Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ReversePort

NPM · REVERSEPORT

Reverse engineer and port apps and games: Godot, Unity IL2CPP, .NET, binaries, with parity checks.

Available components

0 this week 87 Trust /100

Last scanned (3 hours ago)

Scores higher than 91% of npm servers

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security93
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known medium-severity CVE affects glob 13.0.6, reached via @electron/asar > glob. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 62 of 184 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to laaielichter/Reverseport). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability71
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 15068 tokens (~264/item across 57 items; 57 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management63
  • Stability observed for 19 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 82% of tool parameters carry a description.Partial
  • Structured output schemas are declared (35% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 57 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 58 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1
    • Tool safety: pass → unverified ▼ security
    • Stability: 0.57 → unverified ▼ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Schema quality: 100 → unverified ▼ functional
    • Package version: 1.14.0 → 1.15.0 functional
  • 3 Nov 26 +24
    • Known CVEs: unverified → fail ▼ security
    • Malware scan: unverified → pass ▲ security
    • Dependency health: unverified → 0.87 ▲ functional
  • 2 Nov 26 −25
    • Known CVEs: fail → unverified ▼ security
    • Malware scan: pass → unverified ▼ security
    • Schema quality: 201 → 264 ▼ functional
    • Tool coverage: 95% → 82% ▼ functional
    • Dependency health: 0.89 → unverified ▼ functional
    • Schema quality: pass → fail ▼ functional
    • MCP protocol: Implements a current MCP spec version (2026-07-28). functional
    • Package version: 1.10.0 → 1.14.0 functional
    • Package version: 1.10.0 → 1.13.0 functional
    • Package version: 1.10.0 → 1.12.0 functional
    • Package version: 1.10.0 → 1.11.0 functional
  • 1 Nov 26 0
    • Tool safety: pass → unverified ▼ security
    • Stability: 0.47 → unverified ▼ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Schema quality: 100 → unverified ▼ functional
    • Package version: 1.9.0 → 1.10.0 functional
  • 31 Oct 26 −1
    • CVE-2026-118764 affects this package: medium ▼ security
    • CVE-2026-118773 affects this package: medium ▼ security
    • Known CVEs: pass → fail ▼ security
  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Oct 26 +16
    • Malware scan: unverified → pass ▲ security
  • 27 Oct 26 −9
    • Malware scan: pass → unverified ▼ security
    • CVE-2023-54404 no longer affects this package ▲ security
    • Known CVEs: fail → pass ▲ security
    • Package version: 1.8.0 → 1.9.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/reverseport@1.15.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo laaielichter/Reverseport
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/laaielichter/Reverseport/.github/workflows/release.yml@refs/heads/main
Rekor log index 3690131029
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:b5da716ab0163d9c403cf4952bc692fb93af3c0e2e0a01aafd9a58763f0fb861c372deb422d4f199710a3f4b181649dbb622ecd9210066b325679b27a

Background: How many MCP packages publish verified provenance →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-3g3m-2fjr-6pw4 CVE-2026-118773 medium yes
GHSA-g3hv-75wg-m249 CVE-2026-118764 medium yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 184 packages
Packages resolved 184
Deprecated 1
Stale 61
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 57 exposed · ~14,524 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
re_lookup ~388

Recon without files: give one of query (a name), url (store/web/GitHub page), steamAppId, appStoreId or github. Reads public sources only (Steam store API, PCGamingWiki, Wikidata, Apple App Store, GitHub, the web page itself) and returns a dossier: identity (developer, release, platforms, genres), tech (engine with confidence and sources, languages, graphics APIs, middleware, web stack and hosting fingerprint), material (where its files live and how they are structured: install layout and formats of its engine, save/config locations, scripts/wasm/data files a web page loads, a public repo's structure and detected engine), references (screenshots, videos, pages), and open-source reimplementations, remakes and tools. mirror:true downloads a public GitHub repo's source text so re_graph, re_symbols and port_plan can read it. Returns a lookupId for re_blueprint. Cached for a day (fresh:true refetches).

