# Installation Types for Tools in the Bootstrap Manifest: Complete Reference for reverse-skill

> Explore 13 installation types for tools in the reverse-skill bootstrap manifest, including pip-package and github-release-zip. Automate tool provisioning across all major operating systems.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: api-reference
- Published: 2026-08-23

---

**The reverse-skill repository defines 13 distinct installation types in its bootstrap manifest—from `github-release-zip` and `pip-package` to `local-http-mcp` and `manual`—that automate how third-party tools are provisioned across Windows, macOS, Linux, and Kali distributions.**

The [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) files in zhaoxuya520/reverse-skill provide a declarative configuration system for automated tool provisioning. Each entry specifies its installation method via the **`bootstrapKind`** field, which instructs the bootstrap script whether to download GitHub releases, install via package managers, or register MCP services. Understanding these installation types for tools in the bootstrap manifest is essential for contributing new capabilities or customizing your reverse engineering environment.

## GitHub Release Installation Types

These methods fetch pre-built binaries directly from GitHub releases, supporting various archive formats and validation mechanisms.

### github-release-zip

The **`github-release-zip`** type downloads a ZIP asset from a GitHub release, validates its SHA-256 hash, and extracts it to the target directory. As implemented in [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) at lines 14-23, this method is used for tools like `jadx`. The manifest entry specifies `repo`, `assetRegex`, and optional `assetSha256` for verification.

```json
{
  "name": "example-zip-tool",
  "bootstrapKind": "github-release-zip",
  "repo": "owner/example",
  "assetRegex": "^example-.*\\.zip$",
  "installDir": "%USERPROFILE%\\Tools\\example",
  "verifyCommand": "example",
  "releaseTag": "v1.2.3",
  "assetSha256": "<sha256>"
}

```

### github-release-jar-wrapper

For Java-based tools, **`github-release-jar-wrapper`** downloads a JAR file from a GitHub release and installs a wrapper script (e.g., `apktool.bat`) that invokes the JAR. According to the source code at `skills/scripts/bootstrap-manifest.json#L26-L34`, this type handles tools like `apktool` by managing both the binary download and the wrapper generation.

### github-release-tar

Specific to Kali Linux installations, **`github-release-tar`** downloads a TAR.GZ asset from a GitHub release and extracts it to the appropriate directory. This type appears in `kali/scripts/bootstrap-manifest.json#L39` for handling compressed archives that are not ZIP formatted.

## Package Manager Installation Types

These types leverage system or language-specific package managers to install tools declaratively.

### pip-package

The **`pip-package`** type installs Python tools via **pip** (or **pipx**) using a pinned package version. As seen in `skills/scripts/bootstrap-manifest.json#L47-L53` with the `frida` entry, this method ensures reproducible installations by specifying `pipPackage` and `pinnedVersion` fields.

```json
{
  "name": "example-pip",
  "bootstrapKind": "pip-package",
  "pipPackage": "example-pkg==1.0.0",
  "pinnedVersion": "1.0.0",
  "verifyCommand": "example-pkg"
}

```

### npm-global

For Node.js-based tools requiring global availability, **`npm-global`** installs packages globally and may run post-install scripts. The `agent-browser` entry in `skills/scripts/bootstrap-manifest.json#L12-L20` demonstrates this type, which can include additional steps such as installing Playwright browsers after the npm installation completes.

### npm-mcp

The **`npm-mcp`** type installs an MCP (Micro-Component-Proxy) server using **npm** or **npx** and registers it under one or more MCP names. Located at `skills/scripts/bootstrap-manifest.json#L80-L98`, this method is used for tools like `reqable-mcp`, specifying `mcpNames`, `mcpCommand`, and `mcpArgs` to configure the service registration.

```json
{
  "name": "example-mcp",
  "bootstrapKind": "npm-mcp",
  "npmPackage": "example-mcp@2.1.0",
  "mcpNames": ["example"],
  "mcpCommand": "npx",
  "mcpArgs": ["-y", "example-mcp@2.1.0"]
}

```

### winget-package

On Windows systems, **`winget-package`** installs packages via the Windows Package Manager. The `adb` entry in `skills/scripts/bootstrap-manifest.json#L2-4` uses this type with an optional `pinPolicy: "winget-latest"` to ensure the latest version is installed while maintaining declarative configuration.

