Complete Guide to MCP Services Managed by reverse-skill: Security Tools for AI Agents

The reverse-skill repository manages over 20 MCP (Model-Context-Protocol) services that expose security and reverse-engineering tools—including Jadx, Frida, IDA Pro, Ghidra, and Burp Suite—to AI agents via JSON-RPC endpoints.

The reverse-skill project acts as a skill-router that abstracts a comprehensive collection of MCP services behind standardized JSON-RPC interfaces. By containerizing and exposing utilities for Android reversing, binary analysis, and web penetration testing, it allows AI agents to programmatically control sophisticated security tools without manual configuration of each toolchain.

What Are MCP Services in reverse-skill?

MCP (Model-Context-Protocol) services in reverse-skill are lightweight servers—running locally or in containers—that register JSON-RPC endpoints for specific security capabilities. According to the canonical capability list in skills/SKILL.md, each service maps to a bootstrap method defined in skills/scripts/bootstrap-manifest.json, which determines how the server starts (npm-mcp, local-http-mcp, pip-package, etc.). When an AI agent requires a capability, the reverse-skill router discovers the appropriate MCP service, starts the server if necessary, and routes the request to the correct endpoint.

Android Reverse Engineering MCP Services

The following MCP services specialize in mobile application analysis and runtime instrumentation:

• jadx: Decompiles Android DEX/APK files to readable Java source code.
• apktool: Disassembles APK packages to extract resources and Smali bytecode for manual inspection.
• jeb-pro: Provides interactive Java bytecode debugging through the JEB decompiler interface.
• frida: Enables dynamic instrumentation of native and managed processes, supporting runtime hooking and memory read/write operations.
• frida-ps: Lists running processes and performs basic inspection via Frida scripts.
• adb: Controls the Android Debug Bridge for remote device shell access, app installation, and system manipulation.

Static Binary Analysis MCP Services

For native executable and firmware analysis, reverse-skill exposes these disassemblers and decompilers:

• idalib-mcp: Exposes the IDA Pro API over JSON-RPC, allowing AI agents to drive decompilation, cross-references, and byte-level analysis programmatically. Documented in skills/ida-reverse/SKILL.md.
• idapro: Launches the full IDA Pro GUI directly when interactive visualization is required rather than headless automation.
• ghidra-mcp: Provides a headless interface to Ghidra’s analysis engine, offering a free alternative to IDA Pro for automated decompilation. Details are available in skills/ghidra-reverse/SKILL.md.
• r2: Integrates the Radare2 engine for binary analysis, disassembly, and scripting.
• rabin2: Exposes Radare2’s command-line utilities for quick information extraction, including strings, sections, and import tables.
• binwalk: Extracts and analyzes embedded files within firmware images.
• yara: Performs signature-based malware detection and classification against known patterns.

Web Penetration Testing and Network MCP Services

These services handle network reconnaissance, traffic interception, and vulnerability assessment:

• burpsuite-mcp: Bridges the Burp Suite Professional ecosystem—Proxy, Intruder, Repeater, Scanner, and Collaborator—exposing approximately 78 individual tools via MCP. Full documentation resides in skills/pentest-tools/SKILL.md.
• reqable-mcp: Connects the Reqable desktop client for traffic capture, API debugging, and breakpoint control.
• nmap: Executes network mapping for host discovery, port scanning, and service/version detection.
• proxycat: Operates as a simple HTTP/HTTPS proxy with request/response logging and replay capabilities.
• pentestswarm: Runs automated enumeration scripts targeting common web application vulnerabilities such as SQL injection and XSS.
• seclists: Serves curated wordlists containing passwords and usernames for brute-force and reconnaissance tasks.

Browser Automation and JavaScript Analysis MCP Services

For web client analysis and JavaScript reverse engineering:

• jshookmcp: Comprehensive browser-side tooling supporting Chrome DevTools Protocol (CDP) debugging, network interception, JavaScript runtime hooking, AST deobfuscation, source-map reconstruction, Frida-style memory inspection, WebAssembly reversing, and Android adb bridging. Documented in skills/js-reverse/SKILL.md.
• agent-browser: Drives headless Chromium instances to render pages, capture screenshots, and extract DOM data.
• anything-analyzer: Runs a lightweight local HTTP server on port 23816 that combines browser automation with HTTP capture/replay functionality, optionally providing AI-driven analysis of captured traffic.

