Reverse-Skill Bootstrap Manifest Capabilities: The Complete List of 24 Tools

The reverse-skill bootstrap manifest defines 24 capabilities that enable on-demand installation of reverse-engineering, security, and analysis tools.

The bootstrap manifest in the zhaoxuya520/reverse-skill repository serves as the single source of truth for which tools can be automatically installed and launched. Each capability maps to a specific tool or framework used in reverse engineering, malware analysis, penetration testing, or binary analysis. This article breaks down every capability, explains how the manifest system works, and shows how to invoke tools using the bootstrap scripts.

What Is the Reverse-Skill Bootstrap Manifest

The bootstrap manifest is a JSON configuration file that declares all supported capabilities. According to the project's skills/SKILL.md, this file—located at skills/scripts/bootstrap-manifest.json—is the authoritative reference for what tools reverse-skill can provision.

When you request a capability, the bootstrap scripts (bootstrap-reverse.ps1 for Windows or bootstrap-reverse.sh for Kali Linux) parse this manifest to determine:

• Which package manager or installation method to use
• Required dependencies
• Launch parameters

Complete List of 24 Bootstrap Manifest Capabilities

The following table lists every capability defined in the reverse-skill bootstrap manifest, organized by primary use case.

Decompilation & Disassembly

Capability	Description
jadx	Decompiler for Android APK files — converts Dalvik bytecode to readable Java source
jeb-pro	Commercial-grade Android reverse-engineering IDE with advanced decompilation
idapro	Interactive Disassembler (IDA Pro) — industry standard for binary analysis
idalib-mcp	IDA Pro library integration for MCP (Modular Capability Platform)
ghidra-mcp	Ghidra integration for MCP — NSA's open-source reverse-engineering framework
r2	Radare2 — complete open-source reverse-engineering framework
rabin2	Radare2 binary analysis utility for extracting metadata from executables

Android Reverse Engineering

Capability	Description
apktool	Android reverse-engineering toolkit for decoding and rebuilding APKs
frida	Dynamic instrumentation framework for runtime analysis of compiled apps
frida-ps	Frida companion tool for listing and attaching to running processes

Network & Web Security

Capability	Description
reqable-mcp	HTTP/HTTPS request replay and analysis tool
proxycat	Lightweight HTTP/HTTPS proxy for traffic interception
burpsuite-mcp	Burp Suite integration for MCP — web application security testing
nmap	Network mapper for port scanning and service discovery

Dynamic Analysis & Hooking

Capability	Description
jshookmcp	JavaScript hooking library for instrumenting runtime behavior
agent-browser	Browser automation agent for analyzing web-based targets

Static Analysis & Firmware

Capability	Description
anything-analyzer	Generic binary analyzer for unknown file formats
binwalk	Firmware analysis tool for extracting embedded file systems and data
yara	Pattern-matching engine for identifying and classifying malware samples

Exploitation & CTF Tools

Capability	Description
pwntools	CTF and pwn exploitation library for binary exploitation challenges
pentestswarm	Automated penetration testing orchestration framework
bkcrack	Password hash cracking utility for recovering credentials

Supporting Resources

Capability	Description
seclists	Comprehensive collection of security wordlists (passwords, fuzzing payloads, discovery lists)
adb	Android Debug Bridge for device communication and debugging

How to Invoke Bootstrap Manifest Capabilities

The bootstrap scripts read bootstrap-manifest.json to translate capability names into installation and execution commands.

Windows PowerShell

# Install and launch Frida for dynamic instrumentation

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability frida

# Install Ghidra for static analysis

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability ghidra-mcp

Kali Linux

# Install and launch APKTool for Android analysis

bash kali/scripts/bootstrap-reverse.sh -c apktool

# Install Radare2 with binary analysis utilities

bash kali/scripts/bootstrap-reverse.sh -c r2
bash kali/scripts/bootstrap-reverse.sh -c rabin2

Key Files in the Bootstrap Manifest System

Understanding the file structure helps you extend or troubleshoot the capability system:

• skills/scripts/bootstrap-manifest.json — Primary manifest containing all 24 capability definitions with Windows-compatible installation descriptors

• kali/scripts/bootstrap-manifest.json — Kali Linux variant with apt-based installation methods for the same capabilities

• skills/scripts/bootstrap-reverse.ps1 — PowerShell bootstrapper that parses the JSON manifest and executes winget, pip, or direct downloads

• kali/scripts/bootstrap-reverse.sh — Bash bootstrapper handling apt, pip, and manual installations

• skills/SKILL.md — Documentation explicitly referencing the manifest as the authoritative capability list (stated as: "支持的能力（以 scripts/bootstrap-manifest.json 为准）")

Extending the Bootstrap Manifest

To add a new capability, you must:

1. Define the capability entry in bootstrap-manifest.json with:

   • name: Unique capability identifier
   • installMethod: winget, apt, pip, or manual
   • packageName: Package identifier for the respective manager
   • postInstall (optional): Commands to run after installation

2. Update both platform manifests if cross-platform support is required

3. Test invocation via bootstrap-reverse.ps1 -Capability <name> or bootstrap-reverse.sh -c <name>

Summary

• The reverse-skill bootstrap manifest at skills/scripts/bootstrap-manifest.json defines 24 capabilities spanning decompilation, dynamic analysis, mobile reverse engineering, network security, and exploitation tools

• Capabilities are invoked through platform-specific bootstrap scripts that parse the manifest and handle installation automatically

• The manifest system supports Windows (winget/pip) and Kali Linux (apt/pip) through parallel JSON configurations

• All capabilities are documented in skills/SKILL.md with explicit reference to the manifest as the authoritative source

Frequently Asked Questions

Where is the reverse-skill bootstrap manifest located?

The primary manifest is at skills/scripts/bootstrap-manifest.json. A Kali Linux variant exists at kali/scripts/bootstrap-manifest.json. Both contain the same 24 capabilities with platform-specific installation methods.

How do I add a custom tool to the bootstrap manifest?

Add a new entry to bootstrap-manifest.json specifying name, installMethod (winget, apt, pip, or manual), and packageName. For cross-platform support, mirror the entry in both the Windows and Kali manifest files.

Can I use the bootstrap manifest without the provided scripts?

Yes, the JSON structure is self-documenting. Each capability entry contains sufficient metadata to drive custom automation. However, the official bootstrap-reverse.ps1 and bootstrap-reverse.sh scripts handle edge cases like dependency resolution and PATH configuration.

What happens if I request a capability not in the manifest?

The bootstrap scripts will fail with an error message indicating the capability was not found. They validate against the capabilities array in bootstrap-manifest.json before attempting any installation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}