How reverse-skill Manages and Installs Security Tool Dependencies: A Complete Guide

reverse-skill uses a declarative bootstrap manifest combined with Bash helper scripts to discover, install, verify, and register security tools required by its skills.

The reverse-skill repository provides a comprehensive dependency management system for security professionals who need reproducible tool installations on Kali Linux. This article examines how the project handles everything from APT packages to GitHub releases, MCP server registration, and automated tool indexing.

---

Core Architecture: Three-Layer Dependency Management

The reverse-skill dependency system operates through three distinct layers that separate configuration from execution.

Layer 1: Capability Definition

The bootstrap manifest (kali/scripts/bootstrap-manifest.json) serves as the central registry for all installable tools. Each entry defines:

• Tool name and version
• Installation source (APT, pip, npm, GitHub, Go, Docker)
• Verification command and expected output
• SHA-256 checksums for downloaded artifacts
• Associated skill and purpose metadata

This JSON catalog includes security tools like jadx, frida, metasploitmcp, pentestswarm, and many others.

Layer 2: Discovery & Resolution

The kali/scripts/lib/tool-discovery.sh library provides runtime detection capabilities. It defines TOOL_CATALOG—a structured mapping of name | skill | purpose | version args | fallback commands.

Key functions include:

• find_command – Locates binaries in $PATH
• resolve_tool – Maps discovered tools to their consuming skills

This layer enables quick startup by avoiding redundant installations when tools already exist on the host.

Layer 3: Bootstrap & Registration

The kali/scripts/bootstrap-reverse.sh script orchestrates the entire installation pipeline. It:

1. Parses user-supplied capability names
2. Selects appropriate installer functions
3. Validates installation results
4. Registers MCP servers when applicable

---

Installation Methods Explained

The bootstrap script supports seven distinct installation strategies, selected automatically based on each tool's manifest definition.

APT Packages

Classic Kali tools use standard package management for reliability and automatic updates.

# Example tools installed via apt-get

nmap
hashcat
adaptixc2

The install_apt_package function handles apt-get update and apt-get install with proper error handling.

Pip Packages

Python-based security tools install through pip3:

• frida-tools – Dynamic instrumentation
• pwntools – Exploit development framework

Implementation: install_pip_package function with virtual environment awareness.

NPM Globals

JavaScript-centric tools deploy via npm install -g:

• agent-browser
• jshookmcp

The install_npm_global function ensures Node.js availability before installation.

Git Clone at Pinned Commit

For tools not in standard repositories, the script performs deterministic builds:

# ProxyCat example: specific commit for reproducibility

git clone <repo>
git checkout <commit-hash>

This approach guarantees identical installations across different machines and time periods.

GitHub Release Downloads

Binary-distributed tools follow a rigorous verification pipeline in install_github_release:

1. Query GitHub API for release assets
2. Select matching asset via regex pattern
3. Validate SHA-256 checksum against manifest
4. Extract archive to $HOME/tools/<tool-name>/

Example tools: jadx (APK decompiler), nuclei (vulnerability scanner)

# Install jadx from GitHub release with verification

bash bootstrap-reverse.sh jadx

Go Install

When Go is present, native Go tools install directly from source:

go install <package>@<version>

Tools using this method: nuclei, pentestswarm

Docker Pull

Fallback strategy when Go compilation fails or isn't desired. The script pulls pre-built images (e.g., pentestswarm) and creates wrapper scripts for seamless CLI integration.

---

Verification and MCP Registration

Post-Installation Verification

Every installation triggers automatic validation using the verifyCommand specified in bootstrap-manifest.json:

# Typical verification pattern

<binary> --version 2>&1 | grep -q <expected-pattern>

SHA-256 mismatches or missing binaries abort immediately with detailed error messages.

MCP Server Registration

For capabilities exposing Model Context Protocol endpoints, register_mcp_server updates ~/.claude/mcp.json:

• mcp-kali-server
• metasploitmcp
• pentestswarm
• anything-analyzer

This enables AI agents to invoke security tools through standardized MCP interfaces.

# Deploy full MCP suite for AI-driven pentesting

bash bootstrap-reverse.sh mcp-kali-server metasploitmcp hexstrike-ai pentestswarm --start-services

---

Tool Index Generation

After installation, kali/scripts/refresh-tool-index.sh maintains synchronized documentation:

Output File	Purpose
skills/tool-index.md	Human-readable Markdown table
skills/tool-index.json	Machine-readable routing data

The script iterates through TOOL_CATALOG, resolves each entry via tool-discovery.sh, and captures current versions. This index powers the routing engine that maps skill commands to underlying binaries.

# Regenerate indexes after manual tool changes

bash refresh-tool-index.sh

---

Practical Usage Examples

Basic Tool Installation

# Classic reconnaissance tools

bash bootstrap-reverse.sh nmap sqlmap frida

GitHub-Only Tool with MCP Registration

# Install jadx, skip index refresh

bash bootstrap-reverse.sh jadx --skip-refresh

Full AI Pentesting Stack

# All MCP servers with auto-start

bash bootstrap-reverse.sh mcp-kali-server metasploitmcp hexstrike-ai pentestswarm --start-services

Maintenance Operations

# Update tool documentation

bash refresh-tool-index.sh

---

Key Design Principles

The reverse-skill dependency system embodies several architectural strengths:

• Declarative configuration – The manifest separates what from how
• Reproducible builds – Pinned commits and checksums eliminate drift
• Graceful degradation – Multiple fallback strategies per tool type
• Observability – Structured [INFO], [OK], [WARN] logging
• AI integration – Native MCP server registration for agentic workflows

---

Summary

• bootstrap-manifest.json defines all tool metadata including installation source, version, and verification criteria
• tool-discovery.sh provides runtime detection to avoid redundant installations
• bootstrap-reverse.sh implements seven installation methods: APT, pip, npm, git-clone, GitHub releases, Go install, and Docker
• Verification commands and SHA-256 checksums ensure binary integrity before registration
• MCP server registration enables AI agent integration through ~/.claude/mcp.json
• refresh-tool-index.sh generates synchronized Markdown and JSON documentation for the routing layer

---

Frequently Asked Questions

What installation methods does reverse-skill support?

reverse-skill supports seven methods: APT packages, pip packages, npm globals, git-clone at pinned commits, GitHub release downloads with checksum verification, Go install, and Docker pull. The appropriate method is selected automatically based on each tool's entry in bootstrap-manifest.json.

How does reverse-skill ensure tool installations are reproducible?

The system uses pinned commit hashes for git-based installations, SHA-256 checksums for downloaded releases, and explicit version strings for package manager installs. These values are stored in bootstrap-manifest.json and validated during every installation.

What happens if a tool is already installed on the system?

The ensure_capability function in bootstrap-reverse.sh checks for existing binaries using command -v before attempting installation. If found, the tool is registered in the index without redundant installation, significantly speeding up repeated runs.

How do I add a new security tool to reverse-skill?

Add an entry to kali/scripts/bootstrap-manifest.json specifying the tool name, installation method, source URL or package name, version, verification command, and optional SHA-256 checksum. Update TOOL_CATALOG in tool-discovery.sh if the tool needs skill-specific routing, then run refresh-tool-index.sh to regenerate documentation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}