# How the Bootstrap Process Works in Reverse-Skill and How to Customize Tool Installation

> Learn how the reverse-skill bootstrap process automates tool installation on Kali Linux with capability-based resolution and manifest-driven releases. Customize tool setup easily.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-05

---

**The reverse-skill bootstrap process provides a single-command installation system that uses capability-based resolution, manifest-driven GitHub releases, and optional MCP server registration to automate tool setup on Kali Linux.**

The reverse-skill repository streamlines penetration testing workflows through an automated bootstrap system centered on [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh). This script orchestrates tool discovery, installation verification, and service registration through a declarative manifest, while providing clear extension points for adding custom capabilities. Understanding this architecture allows security researchers to replicate environments reliably and integrate proprietary tools into the existing framework.

## Bootstrap Process Architecture

The bootstrap driver resides in [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) and executes in distinct phases, from argument parsing through result reporting.

### Entry Point and Argument Parsing

The script accepts capabilities as positional arguments with optional flags:

```bash
bash bootstrap-reverse.sh <capability1> [capability2 …] [--start-services] [--skip-refresh]

```

Lines **27‑38** iterate over `$@` to populate the `CAPABILITIES` array and set boolean flags `START_SERVICES` and `SKIP_REFRESH`. If no capability is provided, the script outputs a help block (lines **41‑72**) listing all built-in capability names.

Utility functions `log_info`, `log_ok`, `log_warn`, and `log_err` (lines **77‑80**) provide colored output, while `check_sudo` (lines **82‑91**) validates privilege escalation without hard-failing on missing sudo rights.

### Core Installation Primitives

The bootstrap abstracts package management through four wrapper functions:

- **`install_apt_package`** (lines **94‑103**): Wraps `apt-get install` with automatic sudo detection.
- **`install_pip_package`** (lines **105‑113**): Executes `pip3 install` with fallback to non-quiet mode on failure.
- **`install_npm_global`** (lines **115‑124**): Handles `npm install -g` with privilege checking.
- **`install_github_release`** (lines **126‑210**): Downloads GitHub release assets, verifies SHA‑256 checksums using `sha256sum`, and extracts archives using `curl` and `jq`.

### Capability Resolution with ensure_capability

The heart of the bootstrap process is **`ensure_capability`** (lines **26‑66**). For each requested capability, the function:

1. Checks if the binary exists via `command -v`.
2. Routes to the appropriate installation method through a **case statement**:
   - **APT-installable tools** (e.g., `nmap`, `radare2`): Use `install_apt_package`.
   - **MCP-related tools**: Install via APT plus registration via `register_mcp_server`.
   - **Python tools**: Installed through `install_pip_package`.
   - **GitHub-release tools**: Delegated to `install_manifest_release`, which reads from the JSON manifest.
   - **Node-based MCP bridges**: Ensures `node`/`npm` presence before registration.
   - **Manual-install tools**: Marks `MANUAL_REQUIRED` and emits warnings (e.g., `jeb-pro`).

If `START_SERVICES` is true and the capability requires a daemon (such as `anything-analyzer` or `idapro`), the script invokes the corresponding `start_*` function (lines **68‑86**).

### Manifest-Driven GitHub Releases

For capabilities not available in standard repositories, **`install_manifest_release`** (lines **98‑125**) provides declarative installation:

1. Reads [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) using the `manifest_field` helper (lines **88‑96**).
2. Extracts `repo`, `assetRegex`, `installDir`, `releaseTag`, and `assetSha256`.
3. Calls `install_github_release` with these parameters to download, verify, and unpack the binary.

This manifest acts as a **declarative catalogue** of third-party releases, eliminating hard-coded URLs from the main script.

### MCP Server Registration and Service Startup

When a tool exposes an MCP endpoint, **`register_mcp_server`** (lines **44‑68**) writes a JSON configuration entry into the Claude-specific MCP config path (retrieved via `get_claude_mcp_config_path`). This enables AI agents to discover and interact with the newly installed service.

Optional service startup occurs when `--start-services` is passed. Functions like `start_anything_analyzer` and `start_idapro_service` (lines **70‑112**) ensure the service listens on its expected port, cloning repositories if necessary and launching processes in the background.

