# bootstrap-manifest.json for reverse-skill: Complete Capabilities Reference

> Explore the bootstrap-manifest.json in reverse-skill to discover 38 automated capabilities. Learn about reverse-engineering tools like JADX, Frida, and Ghidra for reproducible environments.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: api-reference
- Published: 2026-08-27

---

**The [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) file in the reverse-skill repository defines 38 automated capabilities including reverse-engineering tools like JADX, Frida, and Ghidra, plus MCP services, each with standardized metadata for reproducible environment provisioning.**

The [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) file located at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) serves as the central registry for the reverse-skill framework's automation ecosystem. This manifest enumerates every utility and service the framework can bootstrap automatically, from classic decompilers to modern Model Context Protocol (MCP) servers, ensuring consistent tooling across development environments.

## Schema Structure of bootstrap-manifest.json

Each capability entry under the top-level `"capabilities"` array follows a standardized schema designed for automated provisioning.

### Core Metadata Fields

- **name**: Human-readable identifier used by the routing logic
- **bootstrapKind**: Installation method (e.g., `github-release-zip`, `pip-package`, `npm-mcp`)
- **Source identifiers**: `installDir`, `wingetId`, `repo`, `npmPackage`, or `pipPackage` depending on bootstrap type
- **canAutoInstall**: Boolean flag indicating whether the framework can install automatically (`false` for commercial/manual-only tools)
- **verifyCommand**: Post-installation command to confirm functionality
- **docsUrl**: Official documentation or project homepage

### Version Control and MCP Configuration

Advanced fields ensure reproducibility and service integration:

- **pinPolicy**, **pinnedVersion**, **pinnedCommit**, **assetSha256**: Version-pinning metadata for reproducible builds
- **mcpNames**, **mcpUrl**, **mcpCommand**, **mcpArgs**: MCP service configuration for tools exposing local HTTP APIs
- **postInstallSteps**, **manualInstallHint**: Optional user guidance for complex setups
- **note**: Contextual remarks regarding dependencies or external requirements

## The 38 Capabilities in reverse-skill

The manifest prioritizes industry-standard reverse-engineering utilities and modern MCP services.

### Reverse Engineering and Decompilation Tools

**jadx** uses `github-release-zip` to install the decompiler from `skylot/jadx` (version 1.5.6) into `%USERPROFILE%\Tools\jadx`. **apktool** employs `github-release-jar-wrapper` to download the JAR wrapper for `iBotPeaches/Apktool` (version 3.0.2). For binary analysis, **r2** and **rabin2** retrieve the latest Windows zip from `radareorg/radare2`, while **ghidra-mcp** installs Ghidra from the NSA's releases and adds the Ghidra-MCP plugin via `github-release-zip`.

### Dynamic Analysis and Frida Ecosystem

Mobile and dynamic analysis capabilities include:

**frida** and **frida-ps** install via `pip-package` using `frida-tools==14.10.4`. The **idalib-mcp** capability installs the IDA Pro MCP plugin from a specific git commit using `pip-package`, while **idapro** registers as a `local-http-mcp` service depending on `idalib-mcp`.

### MCP-Based Services and APIs

Modern Model Context Protocol services integrate external tools:

**reqable-mcp** deploys via `npm-mcp` using `reqable-mcp-server@1.0.1`. **jshookmcp** deploys via `npm-mcp` using `@jshookmcp/jshook@0.3.4`. **xquik-mcp** registers as a `remote-http-mcp` service requiring no local installation. **anything-analyzer** clones and runs the web service on port 23816 using `local-http-mcp`. **burpsuite-mcp** registers a local MCP endpoint that requires manual enablement within Burp Suite.

### System Utilities and Package Managers

Platform-specific installation methods include:

**adb** installs Android platform-tools via the `winget-package` bootstrap kind. **nmap** similarly uses `winget-package` for network scanning capabilities. **agent-browser** installs `agent-browser@0.31.1` globally via `npm-global` and pulls Playwright Chromium binaries.

### Security Testing and Wordlists

Penetration testing resources include:

**seclists** clones the SecLists repository via `git-clone` for word-list resources. **proxycat** clones ProxyCat and installs Python dependencies. **pentestswarm** installs via `go-install` with Docker fallback, exposing an MCP server for AI-assisted penetration testing.

