Reversecore MCP

Display binary headers and file information.

Select which decompiler backend to use.

Find all code references TO the specified address.

Search and recall memories from past analyses. Use this when you need to remember something from earlier, or when the user asks about previous findings.

Resume a previous analysis session with full context restoration. Use this when the user says "continue where we left off" or "resume yesterday's analysis".

Analyze binaries for embedded content using binwalk.

Extract embedded files and file systems from a binary using binwalk. This tool performs deep extraction of embedded content, including: - Compressed archives (gzip, bzip2, lzma, xz) - File systems (squashfs, cramfs, jffs2, ubifs) - Firmware images and bootloaders - Nested/matryoshka content (files within files) **Use Cases:** - **Firmware Analysis**: Extract file systems from router/IoT firmware - **Malware Unpacking**: Extract payloads from packed/embedded malware - **Forensics**: Recover embedded files from disk images - **CTF Challenges**: Extract hidden data from challenge files

Analyze binary capabilities using CAPA (Mandiant FLARE). CAPA identifies capabilities in executable files and provides high-level behavioral information such as: - "encrypt data using AES" - "delete files" - "communicate via HTTP" - "create persistence via registry"

Quick CAPA scan returning only high-risk capabilities. Faster than full run_capa, focuses on: - Anti-analysis techniques - Persistence mechanisms - C2 communication - Data exfiltration - Impact capabilities

Identify file metadata using the ``file`` CLI utility.

Run a real AFL++ fuzzing campaign and automatically triage all crashes. This tool bridges ``generate_fuzzing_harness`` and ``triage_crash`` into a complete, automated fuzzing pipeline: 1. **Setup**: Creates a temporary seed corpus and output directory. 2. **Fuzz**: Runs ``afl-fuzz`` for ``timeout_seconds``, sending inputs via ``@@`` file substitution or stdin depending on ``use_stdin``. 3. **Collect**: Gathers all unique crash files from the AFL++ output directory, deduplicated by content signature. 4. **Triage**: Runs ``triage_crash`` (GDB) on each unique crash to assess exploitability (CONFIRMED / LIKELY / POSSIBLE / UNKNOWN). 5. **Report**: Returns a structured report with crash statistics, triage results sorted by severity, and actionable next steps.

Execute vetted radare2 commands for binary triage.

Extract printable strings using the ``strings`` CLI.

Scan binaries against YARA rules via ``yara-python``.

Save important information to long-term memory. Use this to remember: - Function addresses and their purposes - Vulnerability patterns discovered - API call sequences - User instructions and preferences - Interesting strings or structures

Save a code/behavior pattern for cross-session similarity search. Use this when you discover a notable pattern that might appear in other samples. This enables "Hey, this looks similar to before!"

Extract library version strings and CVE clues from a binary. This tool acts as a "Version Detective", scanning the binary for strings that look like version numbers or library identifiers (e.g., "OpenSSL 1.0.2g", "GCC 5.4.0"). It helps identify outdated components and potential CVEs. **Use Cases:** - **SCA (Software Composition Analysis)**: Identify open source components - **Vulnerability Scanning**: Find outdated libraries (e.g., Heartbleed-vulnerable OpenSSL) - **Firmware Analysis**: Determine OS and toolchain versions

Batch scan all files in the workspace using multiple tools in parallel. This tool performs a comprehensive scan of the workspace to identify files, analyze binaries, and detect threats. It runs 'run_file', 'parse_binary_with_lief', and 'run_yara' (if rules exist) on all matching files concurrently. **Workflow:** 1. Identify files matching patterns (default: all files) 2. Run 'file' command on all files 3. Run 'LIEF' analysis on executable files 4. Run 'YARA' scan if rules are available 5. Aggregate results into a single report

Automatically trace taint paths from user input sources to dangerous sinks. This tool performs automated taint analysis by: 1. **Source discovery**: Finds all calls to user-input functions (``read``, ``fgets``, ``recv``, ``getenv``, ``argv``, etc.) via radare2 xrefs. 2. **Sink discovery**: Finds all calls to dangerous functions (``strcpy``, ``system``, ``execve``, ``sprintf``, etc.) and maps their CWE class. 3. **Path verification** (optional): For each source→sink pair, invokes the angr symbolic execution engine (``angr_worker.py``) to check whether the sink is actually reachable from the source with user-controlled data. If reachable, angr also extracts a **concrete input** that triggers the sink. 4. **Report**: Returns ranked taint paths sorted by severity and reachability.

Trace function calls backwards from a target function (Sink) to find potential execution paths. This tool helps identify "Exploit Paths" by finding which functions call a dangerous target function (like 'system', 'strcpy', 'execve'). It performs a recursive cross-reference analysis (backtrace) to map out how execution reaches the target. **Use Cases:** - **Vulnerability Analysis**: Check if user input (main/recv) reaches 'system' - **Reachability Analysis**: Verify if a vulnerable function is actually called - **Taint Analysis Helper**: Provide the path for AI to perform manual taint checking **Performance Optimizations (v3.0):** - Reduced default depth (3→2) for faster analysis - Sink-aware pruning: prioritizes paths through dangerous APIs - Dynamic timeout based on file size

Analyze a crash file against a binary using GDB to determine exploitability.

Update the cumulative analysis time for a session. Call this periodically to track how long an analysis takes.

Run symbolic execution using angr to verify path reachability and extract inputs. Allows proving path reachability to a target instruction and extracting concrete inputs.

Look up IOC reputation using the VirusTotal API v3. Accepts a list of file hashes (MD5/SHA1/SHA256), IP addresses, domain names, and URLs. Returns per-IOC verdict, detection counts, and enrichment data from VirusTotal's 70+ security vendors. **API key required**: Set ``REVERSECORE_VT_API_KEY`` environment variable, or pass the key directly via the ``api_key`` parameter.

Automated vulnerability discovery combining multiple analysis techniques. This tool performs a comprehensive security analysis: 1. Scans for dangerous API calls (buffer overflow, command injection, etc.) 2. Traces back to find how each dangerous call is reached 3. Identifies if inputs are user-controllable (light taint analysis) 4. Generates vulnerability report with YARA detection rules