizin (+ rz-diff), binutils
- ADB and Android tools (apktool, jadx, aapt, apksigner, smali/baksmali)
- FLARE tools (FLOSS, capa)
- RetDec, CFR, Detect-It-Easy (diec), DynamoRIO (drrun), UPX
- Exploit tooling (msfvenom, one_gadget), checksec, mono tools (monodis/ikdasm), llvm-pdbutil
- Network analysis tools (tcpdump, tshark, capinfos)
For complete Docker documentation (stdio mode, volumes, compose usage, and troubleshooting), seeDOCKER.md.
- Docker provides an isolated environment with core tooling pre-installed
- Native installation offers better performance and direct system access
- Choose based on your security and portability requirements
Revula uses stdio transport only.The server reads JSON-RPC from stdin and writes to stdout. Every MCP client listed below launches revula as a local subprocess. There is no HTTP server, no SSE endpoint, and no remote connection.
- Revula must be installed on thesame machinewhere your IDE/client runs.
- If you use a remote server or Docker, you must run both the client and revula inside the same environment (or use SSH piping; seeCustom / Other Clients).
- Every client below uses the samerevulacommand. The only difference iswhereyou put the config.
Make sure revula is installed and the command works:
# Should print the MCP protocol handshake (Ctrl+C to exit) revula # If you installed in a venv, activate it first: source /path/to/venv/bin/activate revula # Or use the full path: /path/to/venv/bin/revula
Ifrevulais not in your PATH, use the full path in every config below.
Status:Fully supported. This is the primary client.
python scripts/setup/setup_claude_desktop.py
This auto-detects your OS, finds the config file, and merges the revula entry. It creates a backup first.
Add to yourclaude_desktop_config.json:
{ "mcpServers": { "revula": { "command": "revula", "args": [] } } }
{ "mcpServers": { "revula": { "command": "/home/you/venvs/revula/bin/revula", "args": [] } } }
{ "mcpServers": { "revula": { "command": "uvx", "args": ["revula"] } } }
After editing:Quit and reopen Claude Desktop. Check the MCP tools icon to confirm 116 tools are available.
Claude Code will start revula as a subprocess when needed.
Edit~/.claude.json(or~/.claude/settings.jsondepending on version):
{ "mcpServers": { "revula": { "command": "revula", "args": [] } } }
Status:Supported. Requires GitHub Copilot extension with MCP support (VS Code 1.99+).
Important:MCP support in VS Code is available through the GitHub Copilot Chat extension. Make sure you have:
- VS Code 1.99 or later
- GitHub Copilot extension installed and active
- MCP enabled in settings:"chat.mcp.enabled": true
Option A: Workspace config (already included in this repo)
{ "servers": { "revula": { "command": "revula", "args": [], "env": {} } } }
Just open this project in VS Code and Copilot will discover the MCP server automatically.
Option B: User-level config (global, all projects)
Open VS Code settings (Ctrl+,) → search "mcp" → editsettings.json:
{ "chat.mcp.enabled": true, "mcp": { "servers": { "revula": { "command": "revula", "args": [], "env": {} } } } }
Option C: Create.vscode/mcp.jsonin any project
Copy the file from this repo or create it manually:
mkdir -p .vscode cat > .vscode/mcp.json << 'EOF' { "servers": { "revula": { "command": "revula", "args": [], "env": {} } } } EOF
After editing:Reload VS Code window (Ctrl+Shift+P→ "Developer: Reload Window"). The MCP tools should appear in Copilot Chat.
Status:Supported. Cursor has built-in MCP support.
Config file:~/.cursor/mcp.json(global) or.cursor/mcp.json(per-project).
This repo ships with.cursor/mcp.jsonfor per-project use.
Option A: Per-project (already included)
{ "mcpServers": { "revula": { "command": "revula", "args": [] } } }
mkdir -p ~/.cursor cat > ~/.cursor/mcp.json << 'EOF' { "mcpServers": { "revula": { "command": "revula", "args": [] } } } EOF
After editing:Restart Cursor. Check Settings → MCP to verify revula appears.
Status:Supported. Windsurf Cascade supports MCP servers.
Config file:~/.codeium/windsurf/mcp_config.json
mkdir -p ~/.codeium/windsurf cat > ~/.codeium/windsurf/mcp_config.json << 'EOF' { "mcpServers": { "revula": { "command": "revula", "args": [] } } } EOF
After editing:Restart Windsurf. The Cascade panel should show revula tools.
Status:Supported. Continue has MCP support in recent versions.
{ "mcpServers": [ { "name": "revula", "command": "revula", "args": [] } ] }
mcpServers: - name: revula command: revula args: []
After editing:Restart your IDE. Continue should detect the MCP server.
Status:Supported. Zed has native MCP support via context servers.
Config file:~/.config/zed/settings.json(Linux/macOS)
{ "context_servers": { "revula": { "command": "revula", "args": [] } } }
After editing:Restart Zed. The context server should appear in the Assistant panel.
Any MCP client that supports stdio transport will work with revula.The protocol is standard JSON-RPC over stdin/stdout.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