### Commercial and Manual Tools

Not all tools support automated installation:

**jeb-pro** marks `canAutoInstall` as `false` using the `manual` bootstrap kind, requiring user installation of the commercial reverse-engineering suite. Similarly, tools like **binwalk**, **yara**, **pwntools**, and **bkcrack** use various methods (Winget, Pip, GitHub) depending on platform requirements.

## Automating Environment Setup with bootstrap-manifest.json

The manifest drives the `refresh-tool-index` and `verify-capability` scripts for hands-free environment provisioning.

### Refreshing the Tool Index

The `skills/scripts/refresh-tool-index.ps1` (PowerShell) and [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) (Bash) scripts parse [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) to install all capabilities marked with `canAutoInstall: true`. This single command provisions the entire reverse-engineering environment:

```powershell

# PowerShell: Install all auto-installable capabilities

.\skills\scripts\refresh-tool-index.ps1

```

```bash

# Bash/Linux/macOS equivalent

bash skills/scripts/refresh-tool-index.sh

```

### Verification Workflows

Post-installation validation uses `skills/scripts/verify-capability.ps1` (or `.sh`), which executes the `verifyCommand` specified in the manifest for each capability:

```powershell

# Verify JADX installation

.\skills\scripts\verify-capability.ps1 -Name jadx

```

```bash

# Verify Frida installation

bash skills/scripts/verify-capability.sh frida

```

### Programmatic Access

Applications can parse the manifest directly to build user interfaces or validation pipelines:

```python
import json
import pathlib

manifest_path = pathlib.Path("skills/scripts/bootstrap-manifest.json")
with open(manifest_path) as f:
    manifest = json.load(f)

cap_names = [c["name"] for c in manifest["capabilities"]]
print(f"Available capabilities: {cap_names}")

```

## Integration with Skill Routing

The manifest integrates with [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), which references these capabilities for skill dispatch. This separation allows the routing logic to reference abstract capability names (like `jadx` or `frida`) while the manifest handles the concrete installation details, enabling the framework to bootstrap a complete environment on fresh hosts with guaranteed reproducible versions.

## Summary

- The [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) file at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) defines **38 distinct capabilities** for the reverse-skill framework
- Each capability specifies **bootstrapKind** (github-release-zip, pip-package, npm-mcp, winget-package, git-clone, etc.) and **canAutoInstall** flags
- Tools include **JADX**, **Apktool**, **Frida**, **Ghidra**, **IDA Pro**, **Radare2**, plus **MCP services** like Reqable and JSHook
- **Version pinning** via `pinnedVersion`, `pinnedCommit`, and `assetSha256` ensures reproducible environments
- **refresh-tool-index** scripts automate installation, while **verify-capability** scripts confirm functionality using manifest-defined `verifyCommand` values

## Frequently Asked Questions

### What is the bootstrap-manifest.json file in reverse-skill?

The [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) file serves as the central registry located at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) that enumerates all tools and services the reverse-skill framework can automatically provision. It defines 38 capabilities ranging from decompilers to MCP servers, specifying installation methods, version constraints, and verification commands for each tool.

### How does reverse-skill install tools automatically?

The framework uses the `refresh-tool-index.ps1` (Windows) or [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) (Linux/macOS) scripts to read the manifest and execute installations based on each capability's `bootstrapKind` field. Supported methods include downloading GitHub releases, installing via pip/npm, cloning git repositories, and using Windows Package Manager (Winget).

### What types of bootstrapKind are supported in the manifest?

The manifest supports multiple installation strategies: `github-release-zip` and `github-release-jar-wrapper` for GitHub releases, `pip-package` for Python tools, `npm-mcp` and `npm-global` for Node.js packages, `winget-package` for Windows tools, `git-clone` for repositories, `local-http-mcp` and `remote-http-mcp` for services, `go-install` for Go tools, and `manual` for commercial software requiring user intervention.

### Can commercial tools like JEB Pro be auto-installed?

No. Commercial tools such as **jeb-pro** set `canAutoInstall` to `false` and use the `manual` bootstrap kind, requiring users to install the software themselves. The manifest includes these entries for routing completeness but provides `manualInstallHint` and `postInstallSteps` to guide users through manual setup.