### Finalization and Exit Reporting

Unless `--skip-refresh` is specified, the bootstrap calls `bash "$SCRIPT_DIR/refresh-tool-index.sh"` (lines **31‑35**) to regenerate [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) for skill routing.

The script aggregates per-capability status into the `RESULTS` array (lines **16‑29**) and exits with:
- **0**: All capabilities ready.
- **2**: At least one capability requires manual installation.
- **1**: Any other failure.

## How to Customize Tool Installation

The bootstrap process reverse-skill supports three primary extension patterns: GitHub releases, package manager integration, and MCP service registration.

### Adding Third-Party Binaries via GitHub Releases

To add a tool distributed as a GitHub release asset:

1. **Update the manifest** ([`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json)):

```json
{
  "name": "mytool",
  "repo": "owner/mytool",
  "assetRegex": "^mytool_.*_linux_amd64\\.tar.gz$",
  "installDir": "$HOME/tools/mytool",
  "releaseTag": "v1.2.3",
  "assetSha256": "sha256:abcd1234...deadbeef"
}

```

2. **Extend the case statement** in `ensure_capability`:

```bash
mytool)
    install_manifest_release "mytool"
    ;;

```

3. **Execute the bootstrap**:

```bash
bash kali/scripts/bootstrap-reverse.sh mytool

```

The script downloads the asset, verifies the SHA‑256 checksum, unpacks it into `$HOME/tools/mytool`, and adds its `bin` directory to `PATH` for the current session.

### Integrating APT and Python Packages

**For APT-available tools**, add a case to the apt section (around lines **38‑41**):

```bash
httpie)
    install_apt_package "httpie"
    ;;

```

**For Python packages**, use the pip wrapper:

```bash
my-py-tool)
    install_pip_package "my-py-tool"
    ;;

```

If the package resides in a Git repository, pass the source URL as the second argument, following the pattern used for `idalib-mcp` (lines **66‑68**).

### Registering Custom MCP Servers

To register a binary that provides an HTTP-based MCP endpoint:

```bash
my-mcp)
    install_apt_package "my-mcp"
    register_mcp_server "my-mcp" '{
        "command": "my-mcp",
        "args": ["--port", "8088"]
    }'
    ;;

```

Add a corresponding `start_my_mcp` function and invoke it when `START_SERVICES` is true to enable automatic service initialization:

```bash
bash kali/scripts/bootstrap-reverse.sh my-mcp --start-services

```

## Summary

- The **bootstrap process reverse-skill** centers on [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh), which resolves capabilities through `ensure_capability` and installs tools via abstracted primitives.
- **GitHub releases** are handled declaratively through [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json), enabling SHA‑256 verified downloads without code changes to the main script.
- **MCP server registration** integrates tools with Claude Desktop through JSON configuration written by `register_mcp_server`.
- Exit codes indicate success (0), manual installation required (2), or hard failure (1).
- Customization requires editing the manifest for third-party binaries, adding case statements for new capabilities, and optionally implementing service startup functions.

## Frequently Asked Questions

### What is the reverse-skill bootstrap process?

The reverse-skill bootstrap process is an automated installation system defined in [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) that installs, registers, and optionally starts penetration testing tools based on capability names. It supports multiple installation backends including APT, pip, npm, and GitHub releases, while maintaining a declarative manifest for third-party binaries.

### How do I add a tool that requires manual installation?

Add the capability name to the `ensure_capability` case statement with a warning marker. For example, mark it as `MANUAL_REQUIRED` and emit instructions using `log_warn`. The script will exit with code 2 to indicate manual steps are needed, allowing you to document proprietary or license-restricted tools within the same framework.

### Where does the bootstrap store MCP server configurations?

The `register_mcp_server` function writes configurations to the Claude Desktop MCP config path, retrieved via `get_claude_mcp_config_path`. This typically resides in the user's home directory under Claude-specific configuration files, enabling immediate discovery by AI agents without additional manual steps.

### Can I skip the tool index refresh after installation?

Yes. Pass the `--skip-refresh` flag when invoking [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) to prevent automatic execution of [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh). This is useful when batch-installing multiple capabilities or when you intend to manually update [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) after completing all modifications.