Installation Types for Tools in the Bootstrap Manifest: Complete Reference for reverse-skill

The reverse-skill repository defines 13 distinct installation types in its bootstrap manifest—from github-release-zip and pip-package to local-http-mcp and manual—that automate how third-party tools are provisioned across Windows, macOS, Linux, and Kali distributions.

The bootstrap-manifest.json files in zhaoxuya520/reverse-skill provide a declarative configuration system for automated tool provisioning. Each entry specifies its installation method via the bootstrapKind field, which instructs the bootstrap script whether to download GitHub releases, install via package managers, or register MCP services. Understanding these installation types for tools in the bootstrap manifest is essential for contributing new capabilities or customizing your reverse engineering environment.

GitHub Release Installation Types

These methods fetch pre-built binaries directly from GitHub releases, supporting various archive formats and validation mechanisms.

github-release-zip

The github-release-zip type downloads a ZIP asset from a GitHub release, validates its SHA-256 hash, and extracts it to the target directory. As implemented in skills/scripts/bootstrap-manifest.json at lines 14-23, this method is used for tools like jadx. The manifest entry specifies repo, assetRegex, and optional assetSha256 for verification.

{
  "name": "example-zip-tool",
  "bootstrapKind": "github-release-zip",
  "repo": "owner/example",
  "assetRegex": "^example-.*\\.zip$",
  "installDir": "%USERPROFILE%\\Tools\\example",
  "verifyCommand": "example",
  "releaseTag": "v1.2.3",
  "assetSha256": "<sha256>"
}

github-release-jar-wrapper

For Java-based tools, github-release-jar-wrapper downloads a JAR file from a GitHub release and installs a wrapper script (e.g., apktool.bat) that invokes the JAR. According to the source code at skills/scripts/bootstrap-manifest.json#L26-L34, this type handles tools like apktool by managing both the binary download and the wrapper generation.

github-release-tar

Specific to Kali Linux installations, github-release-tar downloads a TAR.GZ asset from a GitHub release and extracts it to the appropriate directory. This type appears in kali/scripts/bootstrap-manifest.json#L39 for handling compressed archives that are not ZIP formatted.

Package Manager Installation Types

These types leverage system or language-specific package managers to install tools declaratively.

pip-package

The pip-package type installs Python tools via pip (or pipx) using a pinned package version. As seen in skills/scripts/bootstrap-manifest.json#L47-L53 with the frida entry, this method ensures reproducible installations by specifying pipPackage and pinnedVersion fields.

{
  "name": "example-pip",
  "bootstrapKind": "pip-package",
  "pipPackage": "example-pkg==1.0.0",
  "pinnedVersion": "1.0.0",
  "verifyCommand": "example-pkg"
}

npm-global

For Node.js-based tools requiring global availability, npm-global installs packages globally and may run post-install scripts. The agent-browser entry in skills/scripts/bootstrap-manifest.json#L12-L20 demonstrates this type, which can include additional steps such as installing Playwright browsers after the npm installation completes.

npm-mcp

The npm-mcp type installs an MCP (Micro-Component-Proxy) server using npm or npx and registers it under one or more MCP names. Located at skills/scripts/bootstrap-manifest.json#L80-L98, this method is used for tools like reqable-mcp, specifying mcpNames, mcpCommand, and mcpArgs to configure the service registration.

{
  "name": "example-mcp",
  "bootstrapKind": "npm-mcp",
  "npmPackage": "example-mcp@2.1.0",
  "mcpNames": ["example"],
  "mcpCommand": "npx",
  "mcpArgs": ["-y", "example-mcp@2.1.0"]
}

winget-package

On Windows systems, winget-package installs packages via the Windows Package Manager. The adb entry in skills/scripts/bootstrap-manifest.json#L2-4 uses this type with an optional pinPolicy: "winget-latest" to ensure the latest version is installed while maintaining declarative configuration.

apt-package

Exclusive to Kali Linux, apt-package installs Debian packages via the apt package manager. This type appears in kali/scripts/bootstrap-manifest.json#L52 for tools available in standard Debian repositories.

go-install

The go-install type uses go install to compile and install Go binaries directly from source, optionally falling back to Docker images if compilation fails. As defined in skills/scripts/bootstrap-manifest.json#L94-100, this method handles tools like pentestswarm that are distributed as Go modules.

