Reversecore MCP

Get relevant context from past analyses for current work. Use this proactively when analyzing something new to check if there's relevant knowledge from previous sessions.

Get the current health status and resource usage of the MCP server. Use this to monitor the server's uptime, memory consumption, and tool execution statistics. Returns: ToolResult containing: - uptime_seconds: Server uptime - memory_usage_mb: Current memory usage in MB - status: 'healthy' or 'degraded' - tool_stats: Summary of tool execution success/failure

Get detailed execution metrics for specific or all tools.

One-click automated CVE hunting pipeline for C/C++ libraries, parsers, and codecs. Performs end-to-end vulnerability discovery: 1. Harness & Dictionary auto-synthesis 2. Hybrid Fuzzing + angr concolic branch solving 3. ASan crash triage, CWE mapping, and CVSS v3.1 scoring 4. Testcase minimization & standalone PoC generation 5. Vendor-ready Security Advisory Markdown report draft

List all analysis sessions with timestamps and status. Use this to see what analyses have been done before, or to find a session to resume.

List all files in the workspace directory. Returns: ToolResult with list of files in workspace

Match and filter known library functions to focus on user code. This tool uses radare2's zignatures (FLIRT-compatible signature matching) to: - **Reduce Analysis Noise**: Skip analysis of known library functions (strcpy, malloc, etc.) - **Focus on User Code**: Identify which functions are original vs library code - **Save Time & Tokens**: Reduce analysis scope by 80% by filtering out standard libraries - **Improve Accuracy**: Focus AI analysis on the actual malicious/interesting code Common use cases: - Analyzing large binaries (>25MB) where most code is OpenSSL, zlib, MFC, etc. - Game client reverse engineering (filter out Unreal Engine / Unity standard library) - Malware analysis (focus on custom malware code, skip Windows API wrappers) The tool automatically uses built-in signature databases for common libraries and can optionally use custom signature databases for specialized analysis.

Run a Volatility3 plugin against a memory dump file. Supports Windows, Linux, and macOS memory dumps. Heavy plugin operations (malfind, psscan, netscan) are queued via ARQ for non-blocking execution.

Detect process injection and suspicious memory regions using Volatility3 malfind. Uses the ``malfind`` plugin to identify memory regions with executable permissions that contain suspicious patterns (MZ headers, shellcode signatures).

Dump a loaded module or DLL from a memory dump via Volatility3.

Extract ASCII and Unicode strings from a memory dump.

List all running processes from a memory dump.

List available Volatility3 symbol tables for a memory dump. Volatility3 requires OS-specific symbol tables (ISF files) to run most plugins. Use this tool to inspect which symbol tables are currently available, then load the appropriate one using ``memory_load_symbols`` before running analysis plugins.

Deep fingerprinting of binary packers, cryptors, protectors, and compilers. Computes whole-file & block-level Shannon entropy, checks for known packer signatures (UPX, Themida, VMProtect, ASPack, PyInstaller, ConfuserEx, etc.), identifies section anomalies (e.g., W+X violations, 0-raw size sections, entrypoint in last section), and inspects appended overlays.

Parse binary metadata using LIEF and return structured results. Memory-safe implementation with progressive limits: - Under 100MB: Full parsing with all details - 100-500MB: Warning + reduced extraction limits - Over 500MB: Minimal parsing (headers only) - Over config limit: Rejected

Analyze patch differences for 1-day vulnerability analysis. This tool focuses on identifying security fixes between two versions of a binary. It highlights changed functions, basic blocks, and potential vulnerability indicators that were patched (e.g. added bounds checks).

Summarize sessions, protocols, and packet statistics from a PCAP file. Provides a high-level overview including total packets, unique hosts, protocol distribution, top talkers, and session summary — ideal as a first-pass triage of a PCAP capture.

Detect potential C2 traffic patterns in a PCAP capture. Detects: - Beaconing behavior (periodic connections to same host) - Connections to known suspicious ports - Unusually long/persistent connections - DNS-over-HTTPS (DoH) patterns

Extract DNS queries and responses from a PCAP capture. Useful for identifying C2 domain lookups, DGA patterns, DNS tunneling, and suspicious resolution activity.

List all unique IP/port connections observed in a PCAP capture.

Reconstruct TCP stream payload from a PCAP capture. Reassembles the raw payload of a specific TCP conversation, useful for extracting transferred files, command output, or HTTP request/response bodies.

Add (or update) an annotated bookmark at a binary address.

Return full metadata for a binary function via radare2. Retrieves name, size, cyclomatic complexity, arguments, local variables, call targets, and cross-references using radare2's JSON APIs.

Save (or replace) a C struct definition in the annotation DB.

Decompile a binary function to pseudo-C using the r2ghidra plugin. Uses the ``pdg`` command which invokes the embedded Ghidra decompiler engine inside radare2 — no separate Ghidra or JDK installation required. Includes smart line windowing and function summary header for token efficiency.

Generate a caller/callee call graph for a function. Uses radare2's ``agCd`` (call-graph dot) and ``axtj`` (cross-reference JSON) commands to build a structured graph.

Retrieve a single saved struct definition by name.

List all saved bookmarks / address annotations for a binary.

List all saved C struct definitions for a binary.

List all custom type definitions saved for a binary.

Read raw bytes from a binary at a given virtual address.

Recover C struct layouts from a function's memory access patterns. Analyses local variables (``afvf``), function arguments (``afvj``), and cross-references (``axtj``) to infer struct field offsets and types.

Simulate a byte-level patch at an address and re-decompile. Opens the binary in write mode, applies ``patch_bytes`` (hex string) at ``address``, then runs r2ghidra's ``pdg`` to show the patched pseudo-C. **The original file is not modified** — radare2's ``-w`` flag patches a memory copy only.

Run binary analysis with optional depth level.

Evaluate a math expression using radare2's number parser. Useful for: 64-bit math, resolving addresses for symbols, avoiding hallucinated results.

Close the currently open radare2 session for a file.

Show C-like pseudocode of the function at the given address. Use this to inspect code in a function. Do not run multiple times on the same offset. Includes smart line windowing and function summary header.

Disassemble a specific number of instructions from an address. Use this to inspect a portion of memory as code without depending on function analysis boundaries.

Show assembly listing of the function at the specified address.

Show the current seek position and function name.

Retrieve the function signature at the specified address.

Scan the entire binary for strings with optional regex filter. More thorough than list_strings, but slower.

List class names from various languages (C++, ObjC, Swift, Java, Dalvik).

Show all available decompiler backends.

Display program entrypoints, constructors and main function.

List all functions discovered during analysis.

List functions and their successors (call tree).

List imported symbols. Note: Use list_symbols for addresses with sym.imp. prefix.

List all shared libraries linked to the binary.

List all methods belonging to the specified class.