Reversecore MCP

Generate and verify a pwntools proof-of-concept exploit script. Converts the output of ``vulnerability_hunter`` (symbolic execution concrete input + crash metadata) into a runnable Python POC script using pwntools. Automatically verifies the POC by executing it against the binary and checking for fatal crash signals.

Generate a Sigma rule (YAML) for SIEM integration based on extracted IOCs or API calls.

Generate a YARA signature from opcode bytes at a specific address. This tool extracts opcode bytes from a function or code section and formats them as a YARA rule, enabling automated malware detection. It attempts to mask variable values (addresses, offsets) to create more flexible signatures. **Use Cases:** - Generate detection signatures for malware samples - Create YARA rules for threat hunting - Automate IOC (Indicator of Compromise) generation - Build malware family signatures **Workflow:** 1. Extract opcode bytes from specified address 2. Apply basic masking for variable values (optional) 3. Format as YARA rule template 4. Return ready-to-use YARA rule

Generate a CSAF 2.0 VEX JSON report from vulnerability findings. VEX (Vulnerability Exploitability eXchange) is a format for sharing the exploitability status of a software product in a machine-readable way.

Generate a YARA rule from function bytes. This tool extracts bytes from a function and generates a ready-to-use YARA rule for malware detection and threat hunting.

Retrieve the status and result of a background job from the task queue.

Get complete details and context for a specific session. Use this when resuming an analysis or reviewing past work. Returns all memories and patterns associated with the session.

Get relevant context from past analyses for current work. Use this proactively when analyzing something new to check if there's relevant knowledge from previous sessions.

Get current session information and collected data.

Get the current health status and resource usage of the MCP server. Use this to monitor the server's uptime, memory consumption, and tool execution statistics. Returns: ToolResult containing: - uptime_seconds: Server uptime - memory_usage_mb: Current memory usage in MB - status: 'healthy' or 'degraded' - tool_stats: Summary of tool execution success/failure

Get accurate system timestamp from the server. Returns OS-level time data to prevent AI date hallucination. Includes multiple formats (ISO, Unix, human-readable) and timezone info. Returns: JSON with report_id, date formats, time formats, timezone info

Get current timezone configuration and available options. Returns: JSON with current timezone, offset, and all available timezones

Get detailed execution metrics for specific or all tools.

One-click automated CVE hunting pipeline for C/C++ libraries, parsers, and codecs. Performs end-to-end vulnerability discovery: 1. Harness & Dictionary auto-synthesis 2. Hybrid Fuzzing + angr concolic branch solving 3. ASan crash triage, CWE mapping, and CVSS v3.1 scoring 4. Testcase minimization & standalone PoC generation 5. Vendor-ready Security Advisory Markdown report draft

List all analysis sessions with timestamps and status. Use this to see what analyses have been done before, or to find a session to resume.

List all analysis sessions with their status and duration. Returns: List of all sessions with summary information

List all files in the workspace directory. Returns: ToolResult with list of files in workspace

Match and filter known library functions to focus on user code. This tool uses radare2's zignatures (FLIRT-compatible signature matching) to: - **Reduce Analysis Noise**: Skip analysis of known library functions (strcpy, malloc, etc.) - **Focus on User Code**: Identify which functions are original vs library code - **Save Time & Tokens**: Reduce analysis scope by 80% by filtering out standard libraries - **Improve Accuracy**: Focus AI analysis on the actual malicious/interesting code Common use cases: - Analyzing large binaries (>25MB) where most code is OpenSSL, zlib, MFC, etc. - Game client reverse engineering (filter out Unreal Engine / Unity standard library) - Malware analysis (focus on custom malware code, skip Windows API wrappers) The tool automatically uses built-in signature databases for common libraries and can optionally use custom signature databases for specialized analysis.

Run a Volatility3 plugin against a memory dump file. Supports Windows, Linux, and macOS memory dumps. Heavy plugin operations (malfind, psscan, netscan) are queued via ARQ for non-blocking execution.

