# How the Reverse-Skill Tool Bootstrap System Discovers and Installs Missing Tools

> Discover how the reverse-skill bootstrap system finds and installs missing tools automatically. This Bash orchestrator streamlines your toolchain setup efficiently.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-02

---

**The reverse-skill bootstrap system is a Bash-based orchestrator that automates toolchain setup by checking for existing binaries via `command -v`, consulting a comprehensive tool catalog in [`tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-discovery.sh), and executing targeted installers for APT, pip, npm, or verified GitHub releases before optionally registering tools as MCP servers with Claude.**

The `zhaoxuya520/reverse-skill` repository provides a specialized environment for reverse-engineering and penetration testing workflows. At its core lies a sophisticated bootstrap mechanism that eliminates manual dependency management by intelligently detecting missing capabilities and acquiring them through the most appropriate distribution channel.

## Architecture Overview

The bootstrap system operates through three distinct logical layers defined in [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh). Each layer handles a specific phase of the toolchain initialization process.

### Layer 1: Argument Parsing

The entry point parses command-line arguments into structured variables. Lines 27-39 of [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) process `$@` to populate `CAPABILITIES`, `START_SERVICES`, and `SKIP_REFRESH` arrays, allowing users to specify which tools to install and whether to launch associated services immediately.

### Layer 2: Tool Discovery

The `ensure_capability` function (lines 23-63) serves as the primary discovery mechanism. It first attempts to locate the requested binary using `command -v "$name"`. When this check fails, the system falls back to the comprehensive catalog defined in [`kali/scripts/lib/tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/lib/tool-discovery.sh) (lines 17-85), where the `resolve_tool` helper (lines 60-92) iterates through comma-separated fallback commands and expands globs to locate executable files.

### Layer 3: Installation and Registration

Once a tool is identified as missing, the system selects an appropriate installer from a case statement mapping. Available installers include `install_apt_package` (lines 91-99), `install_pip_package` (lines 102-110), `install_npm_global` (lines 113-121), and `install_github_release` (lines 123-191). Post-installation, the `register_mcp_server` function (lines 41-66) can add JSON entries to `${HOME}/.claude/mcp.json` for Claude MCP protocol integration.

## How Tool Discovery Works

The discovery process combines shell-native checks with a flexible catalog system.

### Primary Availability Check

The `ensure_capability` function performs an immediate system check:

```bash
ensure_capability() {
    local name="$1"

    if command -v "$name" &>/dev/null; then
        log_ok "$name 已可用: $(command -v "$name")"
        return 0
    fi

    log_info "开始安装: $name"
    # ... proceeds to installation logic

}

```

This check determines whether the requested utility exists in the system `PATH` before attempting any network operations.

### Catalog-Based Fallback Resolution

When the primary check fails, the system consults [`tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-discovery.sh). The `resolve_tool` function processes catalog entries containing pipe-delimited fields for tool names, fallback command patterns, and version checking arguments:

```bash
resolve_tool() {
    local entry="$1"
    IFS='|' read -r name skill purpose version_args fallbacks <<< "$entry"
    IFS=',' read -ra candidates <<< "$fallbacks"
    
    for candidate in "${candidates[@]}"; do
        expanded=$(compgen -G "$candidate" | head -n1)
        if [[ -x "$expanded" ]]; then
            echo "${name}|${skill}|${purpose}|yes|${expanded}|..."
            return
        fi
        
        cmd_path=$(find_command "$candidate")
        if [[ -n "$cmd_path" ]]; then
            echo "${name}|${skill}|${purpose}|yes|${cmd_path}|..."
            return
        fi
    done
    echo "${name}|${skill}|${purpose}|no|||missing"
}

```

This implementation supports glob expansion (e.g., `$HOME/Android/Sdk/*/adb`) and multiple fallback binaries, reporting "yes" with the discovered path or "no" if completely absent.

## Installation Methods and Providers

The bootstrap system supports heterogeneous installation sources through specialized helper functions, selecting the appropriate method via a case statement in `ensure_capability`.

### Package Manager Installations

**APT packages** handle system-level dependencies like `nmap`, `sqlmap`, and `radare2`:

```bash
install_apt_package() {
    local pkg="$1"
    sudo apt-get update -qq
    sudo apt-get install -y -qq "$pkg"
}

```

**Python packages** accommodate tools like Frida through `install_pip_package` (lines 102-110), which ensures `pip` availability before installing `frida-tools`.

**Node.js packages** support JavaScript-based utilities via `install_npm_global` (lines 113-121), executing `npm install -g` with proper permission handling.

