# Bootstrapping Tools in reverse-skill: 12 Installation Methods Explained

> Discover 12 reverse-skill installation methods for bootstrapping tools. Explore package managers, GitHub releases, Git, Docker and more with this powerful cross-platform engine.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-26

---

**The reverse-skill project provides a cross-platform bootstrapping engine that supports twelve distinct installation methods for reverse-engineering tools, ranging from package managers like APT and Homebrew to GitHub releases, Git checkouts, and Docker fallbacks.**

The `reverse-skill` repository by zhaoxuya520 ships with automated bootstrapping scripts that eliminate manual setup friction for reverse-engineering and pentesting environments. The engine reads capability definitions from [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) and executes the appropriate installation strategy through [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) (Linux/macOS) or `bootstrap-reverse.ps1` (Windows).

## Package Manager Installation Methods

### APT Package Installation (Linux)

The **APT method** handles Debian-based distributions by updating package lists and installing system packages. According to the source code in [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh), the `install_apt()` function (lines 20-25) executes:

```bash
apt-get update
apt-get install -y <package>

```

This method is the default for capabilities targeting Ubuntu, Kali Linux, and other Debian derivatives.

### Homebrew Formula and Cask (macOS)

For macOS environments, reverse-skill provides two Homebrew-based methods:

- **`install_brew()`** – Installs standard Homebrew formulas using `brew install <package>`
- **`install_brew_cask()`** – Installs GUI applications and binaries via `brew install --cask <package>`

Both functions reside in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) and automatically handle the macOS software ecosystem.

## Language Runtime Methods

### Python and pipx Installation

The **Python runtime method** ensures `python3` is available before installing packages. The `ensure_python_runtime()` function prefers `pipx install --force <package>` for isolated tool installations, falling back to `pip install --user` when pipx is unavailable.

Capability-specific implementations like `ensure_frida_tools()` demonstrate this approach, checking for the Python interpreter before invoking package managers.

### Node.js and npm/pnpm

Node-based tools follow a similar runtime verification pattern through `ensure_node_runtime()`. The engine:

1. Verifies `node`, `npm`, and `npx` availability
2. Executes `npm install -g <package>` for global installation
3. Supports `pnpm` via `ensure_pnpm()`, which runs `npm install -g <pnpm-package>`

Specific capabilities like `ensure_jshookmcp()` and `ensure_reqable_mcp()` leverage this method to register MCP (Machine-Code-Provider) servers.

### Go Installation

Go modules install via `go install <module>`, implemented in `ensure_pentestswarm()` (lines 331-363). The function adds resulting binaries to `$PATH` and monitors for installation failures.

## Source and Binary Distribution Methods

### GitHub Release Downloads

The **`install_github_release()`** function (lines 100-120 in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh)) automates binary distribution:

- Queries the GitHub API for latest or tagged releases
- Verifies SHA-256 digests against the manifest
- Extracts archives to the tools root directory
- Updates `$PATH` to include the binary location

This method bypasses package managers for tools distributed exclusively through GitHub.

### Pinned Git Checkout

For bleeding-edge or specific versions, **`install_git_commit()`** (lines 224-268) performs:

1. Cloning the repository into a temporary staging area
2. Validating the checkout is clean and matches the target commit
3. Moving the validated code into the target directory

This ensures reproducible builds from specific Git references.

## Fallback and Manual Methods

### Docker Fallback

When native compilation fails (notably in `ensure_pentestswarm()`), the engine falls back to **Docker-based MCP definitions**. Instead of installing binaries locally, the script registers an MCP server configuration that runs the tool inside a container, maintaining functionality without polluting the host system.

### Manual Installation Marker

Tools requiring commercial licenses or complex manual builds trigger **`manual_required()`** (lines 445-452). This function:
- Prints configuration warnings
- Marks the capability status as `manual-required`
- Continues processing other capabilities without failing the entire bootstrap

## Integration and Service Management

### MCP Server Registration

After installing MCP-compatible tools, `write_mcp_server()` writes configuration entries to Claude (`~/.claude/mcp.json`) or Codex (`~/.codex/config.toml`). The helper functions `write_claude_mcp_server()` and `write_codex_mcp_server()` handle host-specific formatting.

Control the registration target with the `--mcp-host=none|claude|codex|both` flag.

### Service Management

Capabilities requiring background services (such as `idapro`) support the `--start-services` flag. The engine checks the `START_SERVICES` environment variable in the main loop and invokes service-specific functions like `ensure_idapro()` to launch daemons post-installation.

## Bootstrapping Workflow Execution

The [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script executes a six-phase workflow:

1. **Parse arguments** – Collects capabilities and flags (`--start-services`, `--skip-refresh`, `--mcp-host`)
2. **Expand dependencies** – Resolves capability chains (e.g., `idapro` requires `idalib-mcp`)
3. **Ensure runtime** – Validates Python, Node, Java, and other language interpreters
4. **Iterate capabilities** – Executes matching `ensure_<capability>()` functions using the manifest definitions
5. **Report status** – Returns `ready`, `manual-required`, `registration-required`, or `failed` for each capability
6. **Refresh tool index** – Runs [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) unless `--skip-refresh` is specified

## Practical Usage Examples

Install common reverse-engineering tools with capability names:

```bash

# Install jadx, apktool, and frida

bash skills/scripts/bootstrap-reverse.sh jadx apktool frida

```

Enable MCP registration and background services for IDA Pro:

```bash
bash skills/scripts/bootstrap-reverse.sh idapro --start-services --mcp-host=claude

```

Skip the post-installation tool index refresh for CI pipelines:

```bash
bash skills/scripts/bootstrap-reverse.sh pentestswarm --skip-refresh

```

Key implementation files include [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) (core engine), `skills/scripts/bootstrap-reverse.ps1` (Windows parity), and [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) (capability definitions).

## Summary

- **Twelve distinct methods** handle everything from system packages (APT, Homebrew) to language-specific installs (Python/pipx, Node/npm, Go) and source retrieval (GitHub releases, Git commits)
- **Docker fallback** and **manual markers** ensure graceful degradation when automatic installation fails
- **MCP registration** integrates tools directly with Claude or Codex AI assistants via `write_mcp_server()`
- **Cross-platform support** spans Linux (Bash), macOS (Bash), and Windows (PowerShell) through unified manifest definitions

## Frequently Asked Questions

### What is the difference between bootstrap-reverse.sh and bootstrap-reverse.ps1?

[`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) is the primary Bash implementation for Linux and macOS environments, while `bootstrap-reverse.ps1` provides PowerShell parity for Windows systems. Both scripts consume the same [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) definitions, ensuring consistent capability support across platforms.

### How does reverse-skill handle tools not available in package managers?

The engine prefers **GitHub release downloads** via `install_github_release()` for precompiled binaries, or **pinned Git checkouts** via `install_git_commit()` for source builds. If these fail, it falls back to **Docker containers** or marks the tool as `manual-required`.

### Can I use reverse-skill bootstrapping in CI/CD pipelines?

Yes. Pass the `--skip-refresh` flag to disable the tool index regeneration step, and use `--mcp-host=none` to skip AI assistant registration. The script returns appropriate exit codes and supports non-interactive execution.

### Where are MCP server configurations stored after bootstrapping?

Configurations are written to `~/.claude/mcp.json` for Claude Desktop or `~/.codex/config.toml` for Codex CLI, depending on the `--mcp-host` parameter. The `write_mcp_server()` function automatically creates these directories if they do not exist.