NameTypeReqDescription
appStoreIdstring–Apple App Store id.
freshboolean–Skip the one-day cache.
githubstring–Public GitHub repo: owner/repo or URL.
kindstring–auto (default), game, app or software.
maxFilesinteger–mirror: max files (default 400).
mirrorboolean–GitHub: download the source text (code, scenes, configs) into the workspace.
querystring–Name of the game, app or software.
sourcesarray–Limit sources (default all): steam, pcgamingwiki, wikidata, github, appstore, web.
steamAppIdstring–Steam app id.
urlstring–Steam, App Store, Google Play, GitHub or any public web page URL.

No output schema declared.

No examples provided.

re_probe ~141

For unknown or custom formats: identifies the format at an offset, hex view, entropy map (text/code/compressed regions), embedded files (PNG, OGG, WAV, ZIP, GDPC, glTF, DDS, ELF/PE…) with offsets and sizes, and likely record strides for tables. Works on multi-GB files.

NameTypeReqDescription
filestringyesFile to probe.
lengthinteger–Bytes in the hex view (default 256, max 4096).
maxMBinteger–MiB to scan for entropy/embedded files (default 512).
offsetinteger–Start offset (default 0).

No output schema declared.

No examples provided.

re_refs ~138

Audits a Unity project's GUID references: references to GUIDs no .meta file declares (dangling: missing scripts, pink materials), the same GUID in two .meta files (copies made outside Unity), assets without a .meta, .meta files whose asset is gone, and declared assets nothing references. For dangling script references it suggests scripts that nothing references. Reports only; nothing is written. Fix by re-linking in Unity or by setting the suggested guid in the right .meta.

NameTypeReqDescription
limitinteger–Max items per list (default 200).
pathstringyesUnity project root, or any folder/file inside it.

No output schema declared.

No examples provided.

re_report ~79

Writes ARCHITECTURE.md for a project: stack, languages, entry points, mermaid module graph, cycles, most-used files, scene trees of the entry scenes, class table, possibly unused files and external dependencies.

NameTypeReqDescription
outstring–Output .md path (default: workspace/reports).
pathstringyesProject folder.

No output schema declared.

No examples provided.

re_save ~285

Peels the open layers of a save file (gzip/zlib, base64, LZ-String as RPG Maker MV/MZ uses, JSON, XML, INI/ConfigFile, Godot store_var) and lists every field with type, sample and a guessed role (health, currency, score, position, progress, collection, time, version, identity, integrity, rng, settings). Checksum fields are verified by recomputing md5/sha1/sha256/crc32 over the save without that field; binary saves are checked for CRC32 trailers/headers and get record strides and strings. compare:<second save> lists the fields that changed between two saves, the fastest way to learn which field is which. action:"schema" writes a JSON schema plus SaveData.gd and SaveData.cs with the same field names, to port the save format. Encrypted, XOR-obfuscated, .NET BinaryFormatter and pickle content is reported, never decoded.

NameTypeReqDescription
actionstring–inspect (default) or schema (write schema + data classes).
comparestring–A second save of the same game to diff against.
filestringyesThe save file.
limitinteger–Max fields/changes (default 400).
outstring–schema: folder for the files (default workspace/saves).

No output schema declared.

No examples provided.

re_scan ~124

Reconnaissance of a folder: detects the engine/framework (Godot, Unity, Unreal, GameMaker, RPG Maker, Ren'Py, LÖVE, Defold, Bevy, MonoGame, three.js/Phaser/Electron, Flutter, .NET, Go, Rust, Python…) for source projects AND exported game builds, languages with line counts, file categories, entry points, biggest files and binaries. Start here.

NameTypeReqDescription
maxFilesinteger–Stop after this many files (default 50000).
pathstringyesFolder to scan.

No output schema declared.

No examples provided.

re_scene ~105

Reads Godot .tscn/.tres/project.godot (Godot 3 and 4) and Unity .unity/.prefab/.asset (text serialization) into one neutral tree: node names, types, scripts, transforms (position, quaternion, scale), components, groups/tags, instanced scenes/prefabs (resolved through .meta GUIDs), signal connections, plus a mermaid diagram.

NameTypeReqDescription
filestringyesScene/prefab/project file.

No output schema declared.