### GitHub Release Installations

For binaries distributed exclusively through GitHub, the `install_github_release` function (lines 123-191) implements a secure download pipeline:

```bash
install_github_release() {
    local repo="$1" asset_regex="$2" install_dir="$3" 
    local release_tag="${4:-}" expected_sha256="${5:-}"
    
    # API request and asset matching logic

    curl -L -o "$tmp_file" "$download_url"
    
    # SHA-256 verification

    sha256sum "$tmp_file" | awk '{print $1}' | grep -q "$expected_sha256"
    
    # Extraction based on file extension (.tar.gz, .zip, etc.)

    case "$asset_name" in
        *.tar.gz) tar -xzf "$tmp_file" -C "$install_dir" ;;
        *.zip) unzip -q "$tmp_file" -d "$install_dir" ;;
    esac
}

```

This function validates cryptographic checksums against values specified in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) before extracting archives to the designated `$HOME/tools/` directory.

## MCP Server Registration

Tools that expose Model Context Protocol (MCP) endpoints undergo additional registration. The `register_mcp_server` function appends structured JSON to `~/.claude/mcp.json`, enabling Claude-based agents to invoke the tool through standardized MCP interfaces:

```bash
register_mcp_server() {
    local name="$1" command="$2" args="$3"
    local mcp_file="${HOME}/.claude/mcp.json"
    
    # Creates JSON entry with tool metadata

    # Updates existing entries or appends new capabilities

}

```

This registration occurs automatically after successful installation for capabilities like `anything-analyzer` and `idapro` when the `--start-services` flag is active.

## Complete Workflow Example

The following invocation demonstrates the full discovery and installation pipeline:

```bash
bash bootstrap-reverse.sh jadx apktool --start-services

```

1. **Capability Parsing**: The script stores `jadx` and `apktool` in the `CAPABILITIES` array and sets `START_SERVICES=true`.

2. **Discovery Loop**: For each capability, `ensure_capability` executes:
   - **Check**: `command -v jadx` returns non-zero (not installed)
   - **Map**: The case statement routes `jadx` to `install_manifest_release`
   - **Manifest**: Reads metadata from [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) (repo: `skylot/jadx`, asset pattern, SHA-256 hash)
   - **Download**: `install_github_release` fetches the verified release asset
   - **Verify**: SHA-256 checksum validation passes
   - **Install**: Binary extracted to `$HOME/tools/jadx/bin/jadx`

3. **Registration**: If MCP configuration exists, `register_mcp_server` adds the jadx entry to Claude's configuration.

4. **Service Startup**: With `--start-services`, the script executes `start_jadx_service`, clones the repository if needed, installs dependencies, and validates the service port using `test_tcp_port`.

5. **Index Refresh**: Unless `--skip-refresh` is specified, [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) rebuilds [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) to document the newly available tools.

## Summary

- The **bootstrap system** in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) automates toolchain initialization through a three-layer architecture: argument parsing, discovery, and installation.
- **Discovery** combines `command -v` checks with a comprehensive catalog in [`tool-discovery.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-discovery.sh) that supports glob patterns and multiple fallback binaries.
- **Installation methods** include APT, pip, npm, and verified GitHub releases via `install_github_release`, which validates SHA-256 checksums before extraction.
- **MCP registration** automatically configures Claude integration by updating `~/.claude/mcp.json` with tool metadata.
- The system supports **service orchestration** through the `--start-services` flag, cloning repositories and launching daemons when required.

## Frequently Asked Questions

### What happens if a tool is already installed on the system?

The `ensure_capability` function checks for existing binaries using `command -v` before attempting any installation. If the tool is present, it logs the discovered path and returns immediately without modifying the system or downloading files, making the bootstrap process idempotent for existing installations.

### How does the system handle tools not available in standard package managers?

For tools like `jadx` or `ghidra` that require manual installation, the system consults [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) and executes `install_github_release`. This function queries the GitHub API, matches assets using regex patterns, validates SHA-256 checksums against manifest entries, and extracts archives to `$HOME/tools/`, effectively bridging the gap between release distribution and system integration.

### Can the bootstrap system install specific versions of tools?

Yes, the `install_github_release` function accepts an optional `release_tag` parameter (fourth argument) that specifies exact GitHub release versions. When provided, the installer targets that specific tag rather than the latest release, ensuring reproducible environments across different machines or deployment runs.

### What is the purpose of the MCP server registration?

The `register_mcp_server` function enables integration with Claude Desktop and compatible AI agents by writing JSON configuration entries to `~/.claude/mcp.json`. This registration allows AI assistants to discover and invoke installed reverse-engineering tools through the Model Context Protocol, effectively turning command-line utilities into callable functions for AI-assisted analysis workflows.