Bootstrapping Tools in reverse-skill: 12 Installation Methods Explained

The reverse-skill project provides a cross-platform bootstrapping engine that supports twelve distinct installation methods for reverse-engineering tools, ranging from package managers like APT and Homebrew to GitHub releases, Git checkouts, and Docker fallbacks.

The reverse-skill repository by zhaoxuya520 ships with automated bootstrapping scripts that eliminate manual setup friction for reverse-engineering and pentesting environments. The engine reads capability definitions from bootstrap-manifest.json and executes the appropriate installation strategy through bootstrap-reverse.sh (Linux/macOS) or bootstrap-reverse.ps1 (Windows).

Package Manager Installation Methods

APT Package Installation (Linux)

The APT method handles Debian-based distributions by updating package lists and installing system packages. According to the source code in skills/scripts/bootstrap-reverse.sh, the install_apt() function (lines 20-25) executes:

apt-get update
apt-get install -y <package>

This method is the default for capabilities targeting Ubuntu, Kali Linux, and other Debian derivatives.

Homebrew Formula and Cask (macOS)

For macOS environments, reverse-skill provides two Homebrew-based methods:

• install_brew() – Installs standard Homebrew formulas using brew install <package>
• install_brew_cask() – Installs GUI applications and binaries via brew install --cask <package>

Both functions reside in bootstrap-reverse.sh and automatically handle the macOS software ecosystem.

Language Runtime Methods

Python and pipx Installation

The Python runtime method ensures python3 is available before installing packages. The ensure_python_runtime() function prefers pipx install --force <package> for isolated tool installations, falling back to pip install --user when pipx is unavailable.

Capability-specific implementations like ensure_frida_tools() demonstrate this approach, checking for the Python interpreter before invoking package managers.

Node.js and npm/pnpm

Node-based tools follow a similar runtime verification pattern through ensure_node_runtime(). The engine:

1. Verifies node, npm, and npx availability
2. Executes npm install -g <package> for global installation
3. Supports pnpm via ensure_pnpm(), which runs npm install -g <pnpm-package>

Specific capabilities like ensure_jshookmcp() and ensure_reqable_mcp() leverage this method to register MCP (Machine-Code-Provider) servers.

Go Installation

Go modules install via go install <module>, implemented in ensure_pentestswarm() (lines 331-363). The function adds resulting binaries to $PATH and monitors for installation failures.

Source and Binary Distribution Methods

GitHub Release Downloads

The install_github_release() function (lines 100-120 in bootstrap-reverse.sh) automates binary distribution:

• Queries the GitHub API for latest or tagged releases
• Verifies SHA-256 digests against the manifest
• Extracts archives to the tools root directory
• Updates $PATH to include the binary location

This method bypasses package managers for tools distributed exclusively through GitHub.

Pinned Git Checkout

For bleeding-edge or specific versions, install_git_commit() (lines 224-268) performs:

1. Cloning the repository into a temporary staging area
2. Validating the checkout is clean and matches the target commit
3. Moving the validated code into the target directory

This ensures reproducible builds from specific Git references.

Fallback and Manual Methods

Docker Fallback

When native compilation fails (notably in ensure_pentestswarm()), the engine falls back to Docker-based MCP definitions. Instead of installing binaries locally, the script registers an MCP server configuration that runs the tool inside a container, maintaining functionality without polluting the host system.

Manual Installation Marker

Tools requiring commercial licenses or complex manual builds trigger manual_required() (lines 445-452). This function:

• Prints configuration warnings
• Marks the capability status as manual-required
• Continues processing other capabilities without failing the entire bootstrap

Integration and Service Management

MCP Server Registration

After installing MCP-compatible tools, write_mcp_server() writes configuration entries to Claude (~/.claude/mcp.json) or Codex (~/.codex/config.toml). The helper functions write_claude_mcp_server() and write_codex_mcp_server() handle host-specific formatting.

Control the registration target with the --mcp-host=none|claude|codex|both flag.

Service Management

Capabilities requiring background services (such as idapro) support the --start-services flag. The engine checks the START_SERVICES environment variable in the main loop and invokes service-specific functions like ensure_idapro() to launch daemons post-installation.

Bootstrapping Workflow Execution

The bootstrap-reverse.sh script executes a six-phase workflow:

1. Parse arguments – Collects capabilities and flags (--start-services, --skip-refresh, --mcp-host)
2. Expand dependencies – Resolves capability chains (e.g., idapro requires idalib-mcp)
3. Ensure runtime – Validates Python, Node, Java, and other language interpreters
4. Iterate capabilities – Executes matching ensure_<capability>() functions using the manifest definitions
5. Report status – Returns ready, manual-required, registration-required, or failed for each capability
6. Refresh tool index – Runs refresh-tool-index.sh unless --skip-refresh is specified

Practical Usage Examples

Install common reverse-engineering tools with capability names:

# Install jadx, apktool, and frida

bash skills/scripts/bootstrap-reverse.sh jadx apktool frida

Enable MCP registration and background services for IDA Pro:

bash skills/scripts/bootstrap-reverse.sh idapro --start-services --mcp-host=claude

Skip the post-installation tool index refresh for CI pipelines:

bash skills/scripts/bootstrap-reverse.sh pentestswarm --skip-refresh

Key implementation files include skills/scripts/bootstrap-reverse.sh (core engine), skills/scripts/bootstrap-reverse.ps1 (Windows parity), and skills/scripts/bootstrap-manifest.json (capability definitions).

Summary

• Twelve distinct methods handle everything from system packages (APT, Homebrew) to language-specific installs (Python/pipx, Node/npm, Go) and source retrieval (GitHub releases, Git commits)
• Docker fallback and manual markers ensure graceful degradation when automatic installation fails
• MCP registration integrates tools directly with Claude or Codex AI assistants via write_mcp_server()
• Cross-platform support spans Linux (Bash), macOS (Bash), and Windows (PowerShell) through unified manifest definitions

Frequently Asked Questions

What is the difference between bootstrap-reverse.sh and bootstrap-reverse.ps1?

bootstrap-reverse.sh is the primary Bash implementation for Linux and macOS environments, while bootstrap-reverse.ps1 provides PowerShell parity for Windows systems. Both scripts consume the same bootstrap-manifest.json definitions, ensuring consistent capability support across platforms.

How does reverse-skill handle tools not available in package managers?

The engine prefers GitHub release downloads via install_github_release() for precompiled binaries, or pinned Git checkouts via install_git_commit() for source builds. If these fail, it falls back to Docker containers or marks the tool as manual-required.

Can I use reverse-skill bootstrapping in CI/CD pipelines?

Yes. Pass the --skip-refresh flag to disable the tool index regeneration step, and use --mcp-host=none to skip AI assistant registration. The script returns appropriate exit codes and supports non-interactive execution.

Where are MCP server configurations stored after bootstrapping?

Configurations are written to ~/.claude/mcp.json for Claude Desktop or ~/.codex/config.toml for Codex CLI, depending on the --mcp-host parameter. The write_mcp_server() function automatically creates these directories if they do not exist.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}