# How to Deploy reverse-skill to Production: A Complete Production Deployment Guide

> Learn how to deploy reverse-skill to production easily. Follow our step-by-step guide to run the bootstrap script, refresh the index, and initialize cases for a successful launch.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-04

---

**Deploy reverse-skill to production by running the bootstrap script on a supported host, refreshing the tool index, and initializing cases through the routing layer.**

**reverse-skill** is a skill-router that coordinates reverse-engineering, pentesting, and CTF tooling through three architectural layers. This guide walks through deploying it to production based on the actual source code in `zhaoxuya520/reverse-skill`.

## Understanding the Architecture

Before deploying, understand how the three layers work together:

- **Routing Layer** — `skills/scripts/master-route.ps1` (Windows) and bootstrap scripts (Linux/macOS) decide which skill handles a task based on keyword hints
- **Bootstrap Layer** — [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) installs runtimes, downloads tools, and registers MCP endpoints
- **Ops Contracts Layer** — `skills/ops/` and [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) enforce scope, timeline, and evidence requirements before any "ACT" is permitted

All layers are **idempotent** — repeated runs verify tools and update configuration without side effects.

## Provision the Production Host

Choose a platform that matches your security stack requirements:

| Platform | Best For | Prerequisites |
|----------|----------|---------------|
| Kali Linux | Offensive security tooling | Pre-installed penetration testing tools |
| Ubuntu/Debian | General reverse engineering | APT package manager |
| macOS | Development environments | Homebrew installed |

Review platform-specific notes in [`docs/platforms/linux.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md) and [`docs/platforms/macos.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md) before proceeding.

## Run the Bootstrap Script

The [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script at [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) performs platform detection, runtime installation, tool downloads, and MCP registration.

```bash

# Clone the repository

git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

# Run bootstrap with required capabilities

bash skills/scripts/bootstrap-reverse.sh \
    jadx apktool frida jshookmcp anything-analyzer \
    --start-services

```

The bootstrap script executes these operations:

1. Detects `PLATFORM` and selects installation method (APT, Homebrew, or direct GitHub releases)
2. Installs missing runtimes: Java, Node.js, Python 3, and pipx
3. Downloads tools to `$HOME/tools` or custom `REVERSE_SKILL_TOOLS_DIR`
4. Verifies SHA-256 digests via `verify_sha256` function
5. Registers MCP servers in `~/.claude/mcp.json` using `write_mcp_server`
6. Starts long-running services (Anything-Analyzer, JSHook MCP) when `--start-services` is passed

The script outputs a JSON status summary upon completion.

## Refresh the Tool Index

After bootstrap completes, generate the local tool inventory so the router knows available capabilities:

```bash
bash skills/scripts/refresh-tool-index.sh

```

This creates [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) by detecting installed binaries and their versions.

## Initialize a Case

Production deployments require case initialization to enforce **RULES.md** guardrails:

```bash

# Windows/PowerShell environments

powershell -File skills/scripts/case-init.ps1 -OutDir work/production-case

```

The `case-init.ps1` script creates the `work/` directory structure and validates that scope, timeline, and evidence requirements are defined before any analysis executes.

## Route Tasks Through the Master Router

With infrastructure ready, route tasks using descriptive hints:

```bash
powershell -File skills/scripts/master-route.ps1 -Hint "apk jadx decompile"

```

`master-route.ps1` parses the hint, selects the primary skill, and writes [`route-scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/route-scope.md) specifying:

- Which skill will be invoked
- Available secondary skills
- Required tool configurations

## Execute the Selected Skill

Each skill lives under `skills/<category>/` with its own [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and entrypoint:

```bash

# Example: APK reverse engineering skill

bash skills/apk-reverse/run.sh

```

Skills contain concrete workflows, tool usage patterns, and MCP configuration requirements. The skill entrypoint reads the routing decision from [`route-scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/route-scope.md) and executes the appropriate analysis pipeline.

## MCP Server Configuration

The bootstrap script writes MCP server definitions to `~/.claude/mcp.json`. Key bridges include:

- **JSHook MCP** — JavaScript runtime instrumentation
- **Anything-Analyzer** — General file analysis service
- **BurpSuite integration** — via [`burp-mcp-full/mcp-bridge.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/mcp-bridge.js)

Verify registration after bootstrap:

```bash
cat ~/.claude/mcp.json | jq '.mcpServers | keys'

```

## Production Security Considerations

| Control | Implementation |
|---------|---------------|
| Tool verification | SHA-256 digest checking in `verify_sha256` |
| Scope enforcement | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) validation in `case-init.ps1` |
| Path isolation | `REVERSE_SKILL_TOOLS_DIR` environment variable |
| MCP security | Local-only endpoints, no remote exposure |

Review [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) before running any "ACT" operations — it defines mandatory guardrails for evidence handling and scope boundaries.

## Platform-Specific Deployment Notes

### Linux Production Servers

For headless Linux deployments, omit `--start-services` and run services via systemd:

```bash

# Bootstrap without service start

bash skills/scripts/bootstrap-reverse.sh jadx apktool frida

# Manual service management

systemctl --user enable anything-analyzer

```

### macOS Development Workstations

Ensure Homebrew is installed and `REVERSE_SKILL_TOOLS_DIR` points to a persistent location outside temporary directories.

## Summary

- **Provision** a supported host (Kali, Ubuntu, or macOS) matching your tooling requirements
- **Bootstrap** with [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) to install runtimes, tools, and MCP endpoints
- **Refresh** the tool index so the router detects available capabilities
- **Initialize** cases through `case-init.ps1` to enforce [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) guardrails
- **Route** tasks with descriptive hints via `master-route.ps1`, then execute the selected skill

All steps are idempotent and safe to repeat during maintenance windows or when adding capabilities.

## Frequently Asked Questions

### Can reverse-skill run on Windows Server?

Yes, using the PowerShell-based routing layer. Run `skills/scripts/master-route.ps1` and `case-init.ps1` directly. The bootstrap script currently focuses on Linux/macOS; Windows tool installation requires manual setup or WSL2 with the Linux bootstrap.

### What happens if tool downloads fail SHA-256 verification?

The `verify_sha256` function in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) aborts installation for that specific tool and logs the failure. Re-run bootstrap after resolving network issues or updating the expected digest in the script.

### How do I add custom tools to the routing system?

Install the tool to `REVERSE_SKILL_TOOLS_DIR`, add an entry to [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) via [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh), then create a skill definition under `skills/<category>/SKILL.md` with appropriate keyword hints for the router.

### Is MCP configuration required for production deployments?

MCP registration is optional but recommended. Skills that rely on MCP bridges (Anything-Analyzer, JSHook) will fail gracefully with fallback instructions if the server is unavailable. Core static analysis skills function without MCP.