MCP.Market

Reversecore MCP server

by sjkim1127·io.github.sjkim1127/reversecore-mcp·v3.0.5·205 stars
No reviews yet

Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.

B77/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B77/100

full report

Adoption
Established

205 stars128 downloads/wk

Reviews

Write one

Nobody has reviewed Reversecore MCP yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Reversecore MCP tools (44, 4 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • Radare2_analyzewrite action

    Run binary analysis with optional depth level.

  • Radare2_calculate

    Evaluate a math expression using radare2's number parser.

  • Radare2_close_file

    Close the currently open radare2 session for a file.

  • Radare2_decompile_function

    Show C-like pseudocode of the function at the given address.

  • Radare2_disassemble

    Disassemble a specific number of instructions from an address.

  • Radare2_disassemble_function

    Show assembly listing of the function at the specified address.

  • Radare2_get_current_address

    Show the current seek position and function name.

  • Radare2_get_function_prototype

    Retrieve the function signature at the specified address.

  • Radare2_list_all_strings

    Scan the entire binary for strings with optional regex filter.

  • Radare2_list_classes

    List class names from various languages (C++, ObjC, Swift, Java, Dalvik).

  • Radare2_list_decompilers

    Show all available decompiler backends.

  • Radare2_list_entrypoints

    Display program entrypoints, constructors and main function.

  • Radare2_list_functions

    List all functions discovered during analysis.

  • Radare2_list_functions_tree

    List functions and their successors (call tree).

  • Radare2_list_imports

    List imported symbols.

  • Radare2_list_libraries

    List all shared libraries linked to the binary.

  • Radare2_list_methods

    List all methods belonging to the specified class.

  • Radare2_list_sections

    Display memory sections and segments from the binary.

  • Radare2_list_strings

    List strings from data sections with optional regex filter.

  • Radare2_list_symbols

    Show all symbols (functions, variables, imports) with addresses.

  • Radare2_open_file

    Opens a binary file with radare2 for analysis.

  • Radare2_rename_flag

    Rename a flag (variable or data reference) at the specified address.

  • Radare2_rename_function

    Rename the function at the specified address.

  • Radare2_run_commandwrite action

    Execute a raw radare2 command directly.

  • Radare2_set_comment

    Add a comment at the specified address.

  • Radare2_set_function_prototype

    Set the function signature (return type, name, arguments).

  • Radare2_show_function_details

    Display detailed information about a function.

  • Radare2_show_headers

    Display binary headers and file information.

  • Radare2_use_decompiler

    Select which decompiler backend to use.

  • Radare2_xrefs_to

    Find all code references TO the specified address.

  • complete_memory_session

    Mark an analysis session as completed with a summary.

  • create_memory_sessionwrite action

    Create a new memory session to store memories.

  • find_similar_patterns

    Find similar patterns from previous analyses.

  • get_memory_session_detail

    Get complete details and context for a specific session.

  • get_r2_startup_commands

    Return r2 commands to execute on every new session open.

  • get_relevant_context

    Get relevant context from past analyses for current work.

  • get_server_health

    Get the current health status and resource usage of the MCP server.

  • get_tool_metrics

    Get detailed execution metrics for specific or all tools.

  • list_memory_sessions

    List all analysis sessions with timestamps and status.

  • recall_memory_item

    Search and recall memories from past analyses.

  • resume_memory_session

    Resume a previous analysis session with full context restoration.

  • save_memory_item

    Save important information to long-term memory.

  • save_pattern

    Save a code/behavior pattern for cross-session similarity search.

  • update_memory_session_timewrite action

    Update the cumulative analysis time for a session.

Public scan report

scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it

2 medium
  • Code scan132 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 1 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (2)

  • mediumsubprocess with shell=Trueexec.shell-true
    reversecore_mcp-3.0.5/reversecore_mcp/core/sast/python_ast_scanner.py: … ): # Flag only if shell=True is present has_shel…
  • mediumeval / new Function usedexec.eval
    reversecore_mcp-3.0.5/reversecore_mcp/tools/cve_hunter/hybrid_fuzz_orchestrator.py: … sol = found_state.solver.eval(sym_input, cast_to=bytes) …
Overall 77/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Reversecore MCP compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
77/100
higher than 55% of 915 Security servers
Tools
44
the typical Security server has 6
Tools that change things
9%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
205
more than 96% of 587 Security servers
Downloads a week
128
more than 66% of 248 Security servers with a package

What its tools let an agent do: 38 read · 3 create · 3 change

Release history: 3 versions in the registry since 2026-08-13, latest 2026-09-28, typically one every 36 days.

Install Reversecore MCP in Claude Code, Cursor or VS Code

claude mcp add reversecore-mcp -- uvx reversecore-mcp
Add to Cursor

What the publisher says

From the Reversecore MCP repository's README, as published. We do not edit it. Read it on GitHub

Reversecore MCP

AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol

An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through natural language.

Table of Contents

  • What is Reversecore MCP?
  • Architecture
  • Tool Catalog (151 Tools)
  • Guided Analysis Prompts (22 Modes)
  • MCP Resources (11 URIs)
  • Quick Start
  • Connect to Your AI Client
  • Configuration
  • Security Model
  • Development
  • CI/CD Pipeline
  • Docker Build Architecture

What is Reversecore MCP?

Reversecore MCP is a Model Context Protocol server that wraps 151 analysis tools into a single interface that AI assistants can call through natural language.

Instead of learning the command-line syntax for a dozen different tools, you describe what you want:

"Decompile the main function of this malware sample, extract all network IOCs,
 map the behavior to MITRE ATT&CK, and generate a triage report."

The AI assistant breaks this into tool calls:

r2_decompile("sample.exe", "main")
  → extract_iocs("sample.exe")
    → add_mitre_technique(technique_id="T1071.001", ...)
      → create_analysis_report(template_type="quick_triage")

Each tool returns a structured ToolResult (either ToolSuccess or ToolError) with typed data that the AI can reason about, chain into follow-up queries, or render for the user.

What it covers

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Reversecore MCP: common questions

Is Reversecore MCP server safe?
Mostly: it is graded B (77/100). Read the Reversecore MCP safety report
How do I install Reversecore MCP?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Reversecore MCP need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Reversecore MCP maintained?
The last commit was 33 days ago (2026-10-02). The latest release is v3.0.5.
What can I use instead of Reversecore MCP?
Servers from other publishers that do the same job: CrowdStrike Falcon MCP Server, Wireshark MCP server and Virustotal MCP server. Compare all Reversecore MCP alternatives.
How does Reversecore MCP compare with other Security MCP servers?
safety score 77/100 (higher than 55% of 915 Security servers); tools 44 (the typical Security server has 6); tools that change things 9% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Reversecore MCP

Same job from other publishers: the closest match first, then the best rated.

All Reversecore MCP alternatives →
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
  • Wireshark
    Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
    A
  • Virustotal
    MCP server for querying VirusTotal API with comprehensive security analysis tools.
    B
  • Virustotal
    MCP server for querying VirusTotal API with comprehensive security analysis tools.
    B
  • CodeInspectus
    Local-first MCP security scanner and CLI for AI-generated applications.
    C
Reversecore MCP vs CrowdStrike Falcon MCP ServerReversecore MCP vs WiresharkReversecore MCP vs Virustotal