ReversePort
NPM · REVERSEPORT
Reverse engineer and port apps and games: Godot, Unity IL2CPP, .NET, binaries, with parity checks.
Available components
Last scanned (3 hours ago)
Scores higher than 91% of npm servers
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security93
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects glob 13.0.6, reached via @electron/asar > glob. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 62 of 184 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to laaielichter/Reverseport). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability71
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 15068 tokens (~264/item across 57 items; 57 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management63
- Stability observed for 19 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 82% of tool parameters carry a description.Partial
- Structured output schemas are declared (35% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 57 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 58 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
- Tool safety: pass → unverified ▼ security
- Stability: 0.57 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 1.14.0 → 1.15.0 functional
- 3 Nov 26 +24
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.87 ▲ functional
- 2 Nov 26 −25
- Known CVEs: fail → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Schema quality: 201 → 264 ▼ functional
- Tool coverage: 95% → 82% ▼ functional
- Dependency health: 0.89 → unverified ▼ functional
- Schema quality: pass → fail ▼ functional
- MCP protocol: Implements a current MCP spec version (2026-07-28). functional
- Package version: 1.10.0 → 1.14.0 functional
- Package version: 1.10.0 → 1.13.0 functional
- Package version: 1.10.0 → 1.12.0 functional
- Package version: 1.10.0 → 1.11.0 functional
- 1 Nov 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.47 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 1.9.0 → 1.10.0 functional
- 31 Oct 26 −1
- CVE-2026-118764 affects this package: medium ▼ security
- CVE-2026-118773 affects this package: medium ▼ security
- Known CVEs: pass → fail ▼ security
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +16
- Malware scan: unverified → pass ▲ security
- 27 Oct 26 −9
- Malware scan: pass → unverified ▼ security
- CVE-2023-54404 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- Package version: 1.8.0 → 1.9.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/reverseport@1.15.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | laaielichter/Reverseport |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/laaielichter/Reverseport/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3690131029 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:b5da716ab0163d9c403cf4952bc692fb93af3c0e2e0a01aafd9a58763f0fb861c372deb422d4f199710a3f4b181649dbb622ecd9210066b325679b27a |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-3g3m-2fjr-6pw4 | CVE-2026-118773 | medium | yes | |
| GHSA-g3hv-75wg-m249 | CVE-2026-118764 | medium | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 184 packages
| Packages resolved | 184 |
|---|---|
| Deprecated | 1 |
| Stale | 61 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
re_lookup Look up a game, app or site from public sources (no files) ~388
Recon without files: give one of query (a name), url (store/web/GitHub page), steamAppId, appStoreId or github. Reads public sources only (Steam store API, PCGamingWiki, Wikidata, Apple App Store, GitHub, the web page itself) and returns a dossier: identity (developer, release, platforms, genres), tech (engine with confidence and sources, languages, graphics APIs, middleware, web stack and hosting fingerprint), material (where its files live and how they are structured: install layout and formats of its engine, save/config locations, scripts/wasm/data files a web page loads, a public repo's structure and detected engine), references (screenshots, videos, pages), and open-source reimplementations, remakes and tools. mirror:true downloads a public GitHub repo's source text so re_graph, re_symbols and port_plan can read it. Returns a lookupId for re_blueprint. Cached for a day (fresh:true refetches).
| Name | Type | Req | Description |
|---|---|---|---|
| appStoreId | string | – | Apple App Store id. |
| fresh | boolean | – | Skip the one-day cache. |
| github | string | – | Public GitHub repo: owner/repo or URL. |
| kind | string | – | auto (default), game, app or software. |
| maxFiles | integer | – | mirror: max files (default 400). |
| mirror | boolean | – | GitHub: download the source text (code, scenes, configs) into the workspace. |
| query | string | – | Name of the game, app or software. |
| sources | array | – | Limit sources (default all): steam, pcgamingwiki, wikidata, github, appstore, web. |
| steamAppId | string | – | Steam app id. |
| url | string | – | Steam, App Store, Google Play, GitHub or any public web page URL. |
No output schema declared.
No examples provided.
re_probe Probe unknown data ~141
For unknown or custom formats: identifies the format at an offset, hex view, entropy map (text/code/compressed regions), embedded files (PNG, OGG, WAV, ZIP, GDPC, glTF, DDS, ELF/PE…) with offsets and sizes, and likely record strides for tables. Works on multi-GB files.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | File to probe. |
| length | integer | – | Bytes in the hex view (default 256, max 4096). |
| maxMB | integer | – | MiB to scan for entropy/embedded files (default 512). |
| offset | integer | – | Start offset (default 0). |
No output schema declared.
