# Reversecore MCP

Brings 177 security utilities to your coding assistant for binary analysis, memory forensics, and vulnerability research.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 212
- Author: sjkim1127
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sjkim1127/Reversecore_MCP
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/reversecore-mcp

## What it does

Reversecore MCP runs on FastMCP and bundles tools for low-level security analysis. It exposes engines like Radare2, r2ghidra, Volatility3, Scapy, and YARA directly to your client. You can inspect compiled binaries, dissect network packet dumps, and run static source audits without typing manual terminal commands.

The server organizes 177 analysis tools, 22 structured workflows, and 11 dynamic URI resources. It manages Radare2 instances through a thread-safe connection pool. Findings survive across agent sessions by saving data into an async SQLite database.

Running the server requires Python 3.10, 3.11, or 3.12. The symbolic analysis engine `angr` installs exclusively on Python 3.12, so setups on Python 3.10 and 3.11 omit that module.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add reversecore-mcp -- uvx reversecore-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from reversecore-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add reversecore-mcp -- uvx reversecore-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from reversecore-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "reversecore-mcp": {
            "command": "uvx",
            "args": [
                "reversecore-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from reversecore-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "reversecore-mcp": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "reversecore-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from reversecore-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add reversecore-mcp uvx reversecore-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from reversecore-mcp <command>

## When to use it
- decompile binary functions using r2ghidra
- extract indicators of compromise from suspicious binaries
- inspect memory dumps via Volatility3
- map discovered software behaviors to MITRE ATT&CK
- audit C and C++ source code with regex patterns

## Example prompts
- Decompile the main function of sample.exe and extract its network IOCs.
- Scan firmware.bin using binwalk and flag matching YARA rules.
- Analyze the traffic.pcap capture with Scapy to list outbound connections.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md