### apt-package

Exclusive to Kali Linux, **`apt-package`** installs Debian packages via the **apt** package manager. This type appears in `kali/scripts/bootstrap-manifest.json#L52` for tools available in standard Debian repositories.

### go-install

The **`go-install`** type uses `go install` to compile and install Go binaries directly from source, optionally falling back to Docker images if compilation fails. As defined in `skills/scripts/bootstrap-manifest.json#L94-100`, this method handles tools like `pentestswarm` that are distributed as Go modules.

## MCP Service Registration Types

These specialized types register Model Context Protocol services without necessarily installing traditional binaries.

### remote-http-mcp

The **`remote-http-mcp`** type registers a remote MCP endpoint without installing any local binary. According to `skills/scripts/bootstrap-manifest.json#L21-L31`, this method records the service URL and verification mode for tools like `xquik-mcp`, enabling connections to externally hosted MCP servers.

### local-http-mcp

For locally-hosted services, **`local-http-mcp`** deploys a web server and registers its local URL. As shown in `skills/scripts/bootstrap-manifest.json#L35-L55` with the `anything-analyzer` entry, this type includes configuration for start commands, ports, and post-install steps to bring the service online.

## Repository and Manual Installation Types

These methods handle source code retrieval or tools requiring user intervention.

### git-clone

The **`git-clone`** type clones a Git repository at a specific commit and optionally runs post-install steps. The `seclists` entry in `skills/scripts/bootstrap-manifest.json#L48-53` demonstrates this approach, which is ideal for tools distributed as Git repositories rather than packaged releases.

### manual

For commercial tools or those requiring licenses, **`manual`** indicates that the user must perform the installation themselves. As documented in `skills/scripts/bootstrap-manifest.json#L39-L45` with the `jeb-pro` entry, this type provides documentation links and installation hints while acknowledging that automated provisioning is not possible.

## Summary

- The reverse-skill bootstrap manifest supports **13 distinct installation types** defined by the `bootstrapKind` field.
- **GitHub release types** (`github-release-zip`, `github-release-jar-wrapper`, `github-release-tar`) handle binary distribution from release assets across different archive formats.
- **Package manager types** (`pip-package`, `npm-global`, `npm-mcp`, `winget-package`, `apt-package`, `go-install`) integrate with ecosystem-specific installers for reproducible deployments.
- **MCP service types** (`remote-http-mcp`, `local-http-mcp`) register Model Context Protocol endpoints for AI-assisted tooling workflows.
- **Source and manual types** (`git-clone`, `manual`) handle repository-based installations and commercial tools requiring user intervention.
- Primary configuration occurs in **[`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json)**, with Kali-specific extensions in **[`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)**.

## Frequently Asked Questions

### What is the difference between npm-mcp and npm-global installation types?

**`npm-mcp`** specifically installs and registers Model Context Protocol servers, requiring `mcpNames` and `mcpArgs` configuration to define how the service is invoked, while **`npm-global`** installs general-purpose Node.js packages globally without MCP registration. According to the source code, `npm-mcp` is used for tools like `reqable-mcp` at `skills/scripts/bootstrap-manifest.json#L80-L98`, whereas `npm-global` handles standard CLI tools like `agent-browser`.

### Which installation type should I use for commercial tools requiring manual licensing?

Use the **`manual`** installation type. As implemented in `skills/scripts/bootstrap-manifest.json#L39-L45` for tools like `jeb-pro`, this type acknowledges that the tool cannot be automatically installed and instead provides documentation links and installation hints for the user to complete the process manually.

### What installation types are available exclusively for Kali Linux?

Kali Linux utilizes two platform-specific types: **`github-release-tar`** (for TAR.GZ GitHub releases) at `kali/scripts/bootstrap-manifest.json#L39` and **`apt-package`** (for Debian package installation) at `kali/scripts/bootstrap-manifest.json#L52`. These complement the cross-platform types available in the main manifest.

### How do I configure a tool that requires a specific GitHub release ZIP file?

Use the **`github-release-zip`** type with the `assetRegex` field to match your specific file pattern. As shown in the `jadx` configuration at `skills/scripts/bootstrap-manifest.json#L14-L23`, you must specify the `repo`, `assetRegex`, `installDir`, and optional `assetSha256` for hash verification to ensure secure, reproducible installations of ZIP-distributed tools.