How to Deploy reverse-skill to Production: A Complete Production Deployment Guide

Deploy reverse-skill to production by running the bootstrap script on a supported host, refreshing the tool index, and initializing cases through the routing layer.

reverse-skill is a skill-router that coordinates reverse-engineering, pentesting, and CTF tooling through three architectural layers. This guide walks through deploying it to production based on the actual source code in zhaoxuya520/reverse-skill.

Understanding the Architecture

Before deploying, understand how the three layers work together:

• Routing Layer — skills/scripts/master-route.ps1 (Windows) and bootstrap scripts (Linux/macOS) decide which skill handles a task based on keyword hints
• Bootstrap Layer — skills/scripts/bootstrap-reverse.sh installs runtimes, downloads tools, and registers MCP endpoints
• Ops Contracts Layer — skills/ops/ and RULES.md enforce scope, timeline, and evidence requirements before any "ACT" is permitted

All layers are idempotent — repeated runs verify tools and update configuration without side effects.

Provision the Production Host

Choose a platform that matches your security stack requirements:

Platform	Best For	Prerequisites
Kali Linux	Offensive security tooling	Pre-installed penetration testing tools
Ubuntu/Debian	General reverse engineering	APT package manager
macOS	Development environments	Homebrew installed

Review platform-specific notes in docs/platforms/linux.md and docs/platforms/macos.md before proceeding.

Run the Bootstrap Script

The bootstrap-reverse.sh script at skills/scripts/bootstrap-reverse.sh performs platform detection, runtime installation, tool downloads, and MCP registration.

# Clone the repository

git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

# Run bootstrap with required capabilities

bash skills/scripts/bootstrap-reverse.sh \
    jadx apktool frida jshookmcp anything-analyzer \
    --start-services

The bootstrap script executes these operations:

1. Detects PLATFORM and selects installation method (APT, Homebrew, or direct GitHub releases)
2. Installs missing runtimes: Java, Node.js, Python 3, and pipx
3. Downloads tools to $HOME/tools or custom REVERSE_SKILL_TOOLS_DIR
4. Verifies SHA-256 digests via verify_sha256 function
5. Registers MCP servers in ~/.claude/mcp.json using write_mcp_server
6. Starts long-running services (Anything-Analyzer, JSHook MCP) when --start-services is passed

The script outputs a JSON status summary upon completion.

Refresh the Tool Index

After bootstrap completes, generate the local tool inventory so the router knows available capabilities:

bash skills/scripts/refresh-tool-index.sh

This creates tool-index.md by detecting installed binaries and their versions.

Initialize a Case

Production deployments require case initialization to enforce RULES.md guardrails:

# Windows/PowerShell environments

powershell -File skills/scripts/case-init.ps1 -OutDir work/production-case

The case-init.ps1 script creates the work/ directory structure and validates that scope, timeline, and evidence requirements are defined before any analysis executes.

Route Tasks Through the Master Router

With infrastructure ready, route tasks using descriptive hints:

powershell -File skills/scripts/master-route.ps1 -Hint "apk jadx decompile"

master-route.ps1 parses the hint, selects the primary skill, and writes route-scope.md specifying:

• Which skill will be invoked
• Available secondary skills
• Required tool configurations

Execute the Selected Skill

Each skill lives under skills/<category>/ with its own SKILL.md and entrypoint:

# Example: APK reverse engineering skill

bash skills/apk-reverse/run.sh

Skills contain concrete workflows, tool usage patterns, and MCP configuration requirements. The skill entrypoint reads the routing decision from route-scope.md and executes the appropriate analysis pipeline.

MCP Server Configuration

The bootstrap script writes MCP server definitions to ~/.claude/mcp.json. Key bridges include:

• JSHook MCP — JavaScript runtime instrumentation
• Anything-Analyzer — General file analysis service
• BurpSuite integration — via burp-mcp-full/mcp-bridge.js

Verify registration after bootstrap:

cat ~/.claude/mcp.json | jq '.mcpServers | keys'

Production Security Considerations

Control	Implementation
Tool verification	SHA-256 digest checking in verify_sha256
Scope enforcement	RULES.md validation in case-init.ps1
Path isolation	REVERSE_SKILL_TOOLS_DIR environment variable
MCP security	Local-only endpoints, no remote exposure

Review RULES.md before running any "ACT" operations — it defines mandatory guardrails for evidence handling and scope boundaries.

Platform-Specific Deployment Notes

Linux Production Servers

For headless Linux deployments, omit --start-services and run services via systemd:

# Bootstrap without service start

bash skills/scripts/bootstrap-reverse.sh jadx apktool frida

# Manual service management

systemctl --user enable anything-analyzer

macOS Development Workstations

Ensure Homebrew is installed and REVERSE_SKILL_TOOLS_DIR points to a persistent location outside temporary directories.

Summary

• Provision a supported host (Kali, Ubuntu, or macOS) matching your tooling requirements
• Bootstrap with skills/scripts/bootstrap-reverse.sh to install runtimes, tools, and MCP endpoints
• Refresh the tool index so the router detects available capabilities
• Initialize cases through case-init.ps1 to enforce RULES.md guardrails
• Route tasks with descriptive hints via master-route.ps1, then execute the selected skill

All steps are idempotent and safe to repeat during maintenance windows or when adding capabilities.

Frequently Asked Questions

Can reverse-skill run on Windows Server?

Yes, using the PowerShell-based routing layer. Run skills/scripts/master-route.ps1 and case-init.ps1 directly. The bootstrap script currently focuses on Linux/macOS; Windows tool installation requires manual setup or WSL2 with the Linux bootstrap.

What happens if tool downloads fail SHA-256 verification?

The verify_sha256 function in bootstrap-reverse.sh aborts installation for that specific tool and logs the failure. Re-run bootstrap after resolving network issues or updating the expected digest in the script.

How do I add custom tools to the routing system?

Install the tool to REVERSE_SKILL_TOOLS_DIR, add an entry to tool-index.md via refresh-tool-index.sh, then create a skill definition under skills/<category>/SKILL.md with appropriate keyword hints for the router.

Is MCP configuration required for production deployments?

MCP registration is optional but recommended. Skills that rely on MCP bridges (Anything-Analyzer, JSHook) will fail gracefully with fallback instructions if the server is unavailable. Core static analysis skills function without MCP.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}