Reversecore MCP

Show the current seek position and function name.

Retrieve the function signature at the specified address.

Scan the entire binary for strings with optional regex filter. More thorough than list_strings, but slower.

List class names from various languages (C++, ObjC, Swift, Java, Dalvik).

Show all available decompiler backends.

Display program entrypoints, constructors and main function.

List all functions discovered during analysis.

List functions and their successors (call tree).

List imported symbols. Note: Use list_symbols for addresses with sym.imp. prefix.

List all shared libraries linked to the binary.

List all methods belonging to the specified class.

Display memory sections and segments from the binary.

List strings from data sections with optional regex filter.

Show all symbols (functions, variables, imports) with addresses.

Opens a binary file with radare2 for analysis. Call this tool before any other r2mcp tool. Use an absolute file_path.

Rename a flag (variable or data reference) at the specified address.

Rename the function at the specified address.

Execute a raw radare2 command directly. NOTE: Only analysis commands are allowed. Write and shell commands are blocked.

Add a comment at the specified address.

Set the function signature (return type, name, arguments).

Display detailed information about a function.

Display binary headers and file information.

Select which decompiler backend to use.

Find all code references TO the specified address.

Search and recall memories from past analyses. Use this when you need to remember something from earlier, or when the user asks about previous findings.

Detect dynamic PEB/TEB walking and resolve 32-bit API hashes to Windows export symbols. Matches constants found in instructions or data sections against precomputed hash tables (ROR13, CRC32, MurmurHash3, FNV-1a, DJB2, SDBM) for standard Windows libraries (ntdll, kernel32, user32, advapi32, ws2_32, wininet, winhttp, etc.).

Resume a previous analysis session with full context restoration. Use this when the user says "continue where we left off" or "resume yesterday's analysis".

Analyze binaries for embedded content using binwalk.

Extract embedded files and file systems from a binary using binwalk. This tool performs deep extraction of embedded content, including: - Compressed archives (gzip, bzip2, lzma, xz) - File systems (squashfs, cramfs, jffs2, ubifs) - Firmware images and bootloaders - Nested/matryoshka content (files within files) **Use Cases:** - **Firmware Analysis**: Extract file systems from router/IoT firmware - **Malware Unpacking**: Extract payloads from packed/embedded malware - **Forensics**: Recover embedded files from disk images - **CTF Challenges**: Extract hidden data from challenge files

Analyze binary capabilities using CAPA (Mandiant FLARE). CAPA identifies capabilities in executable files and provides high-level behavioral information such as: - "encrypt data using AES" - "delete files" - "communicate via HTTP" - "create persistence via registry"

Quick CAPA scan returning only high-risk capabilities. Faster than full run_capa, focuses on: - Anti-analysis techniques - Persistence mechanisms - C2 communication - Data exfiltration - Impact capabilities

Run all deobfuscation engines concurrently and assemble a unified intelligence report. Executes stack string recovery, emulated loop decryption, API hash resolution, and opaque predicate dead code elimination, producing a comprehensive report with threat tags and detected malware capabilities.

Identify file metadata using the ``file`` CLI utility.

Run a real AFL++ fuzzing campaign and automatically triage all crashes. This tool bridges ``generate_fuzzing_harness`` and ``triage_crash`` into a complete, automated fuzzing pipeline: 1. **Setup**: Creates a temporary seed corpus and output directory. 2. **Fuzz**: Runs ``afl-fuzz`` for ``timeout_seconds``, sending inputs via ``@@`` file substitution or stdin depending on ``use_stdin``. 3. **Collect**: Gathers all unique crash files from the AFL++ output directory, deduplicated by content signature. 4. **Triage**: Runs ``triage_crash`` (GDB) on each unique crash to assess exploitability (CONFIRMED / LIKELY / POSSIBLE / UNKNOWN). 5. **Report**: Returns a structured report with crash statistics, triage results sorted by severity, and actionable next steps.

Execute vetted radare2 commands for binary triage.

Extract printable strings using the ``strings`` CLI.

Scan binaries against YARA rules via ``yara-python`` with modular namespace support.

Save important information to long-term memory. Use this to remember: - Function addresses and their purposes - Vulnerability patterns discovered - API call sequences - User instructions and preferences - Interesting strings or structures

Save a code/behavior pattern for cross-session similarity search. Use this when you discover a notable pattern that might appear in other samples. This enables "Hey, this looks similar to before!"

Extract library version strings and CVE clues from a binary. This tool acts as a "Version Detective", scanning the binary for strings that look like version numbers or library identifiers (e.g., "OpenSSL 1.0.2g", "GCC 5.4.0"). It helps identify outdated components and potential CVEs. **Use Cases:** - **SCA (Software Composition Analysis)**: Identify open source components - **Vulnerability Scanning**: Find outdated libraries (e.g., Heartbleed-vulnerable OpenSSL) - **Firmware Analysis**: Determine OS and toolchain versions

Batch scan all files in the workspace using multiple tools in parallel. This tool performs a comprehensive scan of the workspace to identify files, analyze binaries, and detect threats. It runs 'run_file', 'parse_binary_with_lief', and 'run_yara' (if rules exist) on all matching files concurrently. **Workflow:** 1. Identify files matching patterns (default: all files) 2. Run 'file' command on all files 3. Run 'LIEF' analysis on executable files 4. Run 'YARA' scan if rules are available 5. Aggregate results into a single report

Update the severity level of the analysis.

Set the default timezone for timestamps.

Start a new malware analysis session. Automatically tracks start time, sample hashes, IOCs, and MITRE techniques.

Automatically trace taint paths from user input sources to dangerous sinks. This tool performs automated taint analysis by: 1. **Source discovery**: Finds all calls to user-input functions (``read``, ``fgets``, ``recv``, ``getenv``, ``argv``, etc.) via radare2 xrefs. 2. **Sink discovery**: Finds all calls to dangerous functions (``strcpy``, ``system``, ``execve``, ``sprintf``, etc.) and maps their CWE class. 3. **Path verification** (optional): For each source→sink pair, invokes the angr symbolic execution engine (``angr_worker.py``) to check whether the sink is actually reachable from the source with user-controlled data. If reachable, angr also extracts a **concrete input** that triggers the sink. 4. **Report**: Returns ranked taint paths sorted by severity and reachability.

Trace function calls backwards from a target function (Sink) to find potential execution paths. This tool helps identify "Exploit Paths" by finding which functions call a dangerous target function (like 'system', 'strcpy', 'execve'). It performs a recursive cross-reference analysis (backtrace) to map out how execution reaches the target. **Use Cases:** - **Vulnerability Analysis**: Check if user input (main/recv) reaches 'system' - **Reachability Analysis**: Verify if a vulnerable function is actually called - **Taint Analysis Helper**: Provide the path for AI to perform manual taint checking **Performance Optimizations (v3.0):** - Reduced default depth (3→2) for faster analysis - Sink-aware pruning: prioritizes paths through dangerous APIs - Dynamic timeout based on file size

Analyze a crash file against a binary using GDB to determine exploitability.

Update the cumulative analysis time for a session. Call this periodically to track how long an analysis takes.

Run symbolic execution using angr to verify path reachability and extract inputs. Allows proving path reachability to a target instruction and extracting concrete inputs.

Look up IOC reputation using the VirusTotal API v3. Accepts a list of file hashes (MD5/SHA1/SHA256), IP addresses, domain names, and URLs. Returns per-IOC verdict, detection counts, and enrichment data from VirusTotal's 70+ security vendors. **API key required**: Set ``REVERSECORE_VT_API_KEY`` environment variable, or pass the key directly via the ``api_key`` parameter.