No examples provided.
re_refs Audit Unity GUID references ~138
Audits a Unity project's GUID references: references to GUIDs no .meta file declares (dangling: missing scripts, pink materials), the same GUID in two .meta files (copies made outside Unity), assets without a .meta, .meta files whose asset is gone, and declared assets nothing references. For dangling script references it suggests scripts that nothing references. Reports only; nothing is written. Fix by re-linking in Unity or by setting the suggested guid in the right .meta.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max items per list (default 200). |
| path | string | yes | Unity project root, or any folder/file inside it. |
No output schema declared.
No examples provided.
re_report Write an architecture report ~79
Writes ARCHITECTURE.md for a project: stack, languages, entry points, mermaid module graph, cycles, most-used files, scene trees of the entry scenes, class table, possibly unused files and external dependencies.
| Name | Type | Req | Description |
|---|---|---|---|
| out | string | – | Output .md path (default: workspace/reports). |
| path | string | yes | Project folder. |
No output schema declared.
No examples provided.
re_save Analyse a save file ~285
Peels the open layers of a save file (gzip/zlib, base64, LZ-String as RPG Maker MV/MZ uses, JSON, XML, INI/ConfigFile, Godot store_var) and lists every field with type, sample and a guessed role (health, currency, score, position, progress, collection, time, version, identity, integrity, rng, settings). Checksum fields are verified by recomputing md5/sha1/sha256/crc32 over the save without that field; binary saves are checked for CRC32 trailers/headers and get record strides and strings. compare:<second save> lists the fields that changed between two saves, the fastest way to learn which field is which. action:"schema" writes a JSON schema plus SaveData.gd and SaveData.cs with the same field names, to port the save format. Encrypted, XOR-obfuscated, .NET BinaryFormatter and pickle content is reported, never decoded.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | inspect (default) or schema (write schema + data classes). |
| compare | string | – | A second save of the same game to diff against. |
| file | string | yes | The save file. |
| limit | integer | – | Max fields/changes (default 400). |
| out | string | – | schema: folder for the files (default workspace/saves). |
No output schema declared.
No examples provided.
re_scan Scan a project or game folder ~124
Reconnaissance of a folder: detects the engine/framework (Godot, Unity, Unreal, GameMaker, RPG Maker, Ren'Py, LÖVE, Defold, Bevy, MonoGame, three.js/Phaser/Electron, Flutter, .NET, Go, Rust, Python…) for source projects AND exported game builds, languages with line counts, file categories, entry points, biggest files and binaries. Start here.
| Name | Type | Req | Description |
|---|---|---|---|
| maxFiles | integer | – | Stop after this many files (default 50000). |
| path | string | yes | Folder to scan. |
No output schema declared.
No examples provided.
re_scene Read a scene, prefab or project file ~105
Reads Godot .tscn/.tres/project.godot (Godot 3 and 4) and Unity .unity/.prefab/.asset (text serialization) into one neutral tree: node names, types, scripts, transforms (position, quaternion, scale), components, groups/tags, instanced scenes/prefabs (resolved through .meta GUIDs), signal connections, plus a mermaid diagram.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Scene/prefab/project file. |
No output schema declared.
No examples provided.
re_strings Extract and apply translatable text ~301
Localisation: extracts user-facing text with stable ids from Godot scenes/resources and GDScript (text, tooltips, tr()), Unity YAML (m_Text, TextMeshPro) and C#, RPG Maker MV/MZ data (Show Text, choices, database names, terms), Ren'Py scripts (say, menu), web code and i18n JSON files. Writes a catalog plus .pot (gettext) and/or CSV with file:line references and placeholder hints. action:"apply" takes a translated .po/.csv/.json and writes a translated COPY of the project into out, checking placeholders and flagging strings that grew a lot. The source is never modified.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | extract (default) or apply. |
| format | string | – | extract: json (default), po, csv or all. |
| lang | string | – | Language code for the output (e.g. nl). |
| limit | integer | – | Entries to return inline (default 500; the files hold all). |
| match | string | – | Only files whose path contains this. |
| out | string | – | extract: folder for the catalog/.pot/.csv (default workspace/strings). apply: new or empty folder for the translated copy. |
| path | string | yes | Project folder. |
| translations | string | – | apply: translated .po, .csv (id|source + translation columns) or .json ({id|source: translation}). |
No output schema declared.