MCP Service Registration Types

These specialized types register Model Context Protocol services without necessarily installing traditional binaries.

remote-http-mcp

The remote-http-mcp type registers a remote MCP endpoint without installing any local binary. According to skills/scripts/bootstrap-manifest.json#L21-L31, this method records the service URL and verification mode for tools like xquik-mcp, enabling connections to externally hosted MCP servers.

local-http-mcp

For locally-hosted services, local-http-mcp deploys a web server and registers its local URL. As shown in skills/scripts/bootstrap-manifest.json#L35-L55 with the anything-analyzer entry, this type includes configuration for start commands, ports, and post-install steps to bring the service online.

Repository and Manual Installation Types

These methods handle source code retrieval or tools requiring user intervention.

git-clone

The git-clone type clones a Git repository at a specific commit and optionally runs post-install steps. The seclists entry in skills/scripts/bootstrap-manifest.json#L48-53 demonstrates this approach, which is ideal for tools distributed as Git repositories rather than packaged releases.

manual

For commercial tools or those requiring licenses, manual indicates that the user must perform the installation themselves. As documented in skills/scripts/bootstrap-manifest.json#L39-L45 with the jeb-pro entry, this type provides documentation links and installation hints while acknowledging that automated provisioning is not possible.

Summary

• The reverse-skill bootstrap manifest supports 13 distinct installation types defined by the bootstrapKind field.
• GitHub release types (github-release-zip, github-release-jar-wrapper, github-release-tar) handle binary distribution from release assets across different archive formats.
• Package manager types (pip-package, npm-global, npm-mcp, winget-package, apt-package, go-install) integrate with ecosystem-specific installers for reproducible deployments.
• MCP service types (remote-http-mcp, local-http-mcp) register Model Context Protocol endpoints for AI-assisted tooling workflows.
• Source and manual types (git-clone, manual) handle repository-based installations and commercial tools requiring user intervention.
• Primary configuration occurs in skills/scripts/bootstrap-manifest.json, with Kali-specific extensions in kali/scripts/bootstrap-manifest.json.

Frequently Asked Questions

What is the difference between npm-mcp and npm-global installation types?

npm-mcp specifically installs and registers Model Context Protocol servers, requiring mcpNames and mcpArgs configuration to define how the service is invoked, while npm-global installs general-purpose Node.js packages globally without MCP registration. According to the source code, npm-mcp is used for tools like reqable-mcp at skills/scripts/bootstrap-manifest.json#L80-L98, whereas npm-global handles standard CLI tools like agent-browser.

Which installation type should I use for commercial tools requiring manual licensing?

Use the manual installation type. As implemented in skills/scripts/bootstrap-manifest.json#L39-L45 for tools like jeb-pro, this type acknowledges that the tool cannot be automatically installed and instead provides documentation links and installation hints for the user to complete the process manually.

What installation types are available exclusively for Kali Linux?

Kali Linux utilizes two platform-specific types: github-release-tar (for TAR.GZ GitHub releases) at kali/scripts/bootstrap-manifest.json#L39 and apt-package (for Debian package installation) at kali/scripts/bootstrap-manifest.json#L52. These complement the cross-platform types available in the main manifest.

How do I configure a tool that requires a specific GitHub release ZIP file?

Use the github-release-zip type with the assetRegex field to match your specific file pattern. As shown in the jadx configuration at skills/scripts/bootstrap-manifest.json#L14-L23, you must specify the repo, assetRegex, installDir, and optional assetSha256 for hash verification to ensure secure, reproducible installations of ZIP-distributed tools.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}