# How to Install Tools Automatically Using reverse-skill Bootstrap Scripts

> Automate security tool installation with reverse-skill bootstrap scripts. Effortlessly fetch and install tools using declarative manifests. Get started today!

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-21

---

**The `reverse-skill` repository provides cross-platform bootstrap scripts that automate the fetching, verification, and installation of security tools via a declarative manifest system.**

`reverse-skill` is an open-source security automation framework that eliminates manual tool installation through intelligent bootstrap scripts. These scripts read a centralized manifest—[`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json)—to determine exact versions, download sources, and platform-specific installation methods for each capability. Whether you are configuring a Kali Linux attack box or a macOS analysis workstation, the bootstrap system handles dependency resolution, cryptographic verification, and PATH configuration automatically.

## How the Bootstrap Architecture Works

The bootstrap system operates on a **capability-based model** defined in [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json). This JSON file maps tool names (capabilities) to their supply-chain metadata, including GitHub release URLs, package manager identifiers (apt/brew/winget), and SHA-256 checksums.

When you invoke the bootstrap script, the `expand_capabilities` function (found in [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) at lines 92-104) first resolves any aliases and implicit dependencies. For example, requesting `frida-ps` automatically expands to include the base `frida` package. The system then dispatches each capability to the appropriate installer via `ensure_capability` (lines 307-334), which selects between `apt-get`, `brew`, `winget`, direct GitHub downloads, or language-specific managers like `pipx` and `npm`.

## Prerequisites and Initial Setup

Before running the bootstrap scripts, ensure you have internet access and standard shell permissions. The scripts automatically detect your platform—Linux, macOS, Windows, or Kali Linux—and adjust behavior accordingly.

Clone the repository to access the scripts:

```bash
git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

```

No additional dependencies are required to start; the bootstrap scripts themselves install the necessary runtimes (Python, Node.js, Java) via the `ensure_python_runtime`, `Ensure-NodeRuntime`, and `Ensure-JavaRuntime` functions.

## Installing Tools on Linux and macOS

The Bash implementation at [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) handles Unix-like systems. This script orchestrates platform detection, runtime installation, and tool deployment.

### Basic Installation Syntax

To install a single tool, pass its capability name as an argument:

```bash
bash skills/scripts/bootstrap-reverse.sh jadx

```

For multiple tools, separate them with spaces:

```bash
bash skills/scripts/bootstrap-reverse.sh jadx apktool frida

```

### Verification and Extraction Pipeline

When installing from GitHub releases, the `install_github_release` function (lines 100-121) performs the following:

1. Downloads the asset to a temporary location.
2. Validates the SHA-256 digest using the checksum stored in the manifest.
3. Extracts the archive to `$HOME/tools` (or the directory specified by `REVERSE_SKILL_TOOLS_DIR`).
4. Appends the binary location to your shell’s PATH.

### Python Runtime Guarantees

The `ensure_python_runtime` function (lines 63-72) ensures that `python3` and `pipx` are present at the exact versions specified in the manifest, preventing environment drift between team members.

## Installing Tools on Windows

Windows users utilize the PowerShell counterpart at `skills/scripts/bootstrap-reverse.ps1`. This script mirrors the Bash logic but leverages Windows-native package management.

### PowerShell Execution

Run the script with the `-Capability` parameter accepting an array of tool names:

```powershell
.\skills\scripts\bootstrap-reverse.ps1 -Capability jadx,apktool,frida

```

### Windows Package Management

The `Ensure-WingetPackage` function handles system packages through `winget`, while the `Assert-DownloadedFileIntegrity` function performs SHA-256 validation equivalent to the Bash implementation. For GitHub-hosted tools, the script uses `Invoke-WebRequest` followed by extraction logic defined in `skills/scripts/lib/BootstrapSupplyChain.ps1`.

## Integrating with MCP Servers

The bootstrap scripts can automatically register tools as **Model-Control-Protocol (MCP)** servers for AI assistants like Claude and Codex. This enables AI-driven reverse engineering workflows where tools expose standardized endpoints.