No examples provided.
re_symbols Classes, functions, signals ~149
Code structure for one file or a whole folder (30+ languages: GDScript, C#, C/C++ incl. Unreal macros, Python, JS/TS, Lua, Java/Kotlin, Go, Rust, Swift, shaders, Ren'Py…): classes with base classes, functions with lines, signals/events, exported/serialized fields, dependencies, node paths. match filters by name (substring or * wildcard).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max files (default 25; each file lists up to 40 functions unless match narrows it). |
| match | string | – | Filter names (e.g. "player", "*_process"). |
| path | string | yes | File or folder. |
No output schema declared.
No examples provided.
run_batch Run several tools in one call ~134
Runs up to 20 tool calls in order (ReversePort's tools and engine tools) and returns their results together, so a plan of small steps costs one round trip. select keeps only the fields you need from each result (dot paths like "primary.id", "entryPoints[0].file" or "items[*].file"), which keeps the answer small. Stops at the first error unless continueOnError is true; the error says which call failed and why.
| Name | Type | Req | Description |
|---|---|---|---|
| calls | array | yes | The calls, in order. |
| continueOnError | boolean | – | Run the remaining calls after an error (default false). |
No output schema declared.
No examples provided.
search_procedures Search Procedures ~263
Search every analyzed procedure name using literal matching by default or regex when requested. Results are deterministic and complete. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker. The matching deadline is REA_REGEX_MATCHING_DEADLINE_MS (a positive decimal integer of milliseconds from 1 to 2147483647, default 5000). Unset keeps the default. A deadline failure names the effective milliseconds, source (default or setting), the default, and the maximum, and leaves the API usable. The worker old-generation request is REA_REGEX_WORKER_HEAP_REQUEST_MIB (a decimal integer of mebibytes from 7 to 16384, default 128). Unset keeps the default. A positive Node --max-old-space-size, including NODE_OPTIONS, overrides that request and is not limited by the setting's floor or maximum. A heap failure names the effective request, its source (default or setting), the default, the floor, and the maximum. Select detail summary for counts and retained native-inventory pages; complete remains the default.
| Name | Type | Req | Description |
|---|---|---|---|
| case_sensitive | boolean | – | – |
| detail | string | – | – |
| document | string | – | – |
| mode | string | – | – |
| pattern | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| analysis_profile | – | yes | – |
| authority | – | yes | – |
| caller_input_path | – | – | – |
| confidence | – | yes | – |
| environment | – | yes | – |
| evidence_id | – | yes | – |
| evidence_links | – | yes | – |
| limitations | – | yes | – |
| locations | – | yes | – |
| normalized_result | – | yes | – |
| operation | – | yes | – |
| parameters | – | yes | – |
| predicate_type | – | yes | – |
| provider | – | yes | – |
| raw_result | – | yes | – |
| relationship_coverage | – | yes | – |
| subject | – | yes | – |
No examples provided.
search_strings Search Strings ~362
Search every provider-reported string object or candidate using literal matching by default or regex when requested. Results are deterministic and complete over that provider inventory, not every text sequence in artifact bytes. Kuna scans mapped sequences of at least five characters, including unterminated fragments, without computing references. Ghidra may omit packed or undefined literals, including Rust strings; an empty result does not prove text is absent. If an address is known, read_bytes and xrefs inspect its bytes and references. Hopper retains typed byte decoding, native display, and explicit decoding unknowns. Adjacent long-literal fragments match independently. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker. The matching deadline is REA_REGEX_MATCHING_DEADLINE_MS (a positive decimal integer of milliseconds from 1 to 2147483647, default 5000). Unset keeps the default. A deadline failure names the effective milliseconds, source (default or setting), the default, and the maximum, and leaves the API usable. The worker old-generation request is REA_REGEX_WORKER_HEAP_REQUEST_MIB (a decimal integer of mebibytes from 7 to 16384, default 128). Unset keeps the default. A positive Node --max-old-space-size, including NODE_OPTIONS, overrides that request and is not limited by the setting's floor or maximum. A heap failure names the effective request, its source (default or setting), the default, the floor, and the maximum. Select detail summary for counts and retained native-inventory pages; complete remains the default.