No examples provided.

re_strings ~301

Localisation: extracts user-facing text with stable ids from Godot scenes/resources and GDScript (text, tooltips, tr()), Unity YAML (m_Text, TextMeshPro) and C#, RPG Maker MV/MZ data (Show Text, choices, database names, terms), Ren'Py scripts (say, menu), web code and i18n JSON files. Writes a catalog plus .pot (gettext) and/or CSV with file:line references and placeholder hints. action:"apply" takes a translated .po/.csv/.json and writes a translated COPY of the project into out, checking placeholders and flagging strings that grew a lot. The source is never modified.

NameTypeReqDescription
actionstring–extract (default) or apply.
formatstring–extract: json (default), po, csv or all.
langstring–Language code for the output (e.g. nl).
limitinteger–Entries to return inline (default 500; the files hold all).
matchstring–Only files whose path contains this.
outstring–extract: folder for the catalog/.pot/.csv (default workspace/strings). apply: new or empty folder for the translated copy.
pathstringyesProject folder.
translationsstring–apply: translated .po, .csv (id|source + translation columns) or .json ({id|source: translation}).

No output schema declared.

No examples provided.

re_symbols ~149

Code structure for one file or a whole folder (30+ languages: GDScript, C#, C/C++ incl. Unreal macros, Python, JS/TS, Lua, Java/Kotlin, Go, Rust, Swift, shaders, Ren'Py…): classes with base classes, functions with lines, signals/events, exported/serialized fields, dependencies, node paths. match filters by name (substring or * wildcard).

NameTypeReqDescription
limitinteger–Max files (default 25; each file lists up to 40 functions unless match narrows it).
matchstring–Filter names (e.g. "player", "*_process").
pathstringyesFile or folder.

No output schema declared.

No examples provided.

run_batch ~134

Runs up to 20 tool calls in order (ReversePort's tools and engine tools) and returns their results together, so a plan of small steps costs one round trip. select keeps only the fields you need from each result (dot paths like "primary.id", "entryPoints[0].file" or "items[*].file"), which keeps the answer small. Stops at the first error unless continueOnError is true; the error says which call failed and why.

NameTypeReqDescription
callsarrayyesThe calls, in order.
continueOnErrorboolean–Run the remaining calls after an error (default false).

No output schema declared.

No examples provided.

search_procedures ~263

Search every analyzed procedure name using literal matching by default or regex when requested. Results are deterministic and complete. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker. The matching deadline is REA_REGEX_MATCHING_DEADLINE_MS (a positive decimal integer of milliseconds from 1 to 2147483647, default 5000). Unset keeps the default. A deadline failure names the effective milliseconds, source (default or setting), the default, and the maximum, and leaves the API usable. The worker old-generation request is REA_REGEX_WORKER_HEAP_REQUEST_MIB (a decimal integer of mebibytes from 7 to 16384, default 128). Unset keeps the default. A positive Node --max-old-space-size, including NODE_OPTIONS, overrides that request and is not limited by the setting's floor or maximum. A heap failure names the effective request, its source (default or setting), the default, the floor, and the maximum. Select detail summary for counts and retained native-inventory pages; complete remains the default.

NameTypeReqDescription
case_sensitiveboolean––
detailstring––
documentstring––
modestring––
patternstringyes–
NameTypeReqDescription
analysis_profile–yes–
authority–yes–
caller_input_path–––
confidence–yes–
environment–yes–
evidence_id–yes–
evidence_links–yes–
limitations–yes–
locations–yes–
normalized_result–yes–
operation–yes–
parameters–yes–
predicate_type–yes–
provider–yes–
raw_result–yes–
relationship_coverage–yes–
subject–yes–

No examples provided.

search_strings ~362

Search every provider-reported string object or candidate using literal matching by default or regex when requested. Results are deterministic and complete over that provider inventory, not every text sequence in artifact bytes. Kuna scans mapped sequences of at least five characters, including unterminated fragments, without computing references. Ghidra may omit packed or undefined literals, including Rust strings; an empty result does not prove text is absent. If an address is known, read_bytes and xrefs inspect its bytes and references. Hopper retains typed byte decoding, native display, and explicit decoding unknowns. Adjacent long-literal fragments match independently. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker. The matching deadline is REA_REGEX_MATCHING_DEADLINE_MS (a positive decimal integer of milliseconds from 1 to 2147483647, default 5000). Unset keeps the default. A deadline failure names the effective milliseconds, source (default or setting), the default, and the maximum, and leaves the API usable. The worker old-generation request is REA_REGEX_WORKER_HEAP_REQUEST_MIB (a decimal integer of mebibytes from 7 to 16384, default 128). Unset keeps the default. A positive Node --max-old-space-size, including NODE_OPTIONS, overrides that request and is not limited by the setting's floor or maximum. A heap failure names the effective request, its source (default or setting), the default, the floor, and the maximum. Select detail summary for counts and retained native-inventory pages; complete remains the default.

