How MCP Service Management Works for IDA Pro, Anything-Analyzer, and BurpSuite in reverse-skill

MCP service management in reverse-skill uses a unified JSON-RPC 2.0 lifecycle—register, warm-up, health-check, invoke, shutdown—to expose IDA Pro, Anything-Analyzer, and BurpSuite as local HTTP services that AI agents can call directly.

The reverse-skill repository implements a Model Context Protocol (MCP) architecture where each security tool runs as a standalone service with a consistent API surface. This design allows AI agents (Claude, Kiro, Cursor) to orchestrate complex reverse-engineering and penetration-testing workflows through standardized JSON-RPC calls rather than brittle CLI wrappers.

Service Registration and Bootstrap Architecture

All MCP-enabled tools are catalogued in skills/scripts/bootstrap-manifest.json. The cross-platform bootstrap scripts—skills/scripts/bootstrap-reverse.ps1 (PowerShell) and bootstrap-reverse.sh (Bash)—automate the entire lifecycle: cloning upstream repositories, installing dependencies, launching services, and registering endpoints in the agent configuration file (typically ~/.claude.json or equivalent).

PowerShell invocation for all three services:

powershell -File "skills\scripts\bootstrap-reverse.ps1" `
    -Capability @('idapro','anything-analyzer','burpsuite-mcp')

Bash invocation for the same stack:

bash skills/scripts/bootstrap-reverse.sh idapro anything-analyzer burpsuite-mcp

Each capability entry in the manifest triggers a tool-specific start command—pnpm dev for Anything-Analyzer, gradlew :run for the BurpBridge, or a Python HTTP server for IDA Pro. The bootstrap script then writes a registration entry:

{
  "name": "anything-analyzer",
  "endpoint": "http://127.0.0.1:23816"
}

The MCP client library (mcp-client.js, imported by every skill) consumes these entries to route RPC calls to the correct endpoint.

IDA Pro MCP Service Management

Attribute	Value
Server name	idapro
Method prefix	idapro_*
Default port	5000 (override via IDAPRO_MCP_PORT)
Warm-up RPC	idapro_server_warmup()
Health RPC	idapro_server_health()
Session RPCs	idapro_idalib_list(), idapro_idalib_switch(), idapro_idalib_close()
Analysis RPCs	idapro_decompile(), idapro_trace_data_flow(), idapro_list_funcs()

The IDA Pro service implements a session-isolation model. The idapro_server_warmup() call pre-loads the IDA headless binary and initializes a shared analysis worker. Multiple analysis sessions can coexist, each isolating a different binary file, managed through the idapro_idalib_* family of calls.

Listing functions via MCP:

const mcp = require('mcp-client');

async function listIdaFunctions() {
  await mcp.call('idapro_server_warmup');
  const health = await mcp.call('idapro_server_health');
  if (!health.ok) throw new Error('IDA server not healthy');

  const funcs = await mcp.call('idapro_list_funcs', {
    queries: [{ offset: 0, limit: 20 }]
  });
  console.log('Functions:', funcs);
}
listIdaFunctions();

Source reference: skills/ida-reverse/references/ida-mcp-cheatsheet.md

Anything-Analyzer MCP Service Management

Attribute	Value
Server name	anything-analyzer
Port	23816 (hard-coded)
Capabilities	Browser automation, HTTP traffic capture, AI-assisted traffic analysis
Health endpoint	GET /health → {status:"ok"}
Bootstrap command	pnpm install && pnpm dev in ~/tools/anything-analyzer

Anything-Analyzer operates as a Node/Electron application that instruments Chromium for automated browsing and intercepts HTTP request/response cycles. The MCP surface exposes both low-level browser control (anything-analyzer_open) and high-level capture workflows (anything-analyzer_wait_for).

