How the Reverse-Skill Tool Bootstrap System Discovers and Installs Missing Tools

The reverse-skill bootstrap system is a Bash-based orchestrator that automates toolchain setup by checking for existing binaries via command -v, consulting a comprehensive tool catalog in tool-discovery.sh, and executing targeted installers for APT, pip, npm, or verified GitHub releases before optionally registering tools as MCP servers with Claude.

The zhaoxuya520/reverse-skill repository provides a specialized environment for reverse-engineering and penetration testing workflows. At its core lies a sophisticated bootstrap mechanism that eliminates manual dependency management by intelligently detecting missing capabilities and acquiring them through the most appropriate distribution channel.

Architecture Overview

The bootstrap system operates through three distinct logical layers defined in kali/scripts/bootstrap-reverse.sh. Each layer handles a specific phase of the toolchain initialization process.

Layer 1: Argument Parsing

The entry point parses command-line arguments into structured variables. Lines 27-39 of bootstrap-reverse.sh process $@ to populate CAPABILITIES, START_SERVICES, and SKIP_REFRESH arrays, allowing users to specify which tools to install and whether to launch associated services immediately.

Layer 2: Tool Discovery

The ensure_capability function (lines 23-63) serves as the primary discovery mechanism. It first attempts to locate the requested binary using command -v "$name". When this check fails, the system falls back to the comprehensive catalog defined in kali/scripts/lib/tool-discovery.sh (lines 17-85), where the resolve_tool helper (lines 60-92) iterates through comma-separated fallback commands and expands globs to locate executable files.

Layer 3: Installation and Registration

Once a tool is identified as missing, the system selects an appropriate installer from a case statement mapping. Available installers include install_apt_package (lines 91-99), install_pip_package (lines 102-110), install_npm_global (lines 113-121), and install_github_release (lines 123-191). Post-installation, the register_mcp_server function (lines 41-66) can add JSON entries to ${HOME}/.claude/mcp.json for Claude MCP protocol integration.

How Tool Discovery Works

The discovery process combines shell-native checks with a flexible catalog system.

Primary Availability Check

The ensure_capability function performs an immediate system check:

ensure_capability() {
    local name="$1"

    if command -v "$name" &>/dev/null; then
        log_ok "$name 已可用: $(command -v "$name")"
        return 0
    fi

    log_info "开始安装: $name"
    # ... proceeds to installation logic

}

This check determines whether the requested utility exists in the system PATH before attempting any network operations.

Catalog-Based Fallback Resolution

When the primary check fails, the system consults tool-discovery.sh. The resolve_tool function processes catalog entries containing pipe-delimited fields for tool names, fallback command patterns, and version checking arguments:

resolve_tool() {
    local entry="$1"
    IFS='|' read -r name skill purpose version_args fallbacks <<< "$entry"
    IFS=',' read -ra candidates <<< "$fallbacks"
    
    for candidate in "${candidates[@]}"; do
        expanded=$(compgen -G "$candidate" | head -n1)
        if [[ -x "$expanded" ]]; then
            echo "${name}|${skill}|${purpose}|yes|${expanded}|..."
            return
        fi
        
        cmd_path=$(find_command "$candidate")
        if [[ -n "$cmd_path" ]]; then
            echo "${name}|${skill}|${purpose}|yes|${cmd_path}|..."
            return
        fi
    done
    echo "${name}|${skill}|${purpose}|no|||missing"
}

This implementation supports glob expansion (e.g., $HOME/Android/Sdk/*/adb) and multiple fallback binaries, reporting "yes" with the discovered path or "no" if completely absent.

Installation Methods and Providers

The bootstrap system supports heterogeneous installation sources through specialized helper functions, selecting the appropriate method via a case statement in ensure_capability.

Package Manager Installations

APT packages handle system-level dependencies like nmap, sqlmap, and radare2:

install_apt_package() {
    local pkg="$1"
    sudo apt-get update -qq
    sudo apt-get install -y -qq "$pkg"
}

Python packages accommodate tools like Frida through install_pip_package (lines 102-110), which ensures pip availability before installing frida-tools.

Node.js packages support JavaScript-based utilities via install_npm_global (lines 113-121), executing npm install -g with proper permission handling.