Use the `--mcp-host` flag (Bash) or `-McpHostTarget` parameter (PowerShell) to specify the target client:

```bash
bash skills/scripts/bootstrap-reverse.sh frida --mcp-host=claude

```

```powershell
.\skills\scripts\bootstrap-reverse.ps1 -Capability frida -McpHostTarget Both

```

The `write_mcp_server`, `write_claude_mcp_server`, and `write_codex_mcp_server` functions (lines 78-98) generate the appropriate configuration files at `~/.claude/mcp.json` or `~/.codex/config.toml`, pointing to the tool’s executable path.

## Starting Background Services

Long-running analysis engines like `anything-analyzer` or `idapro` MCP servers require persistent processes. The bootstrap system can launch these and verify port availability using the `--start-services` flag:

```bash
bash skills/scripts/bootstrap-reverse.sh anything-analyzer --start-services --mcp-host=both

```

```powershell
.\skills\scripts\bootstrap-reverse.ps1 -Capability anything-analyzer -StartServices -McpHostTarget Both

```

The script polls the service ports (e.g., port 23816 for `anything-analyzer`) before completing, ensuring dependent tools have fully initialized.

## Customizing the Installation Directory

By default, tools install to `$HOME/tools`. Override this by setting the `REVERSE_SKILL_TOOLS_DIR` environment variable:

```bash
export REVERSE_SKILL_TOOLS_DIR="$HOME/security-tools"
bash skills/scripts/bootstrap-reverse.sh pentestswarm

```

```powershell
$env:REVERSE_SKILL_TOOLS_DIR = "$HOME\security-tools"
.\skills\scripts\bootstrap-reverse.ps1 -Capability nmap,pentestswarm

```

This variable propagates through the `install_github_release` logic and PATH modification routines in both the Bash and PowerShell implementations.

## Discovering Available Capabilities

To list all installable tools without executing installations:

```bash
bash skills/scripts/bootstrap-reverse.sh --list

```

On Windows, use the help mechanism:

```powershell
.\skills\scripts\bootstrap-reverse.ps1 -Capability @() -McpHostTarget None -Help

```

## Summary

- **Declarative Installation**: Tools are defined in [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json), ensuring version consistency across teams.
- **Cross-Platform**: Use [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) for Linux/macOS and `skills/scripts/bootstrap-reverse.ps1` for Windows.
- **Automatic Dependency Resolution**: The `expand_capabilities` function resolves tool aliases and prerequisites automatically.
- **Supply-Chain Security**: SHA-256 verification is enforced via `verify_sha256` (Bash) and `Assert-DownloadedFileIntegrity` (PowerShell) for all GitHub releases.
- **AI Integration**: Optional MCP server registration supports Claude and Codex via `--mcp-host` or `-McpHostTarget`.
- **Service Orchestration**: The `--start-services` flag manages long-running background processes and port readiness.

## Frequently Asked Questions

### Where does reverse-skill store the installed tools?

By default, binaries extract to `$HOME/tools` on Unix systems or the equivalent user profile directory on Windows. You can customize this location by setting the `REVERSE_SKILL_TOOLS_DIR` environment variable before running the bootstrap script, as implemented in the path resolution logic of both [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) and `bootstrap-reverse.ps1`.

### How does the script handle tool version conflicts?

The bootstrap system reads exact versions from [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json). When `ensure_capability` dispatches to package managers like `apt-get` or `brew`, it specifies version constraints where possible. For GitHub releases, the `install_github_release` function downloads the exact release asset listed in the manifest and validates it against the embedded SHA-256 checksum, preventing version drift.

### Can I use the bootstrap script on Kali Linux?

Yes. The repository includes Kali-specific variants at [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) and [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) that utilize the same core functions—`expand_capabilities`, `ensure_python_runtime`, and `install_github_release`—but with manifest entries optimized for penetration testing workflows common to Kali environments.

### What happens if a tool is already installed?

The `ensure_capability` function and its PowerShell equivalent `Ensure-WingetPackage` first check for existing installations via `which` (Bash) or `Get-Command` (PowerShell) before attempting installation. If the installed version matches the manifest specification, the script skips redundant operations; if versions differ, it updates the tool according to the manifest’s supply-chain configuration.