# How reverse-skill Manages and Installs Security Tool Dependencies: A Complete Guide > Learn how reverse-skill manages and installs security tool dependencies using declarative manifests and Bash scripts for efficient discovery, installation, and verification. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-11 --- **`reverse-skill` uses a declarative bootstrap manifest combined with Bash helper scripts to discover, install, verify, and register security tools required by its skills.** The `reverse-skill` repository provides a comprehensive dependency management system for security professionals who need reproducible tool installations on Kali Linux. This article examines how the project handles everything from **APT packages** to **GitHub releases**, **MCP server registration**, and automated tool indexing. --- ## Core Architecture: Three-Layer Dependency Management The `reverse-skill` dependency system operates through three distinct layers that separate configuration from execution. ### Layer 1: Capability Definition The **bootstrap manifest** ([`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)) serves as the central registry for all installable tools. Each entry defines: - Tool name and version - Installation source (APT, pip, npm, GitHub, Go, Docker) - Verification command and expected output - SHA-256 checksums for downloaded artifacts - Associated skill and purpose metadata This JSON catalog includes security tools like `jadx`, `frida`, `metasploitmcp`, `pentestswarm`, and many others. ### Layer 2: Discovery & Resolution The [`kali/scripts/lib/tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/lib/tool-discovery.sh) library provides runtime detection capabilities. It defines `TOOL_CATALOG`—a structured mapping of **name | skill | purpose | version args | fallback commands**. Key functions include: - `find_command` – Locates binaries in `$PATH` - `resolve_tool` – Maps discovered tools to their consuming skills This layer enables quick startup by avoiding redundant installations when tools already exist on the host. ### Layer 3: Bootstrap & Registration The [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) script orchestrates the entire installation pipeline. It: 1. Parses user-supplied capability names 2. Selects appropriate installer functions 3. Validates installation results 4. Registers MCP servers when applicable --- ## Installation Methods Explained The bootstrap script supports **seven distinct installation strategies**, selected automatically based on each tool's manifest definition. ### APT Packages **Classic Kali tools** use standard package management for reliability and automatic updates. ```bash # Example tools installed via apt-get nmap hashcat adaptixc2 ``` The `install_apt_package` function handles `apt-get update` and `apt-get install` with proper error handling. ### Pip Packages **Python-based security tools** install through `pip3`: - `frida-tools` – Dynamic instrumentation - `pwntools` – Exploit development framework Implementation: `install_pip_package` function with virtual environment awareness. ### NPM Globals **JavaScript-centric tools** deploy via `npm install -g`: - `agent-browser` - `jshookmcp` The `install_npm_global` function ensures Node.js availability before installation. ### Git Clone at Pinned Commit For **tools not in standard repositories**, the script performs deterministic builds: ```bash # ProxyCat example: specific commit for reproducibility git clone git checkout ``` This approach guarantees identical installations across different machines and time periods. ### GitHub Release Downloads **Binary-distributed tools** follow a rigorous verification pipeline in `install_github_release`: 1. Query GitHub API for release assets 2. Select matching asset via regex pattern 3. Validate SHA-256 checksum against manifest 4. Extract archive to `$HOME/tools//` Example tools: `jadx` (APK decompiler), `nuclei` (vulnerability scanner) ```bash # Install jadx from GitHub release with verification bash bootstrap-reverse.sh jadx ``` ### Go Install When Go is present, **native Go tools** install directly from source: ```bash go install @ ``` Tools using this method: `nuclei`, `pentestswarm` ### Docker Pull **Fallback strategy** when Go compilation fails or isn't desired. The script pulls pre-built images (e.g., `pentestswarm`) and creates wrapper scripts for seamless CLI integration. --- ## Verification and MCP Registration ### Post-Installation Verification Every installation triggers **automatic validation** using the `verifyCommand` specified in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json): ```bash # Typical verification pattern --version 2>&1 | grep -q ``` SHA-256 mismatches or missing binaries abort immediately with detailed error messages. ### MCP Server Registration For capabilities exposing **Model Context Protocol** endpoints, `register_mcp_server` updates `~/.claude/mcp.json`: - `mcp-kali-server` - `metasploitmcp` - `pentestswarm` - `anything-analyzer` This enables AI agents to invoke security tools through standardized MCP interfaces. ```bash # Deploy full MCP suite for AI-driven pentesting bash bootstrap-reverse.sh mcp-kali-server metasploitmcp hexstrike-ai pentestswarm --start-services ``` --- ## Tool Index Generation After installation, [`kali/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/refresh-tool-index.sh) maintains synchronized documentation: | Output File | Purpose | |-------------|---------| | [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) | Human-readable Markdown table | | [`skills/tool-index.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.json) | Machine-readable routing data | The script iterates through `TOOL_CATALOG`, resolves each entry via [`tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-discovery.sh), and captures current versions. This index powers the routing engine that maps skill commands to underlying binaries. ```bash # Regenerate indexes after manual tool changes bash refresh-tool-index.sh ``` --- ## Practical Usage Examples ### Basic Tool Installation ```bash # Classic reconnaissance tools bash bootstrap-reverse.sh nmap sqlmap frida ``` ### GitHub-Only Tool with MCP Registration ```bash # Install jadx, skip index refresh bash bootstrap-reverse.sh jadx --skip-refresh ``` ### Full AI Pentesting Stack ```bash # All MCP servers with auto-start bash bootstrap-reverse.sh mcp-kali-server metasploitmcp hexstrike-ai pentestswarm --start-services ``` ### Maintenance Operations ```bash # Update tool documentation bash refresh-tool-index.sh ``` --- ## Key Design Principles The `reverse-skill` dependency system embodies several architectural strengths: - **Declarative configuration** – The manifest separates *what* from *how* - **Reproducible builds** – Pinned commits and checksums eliminate drift - **Graceful degradation** – Multiple fallback strategies per tool type - **Observability** – Structured `[INFO]`, `[OK]`, `[WARN]` logging - **AI integration** – Native MCP server registration for agentic workflows --- ## Summary - **[`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json)** defines all tool metadata including installation source, version, and verification criteria - **[`tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-discovery.sh)** provides runtime detection to avoid redundant installations - **[`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh)** implements seven installation methods: APT, pip, npm, git-clone, GitHub releases, Go install, and Docker - **Verification commands** and SHA-256 checksums ensure binary integrity before registration - **MCP server registration** enables AI agent integration through `~/.claude/mcp.json` - **[`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh)** generates synchronized Markdown and JSON documentation for the routing layer --- ## Frequently Asked Questions ### What installation methods does reverse-skill support? `reverse-skill` supports seven methods: APT packages, pip packages, npm globals, git-clone at pinned commits, GitHub release downloads with checksum verification, Go install, and Docker pull. The appropriate method is selected automatically based on each tool's entry in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json). ### How does reverse-skill ensure tool installations are reproducible? The system uses pinned commit hashes for git-based installations, SHA-256 checksums for downloaded releases, and explicit version strings for package manager installs. These values are stored in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) and validated during every installation. ### What happens if a tool is already installed on the system? The `ensure_capability` function in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) checks for existing binaries using `command -v` before attempting installation. If found, the tool is registered in the index without redundant installation, significantly speeding up repeated runs. ### How do I add a new security tool to reverse-skill? Add an entry to [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) specifying the tool name, installation method, source URL or package name, version, verification command, and optional SHA-256 checksum. Update `TOOL_CATALOG` in [`tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-discovery.sh) if the tool needs skill-specific routing, then run [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) to regenerate documentation.