Capturing and analyzing login traffic:

const mcp = require('mcp-client');

async function captureAndAnalyse(url) {
  await mcp.call('anything-analyzer_open', { url });

  const captured = await mcp.call('anything-analyzer_wait_for', {
    filter: { method: 'GET', urlPattern: '*login*' },
    timeout: 15000
  });

  const analysis = await mcp.call('ai_analyse_http', {
    request: captured.request
  });
  console.log('AI analysis:', analysis);
}
captureAndAnalyse('https://example.com/login');

Source reference: skills/js-reverse/SKILL.md (section "注册并启动 anything-analyzer")

BurpSuite MCP Service Management

Attribute	Value
Extension	"MCP Server" BApp (Burp BApp Store)
Bridge implementation	burp-mcp-full/mcp-bridge.js
Default address	http://127.0.0.1:9876
Environment variables	BURP_MCP_HOST, BURP_MCP_PORT
Core RPCs	burpsuite_proxy_history(), burpsuite_intruder_attack(), burpsuite_scanner_start(), burpsuite_collaborator_poll()

BurpSuite MCP differs from the other two services: the MCP Server BApp must be installed manually through Burp's extension marketplace. Once enabled, the extension launches mcp-bridge.js automatically on Burp startup. The bootstrap script only handles endpoint registration—no process management required.

The bridge translates JSON-RPC calls into native Burp Extender API invocations, exposing proxy history, repeater, intruder, scanner, and collaborator functionality.

Retrieving recent proxy entries:

const mcp = require('mcp-client');

async function recentProxyEntries() {
  const history = await mcp.call('burpsuite_proxy_history', {
    limit: 10,
    offset: 0
  });
  console.log('Recent proxy entries:', history);
}
recentProxyEntries();

Source references: skills/pentest-tools/references/burpsuite-mcp-guide.md, burp-mcp-full/mcp-bridge.js, burp-mcp-full/test/mcp-bridge.test.js

Unified Four-Step Service Lifecycle

All three MCP services in reverse-skill follow an identical operational pattern:

1. Discovery — Bootstrap script writes name → endpoint mappings to agent configuration
2. Warm-up — Tool-specific initialization RPC or automatic process start
3. Health verification — Lightweight RPC or HTTP check confirms readiness
4. Invocation — Prefixed RPC calls routed through mcp-client.js

Shutdown is symmetric: skills may call service-specific close methods (idapro_idalib_close, anything-analyzer_shutdown, burpsuite_shutdown), or use the bootstrap script's -StopServices flag for bulk termination.

Summary

• MCP service management in reverse-skill standardizes IDA Pro, Anything-Analyzer, and BurpSuite as local HTTP JSON-RPC services
• skills/scripts/bootstrap-manifest.json and bootstrap-reverse.ps1/**.sh** automate registration and lifecycle
• IDA Pro runs on port 5000 with session-isolated analysis via idapro_idalib_* RPCs
• Anything-Analyzer binds port 23816 for browser automation and traffic capture
• BurpSuite uses the MCP Server BApp with mcp-bridge.js on port 9876, exposing full Extender API
• All services share register → warm-up → health-check → invoke → shutdown semantics through mcp-client.js

Frequently Asked Questions

What is MCP in the context of reverse-skill?

MCP (Model Context Protocol) is a JSON-RPC 2.0 wrapper that exposes security tools as local HTTP services. In reverse-skill, MCP allows AI agents to call IDA Pro, Anything-Analyzer, and BurpSuite through standardized method invocations rather than parsing command-line output or managing raw subprocesses.

How do I start multiple MCP services simultaneously?

Use the bootstrap script with the -Capability array (PowerShell) or positional arguments (Bash). Both skills/scripts/bootstrap-reverse.ps1 and bootstrap-reverse.sh accept multiple capability names and start them in dependency order defined by bootstrap-manifest.json. The script automatically registers all endpoints in your agent configuration.

Why does BurpSuite MCP require manual BApp installation?

BurpSuite's extension model requires the MCP Server BApp to be loaded through Burp's own extension marketplace for licensing and security reasons. Unlike IDA Pro and Anything-Analyzer—standalone processes that the bootstrap script can launch directly—BurpSuite MCP runs inside Burp's JVM. The bootstrap script only configures the endpoint; the bridge starts automatically when Burp launches with the extension enabled.

Can I change the default ports for these MCP services?

IDA Pro and BurpSuite support environment variable overrides: IDAPRO_MCP_PORT, BURP_MCP_HOST, and BURP_MCP_PORT. Anything-Analyzer uses a hard-coded port 23816 that requires modifying the source to change. Always update the bootstrap manifest or agent configuration after changing ports to ensure the MCP client library routes calls correctly.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}