GitHub Release Installations

For binaries distributed exclusively through GitHub, the install_github_release function (lines 123-191) implements a secure download pipeline:

install_github_release() {
    local repo="$1" asset_regex="$2" install_dir="$3" 
    local release_tag="${4:-}" expected_sha256="${5:-}"
    
    # API request and asset matching logic

    curl -L -o "$tmp_file" "$download_url"
    
    # SHA-256 verification

    sha256sum "$tmp_file" | awk '{print $1}' | grep -q "$expected_sha256"
    
    # Extraction based on file extension (.tar.gz, .zip, etc.)

    case "$asset_name" in
        *.tar.gz) tar -xzf "$tmp_file" -C "$install_dir" ;;
        *.zip) unzip -q "$tmp_file" -d "$install_dir" ;;
    esac
}

This function validates cryptographic checksums against values specified in bootstrap-manifest.json before extracting archives to the designated $HOME/tools/ directory.

MCP Server Registration

Tools that expose Model Context Protocol (MCP) endpoints undergo additional registration. The register_mcp_server function appends structured JSON to ~/.claude/mcp.json, enabling Claude-based agents to invoke the tool through standardized MCP interfaces:

register_mcp_server() {
    local name="$1" command="$2" args="$3"
    local mcp_file="${HOME}/.claude/mcp.json"
    
    # Creates JSON entry with tool metadata

    # Updates existing entries or appends new capabilities

}

This registration occurs automatically after successful installation for capabilities like anything-analyzer and idapro when the --start-services flag is active.

Complete Workflow Example

The following invocation demonstrates the full discovery and installation pipeline:

bash bootstrap-reverse.sh jadx apktool --start-services

1. Capability Parsing: The script stores jadx and apktool in the CAPABILITIES array and sets START_SERVICES=true.

2. Discovery Loop: For each capability, ensure_capability executes:

   • Check: command -v jadx returns non-zero (not installed)
   • Map: The case statement routes jadx to install_manifest_release
   • Manifest: Reads metadata from bootstrap-manifest.json (repo: skylot/jadx, asset pattern, SHA-256 hash)
   • Download: install_github_release fetches the verified release asset
   • Verify: SHA-256 checksum validation passes
   • Install: Binary extracted to $HOME/tools/jadx/bin/jadx

3. Registration: If MCP configuration exists, register_mcp_server adds the jadx entry to Claude's configuration.

4. Service Startup: With --start-services, the script executes start_jadx_service, clones the repository if needed, installs dependencies, and validates the service port using test_tcp_port.

5. Index Refresh: Unless --skip-refresh is specified, refresh-tool-index.sh rebuilds skills/tool-index.md to document the newly available tools.

Summary

• The bootstrap system in bootstrap-reverse.sh automates toolchain initialization through a three-layer architecture: argument parsing, discovery, and installation.
• Discovery combines command -v checks with a comprehensive catalog in tool-discovery.sh that supports glob patterns and multiple fallback binaries.
• Installation methods include APT, pip, npm, and verified GitHub releases via install_github_release, which validates SHA-256 checksums before extraction.
• MCP registration automatically configures Claude integration by updating ~/.claude/mcp.json with tool metadata.
• The system supports service orchestration through the --start-services flag, cloning repositories and launching daemons when required.

Frequently Asked Questions

What happens if a tool is already installed on the system?

The ensure_capability function checks for existing binaries using command -v before attempting any installation. If the tool is present, it logs the discovered path and returns immediately without modifying the system or downloading files, making the bootstrap process idempotent for existing installations.

How does the system handle tools not available in standard package managers?

For tools like jadx or ghidra that require manual installation, the system consults bootstrap-manifest.json and executes install_github_release. This function queries the GitHub API, matches assets using regex patterns, validates SHA-256 checksums against manifest entries, and extracts archives to $HOME/tools/, effectively bridging the gap between release distribution and system integration.

Can the bootstrap system install specific versions of tools?

Yes, the install_github_release function accepts an optional release_tag parameter (fourth argument) that specifies exact GitHub release versions. When provided, the installer targets that specific tag rather than the latest release, ensuring reproducible environments across different machines or deployment runs.

What is the purpose of the MCP server registration?

The register_mcp_server function enables integration with Claude Desktop and compatible AI agents by writing JSON configuration entries to ~/.claude/mcp.json. This registration allows AI assistants to discover and invoke installed reverse-engineering tools through the Model Context Protocol, effectively turning command-line utilities into callable functions for AI-assisted analysis workflows.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}