NameTypeReqDescription
case_sensitiveboolean––
detailstring––
documentstring––
modestring––
patternstringyes–
NameTypeReqDescription
analysis_profile–yes–
authority–yes–
caller_input_path–––
confidence–yes–
environment–yes–
evidence_id–yes–
evidence_links–yes–
limitations–yes–
locations–yes–
normalized_result–yes–
operation–yes–
parameters–yes–
predicate_type–yes–
provider–yes–
raw_result–yes–
relationship_coverage–yes–
subject–yes–

No examples provided.

set_tool_profile ~90

Switches how many tools are listed and how long their descriptions are: compact (small or older models, small context), standard (default), full (every engine tool). Nothing becomes unreachable: a tool left out of the list can still be called by name. Clients that support list changes refresh automatically; others see it on the next tools/list.

NameTypeReqDescription
profilestringyescompact, standard or full.

No output schema declared.

No examples provided.

share_feedback ~160

Optional, any time: note what worked, what was confusing or slow, and what would help next time. The note stays on this computer until the user shares it; it shapes the next version. It never changes your task.

NameTypeReqDescription
agentstring–Who you are, if you like (client, model).
frictionstring–What got in the way: unclear text, wasted calls, too much output, errors without a next step…
ratinginteger–How well it served the task, 1 (poorly) to 5 (very well).
suggestionstring–What would help.
toolstring–Tool the note is about (if any).
workedstring–What helped.

No output schema declared.

No examples provided.

trace_application_feature ~104

Trace a typed literal seed through every reachable part of an authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.

NameTypeReqDescription
applicationobjectyes–
directionstring–Direction in which to traverse or compare relationships.
native_observationsarray––
seedobjectyes–
NameTypeReqDescription
analysis_profile–yes–
authority–yes–
caller_input_path–––
confidence–yes–
environment–yes–
evidence_id–yes–
evidence_links–yes–
limitations–yes–
locations–yes–
normalized_result–yes–
operation–yes–
parameters–yes–
predicate_type–yes–
provider–yes–
raw_result–yes–
relationship_coverage–yes–
subject–yes–

No examples provided.

xrefs ~92

Return analyzed references to a code or data address. Hopper may default to its current cursor; headless providers such as Ghidra require an explicit address. Use to connect strings, globals, selectors, and functions; bare addresses are untyped and indirect references may be incomplete. Use inspect_native_instruction at the target address for typed incoming references where supported.

NameTypeReqDescription
addressstring––
documentstring––
NameTypeReqDescription
analysis_profile–yes–
authority–yes–
caller_input_path–––
confidence–yes–
environment–yes–
evidence_id–yes–
evidence_links–yes–
limitations–yes–
locations–yes–
normalized_result–yes–
operation–yes–
parameters–yes–
predicate_type–yes–
provider–yes–
raw_result–yes–
relationship_coverage–yes–
subject–yes–

No examples provided.

Install

How do I install the ReversePort MCP server?

ReversePort runs locally as an npm package, launched with npx -y reverseport. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · reverseport

# add to Claude Code
claude mcp add laaielichter-reverseport -- npx -y reverseport
Common questions

What is the ReversePort MCP server?

ReversePort is an MCP server listed in the public MCP registry as io.github.laaielichter/reverseport. Reverse engineer and port apps and games: Godot, Unity IL2CPP, .NET, binaries, with parity checks. This page covers its npm package (reverseport).

Is the ReversePort MCP server safe to use?

ReversePort scores 87 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ReversePort MCP server expose?

ReversePort exposes 57 tools: re_scan, re_graph, re_symbols, re_scene, re_binary, and 52 more. Their descriptions and schemas cost roughly 14,524 tokens of context every time the server is loaded.

Is the ReversePort MCP server still maintained?

ReversePort is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the ReversePort MCP server under?

ReversePort declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.