| Name | Type | Req | Description |
|---|---|---|---|
| case_sensitive | boolean | – | – |
| detail | string | – | – |
| document | string | – | – |
| mode | string | – | – |
| pattern | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| analysis_profile | – | yes | – |
| authority | – | yes | – |
| caller_input_path | – | – | – |
| confidence | – | yes | – |
| environment | – | yes | – |
| evidence_id | – | yes | – |
| evidence_links | – | yes | – |
| limitations | – | yes | – |
| locations | – | yes | – |
| normalized_result | – | yes | – |
| operation | – | yes | – |
| parameters | – | yes | – |
| predicate_type | – | yes | – |
| provider | – | yes | – |
| raw_result | – | yes | – |
| relationship_coverage | – | yes | – |
| subject | – | yes | – |
No examples provided.
set_tool_profile Fit the tool list to your context ~90
Switches how many tools are listed and how long their descriptions are: compact (small or older models, small context), standard (default), full (every engine tool). Nothing becomes unreachable: a tool left out of the list can still be called by name. Clients that support list changes refresh automatically; others see it on the next tools/list.
| Name | Type | Req | Description |
|---|---|---|---|
| profile | string | yes | compact, standard or full. |
No output schema declared.
No examples provided.
share_feedback Tell the maintainers what helped or got in the way ~160
Optional, any time: note what worked, what was confusing or slow, and what would help next time. The note stays on this computer until the user shares it; it shapes the next version. It never changes your task.
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | Who you are, if you like (client, model). |
| friction | string | – | What got in the way: unclear text, wasted calls, too much output, errors without a next step… |
| rating | integer | – | How well it served the task, 1 (poorly) to 5 (very well). |
| suggestion | string | – | What would help. |
| tool | string | – | Tool the note is about (if any). |
| worked | string | – | What helped. |
No output schema declared.
No examples provided.
trace_application_feature Trace Application Feature ~104
Trace a typed literal seed through every reachable part of an authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.
| Name | Type | Req | Description |
|---|---|---|---|
| application | object | yes | – |
| direction | string | – | Direction in which to traverse or compare relationships. |
| native_observations | array | – | – |
| seed | object | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| analysis_profile | – | yes | – |
| authority | – | yes | – |
| caller_input_path | – | – | – |
| confidence | – | yes | – |
| environment | – | yes | – |
| evidence_id | – | yes | – |
| evidence_links | – | yes | – |
| limitations | – | yes | – |
| locations | – | yes | – |
| normalized_result | – | yes | – |
| operation | – | yes | – |
| parameters | – | yes | – |
| predicate_type | – | yes | – |
| provider | – | yes | – |
| raw_result | – | yes | – |
| relationship_coverage | – | yes | – |
| subject | – | yes | – |
No examples provided.
xrefs Xrefs ~92
Return analyzed references to a code or data address. Hopper may default to its current cursor; headless providers such as Ghidra require an explicit address. Use to connect strings, globals, selectors, and functions; bare addresses are untyped and indirect references may be incomplete. Use inspect_native_instruction at the target address for typed incoming references where supported.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | – |
| document | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| analysis_profile | – | yes | – |
| authority | – | yes | – |
| caller_input_path | – | – | – |
| confidence | – | yes | – |
| environment | – | yes | – |
| evidence_id | – | yes | – |
| evidence_links | – | yes | – |
| limitations | – | yes | – |
| locations | – | yes | – |
| normalized_result | – | yes | – |
| operation | – | yes | – |
| parameters | – | yes | – |
| predicate_type | – | yes | – |
| provider | – | yes | – |
| raw_result | – | yes | – |
| relationship_coverage | – | yes | – |
| subject | – | yes | – |
No examples provided.
How do I install the ReversePort MCP server?
ReversePort runs locally as an npm package, launched with npx -y reverseport. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · reverseport
claude mcp add laaielichter-reverseport -- npx -y reverseport
What is the ReversePort MCP server?
ReversePort is an MCP server listed in the public MCP registry as io.github.laaielichter/reverseport. Reverse engineer and port apps and games: Godot, Unity IL2CPP, .NET, binaries, with parity checks. This page covers its npm package (reverseport).
Is the ReversePort MCP server safe to use?
ReversePort scores 87 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ReversePort MCP server expose?
ReversePort exposes 57 tools: re_scan, re_graph, re_symbols, re_scene, re_binary, and 52 more. Their descriptions and schemas cost roughly 14,524 tokens of context every time the server is loaded.
Is the ReversePort MCP server still maintained?
ReversePort is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the ReversePort MCP server under?
ReversePort declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.