Detect process injection and suspicious memory regions using Volatility3 malfind. Uses the ``malfind`` plugin to identify memory regions with executable permissions that contain suspicious patterns (MZ headers, shellcode signatures).

Dump a loaded module or DLL from a memory dump via Volatility3.

Extract ASCII and Unicode strings from a memory dump.

List all running processes from a memory dump.

List available Volatility3 symbol tables for a memory dump. Volatility3 requires OS-specific symbol tables (ISF files) to run most plugins. Use this tool to inspect which symbol tables are currently available, then load the appropriate one using ``memory_load_symbols`` before running analysis plugins.

Deep fingerprinting of binary packers, cryptors, protectors, and compilers. Computes whole-file & block-level Shannon entropy, checks for known packer signatures (UPX, Themida, VMProtect, ASPack, PyInstaller, ConfuserEx, etc.), identifies section anomalies (e.g., W+X violations, 0-raw size sections, entrypoint in last section), and inspects appended overlays.

Parse binary metadata using LIEF and return structured results. Memory-safe implementation with progressive limits: - Under 100MB: Full parsing with all details - 100-500MB: Warning + reduced extraction limits - Over 500MB: Minimal parsing (headers only) - Over config limit: Rejected

Analyze patch differences for 1-day vulnerability analysis. This tool focuses on identifying security fixes between two versions of a binary. It highlights changed functions, basic blocks, and potential vulnerability indicators that were patched (e.g. added bounds checks).

Summarize sessions, protocols, and packet statistics from a PCAP file. Provides a high-level overview including total packets, unique hosts, protocol distribution, top talkers, and session summary — ideal as a first-pass triage of a PCAP capture.

Detect potential C2 traffic patterns in a PCAP capture. Detects: - Beaconing behavior (periodic connections to same host) - Connections to known suspicious ports - Unusually long/persistent connections - DNS-over-HTTPS (DoH) patterns

Extract DNS queries and responses from a PCAP capture. Useful for identifying C2 domain lookups, DGA patterns, DNS tunneling, and suspicious resolution activity.

List all unique IP/port connections observed in a PCAP capture.

Reconstruct TCP stream payload from a PCAP capture. Reassembles the raw payload of a specific TCP conversation, useful for extracting transferred files, command output, or HTTP request/response bodies.

Add (or update) an annotated bookmark at a binary address.

Return full metadata for a binary function via radare2. Retrieves name, size, cyclomatic complexity, arguments, local variables, call targets, and cross-references using radare2's JSON APIs.

Save (or replace) a C struct definition in the annotation DB.

Decompile a binary function to pseudo-C using the r2ghidra plugin. Uses the ``pdg`` command which invokes the embedded Ghidra decompiler engine inside radare2 — no separate Ghidra or JDK installation required. Includes smart line windowing and function summary header for token efficiency.

Generate a caller/callee call graph for a function. Uses radare2's ``agCd`` (call-graph dot) and ``axtj`` (cross-reference JSON) commands to build a structured graph.

Retrieve a single saved struct definition by name.

List all saved bookmarks / address annotations for a binary.

List all saved C struct definitions for a binary.

List all custom type definitions saved for a binary.

Read raw bytes from a binary at a given virtual address.

Recover C struct layouts from a function's memory access patterns. Analyses local variables (``afvf``), function arguments (``afvj``), and cross-references (``axtj``) to infer struct field offsets and types.

Simulate a byte-level patch at an address and re-decompile. Copies the binary to a temporary workspace cache file, opens that copy in write mode, applies ``patch_bytes`` at ``address``, then runs r2ghidra's ``pdg``. The original file remains read-only throughout the simulation.

Run binary analysis with optional depth level.

Evaluate a math expression using radare2's number parser. Useful for: 64-bit math, resolving addresses for symbols, avoiding hallucinated results.

Close the currently open radare2 session for a file.

Show C-like pseudocode of the function at the given address. Use this to inspect code in a function. Do not run multiple times on the same offset. Includes smart line windowing and function summary header.

Disassemble a specific number of instructions from an address. Use this to inspect a portion of memory as code without depending on function analysis boundaries.

Show assembly listing of the function at the specified address.