Exploitation and Specialized MCP Services

Specialized utilities for capture-the-flag scenarios and archive analysis:

• pwntools: Exposes the Python pwntools library for exploit development, offering shellcraft generation, ROP chain building, and remote process interaction.
• bkcrack: Performs brute-force password recovery against encrypted ZIP archives.

How to Bootstrap and Call MCP Services

The skills/scripts/bootstrap-manifest.json file maps each capability to its startup method. Below are practical examples of how AI agents interact with these services.

Initialize a service and call a browser automation method via Python:

# Discover the appropriate MCP service for HTTP capture

tool = agent.select_tool(category="network_capture")

# Returns: "anything-analyzer"

# Launch a headless Chrome session through the MCP

response = agent.call_mcp(
    service="anything-analyzer",
    method="browser.launch",
    params={"url": "https://example.com", "headless": True}
)
print(response["screenshot"])  # Base64-encoded PNG

Start a server and invoke methods via Bash:

# Bootstrap the jshookmcp server for the Claude host

bash skills/scripts/bootstrap-reverse.sh jshookmcp --mcp-host=claude

# Call the network interceptor via JSON-RPC

curl -X POST http://localhost:23816/jsonrpc \
     -d '{"jsonrpc":"2.0","id":1,"method":"jshookmcp.network.intercept","params":{"url":"*"}}'

Register IDA Pro capabilities via PowerShell:

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability idalib-mcp -McpHostTarget Claude

Key Documentation and Source Files

The following files define and document the MCP services managed by reverse-skill:

• skills/SKILL.md: Master registry of all supported capabilities and their primary purposes.
• skills/js-reverse/SKILL.md: Detailed specification of jshookmcp sub-tools (CDP, WASM, etc.).
• skills/pentest-tools/SKILL.md: Overview of Burp Suite, Reqable, and network testing integrations.
• skills/ida-reverse/SKILL.md: Configuration for idalib-mcp JSON-RPC endpoints.
• skills/ghidra-reverse/SKILL.md: Setup instructions for the ghidra-mcp headless server.
• skills/scripts/bootstrap-manifest.json: JSON mapping of capability names to bootstrap methods.
• docs/OVERVIEW.md: High-level architectural documentation explaining how MCP services integrate into the reverse-skill platform.

Summary

• reverse-skill exposes 24+ MCP services covering Android reversing, static analysis, web pentesting, and browser automation.
• Services like idalib-mcp, ghidra-mcp, and burpsuite-mcp wrap commercial and open-source tools in JSON-RPC interfaces for AI consumption.
• The bootstrap system uses skills/scripts/bootstrap-manifest.json to determine how each server starts (npm, HTTP, or pip).
• anything-analyzer and jshookmcp provide specialized browser and JavaScript analysis capabilities on local ports.
• All capabilities are cataloged in skills/SKILL.md with category-specific details in subdirectories like skills/pentest-tools/ and skills/ida-reverse/.

Frequently Asked Questions

What is the difference between idalib-mcp and idapro services?

idalib-mcp exposes IDA Pro’s programmatic API over JSON-RPC, enabling headless automation where an AI agent can request decompilation or cross-references without GUI interaction. idapro simply launches the full IDA Pro graphical interface for manual analysis sessions. According to skills/SKILL.md, use idalib-mcp for scripted workflows and idapro when interactive visualization is required.

How does reverse-skill connect MCP services to AI agents?

The router consults skills/scripts/bootstrap-manifest.json to determine the bootstrap method (npm-mcp, local-http-mcp, etc.) for each capability. Once started, the MCP server registers a JSON-RPC endpoint—typically on localhost—which the agent queries using standard JSON-RPC 2.0 requests. As implemented in skills/SKILL.md, the system supports both automatic service discovery via agent.select_tool() and direct invocation via agent.call_mcp().

Can I use reverse-skill MCP services without purchasing IDA Pro?

Yes. While idalib-mcp requires an IDA Pro license, ghidra-mcp provides a fully free alternative for static binary analysis. The skills/ghidra-reverse/SKILL.md file documents how to run Ghidra’s analysis engine in headless mode via MCP, offering comparable decompilation and scripting capabilities for reverse engineering workflows.

Which MCP service should I use for intercepting HTTPS traffic from mobile applications?

For mobile HTTPS interception, combine proxycat or reqable-mcp for traffic capture with frida for SSL pinning bypass. The anything-analyzer service (port 23816) also provides HTTP capture/replay with browser automation if testing web views. For comprehensive Burp Suite integration—including active scanning and intruder attacks—use burpsuite-mcp as documented in skills/pentest-tools/SKILL.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}