bootstrap-manifest.json for reverse-skill: Complete Capabilities Reference

The bootstrap-manifest.json file in the reverse-skill repository defines 38 automated capabilities including reverse-engineering tools like JADX, Frida, and Ghidra, plus MCP services, each with standardized metadata for reproducible environment provisioning.

The bootstrap-manifest.json file located at skills/scripts/bootstrap-manifest.json serves as the central registry for the reverse-skill framework's automation ecosystem. This manifest enumerates every utility and service the framework can bootstrap automatically, from classic decompilers to modern Model Context Protocol (MCP) servers, ensuring consistent tooling across development environments.

Schema Structure of bootstrap-manifest.json

Each capability entry under the top-level "capabilities" array follows a standardized schema designed for automated provisioning.

Core Metadata Fields

• name: Human-readable identifier used by the routing logic
• bootstrapKind: Installation method (e.g., github-release-zip, pip-package, npm-mcp)
• Source identifiers: installDir, wingetId, repo, npmPackage, or pipPackage depending on bootstrap type
• canAutoInstall: Boolean flag indicating whether the framework can install automatically (false for commercial/manual-only tools)
• verifyCommand: Post-installation command to confirm functionality
• docsUrl: Official documentation or project homepage

Version Control and MCP Configuration

Advanced fields ensure reproducibility and service integration:

• pinPolicy, pinnedVersion, pinnedCommit, assetSha256: Version-pinning metadata for reproducible builds
• mcpNames, mcpUrl, mcpCommand, mcpArgs: MCP service configuration for tools exposing local HTTP APIs
• postInstallSteps, manualInstallHint: Optional user guidance for complex setups
• note: Contextual remarks regarding dependencies or external requirements

The 38 Capabilities in reverse-skill

The manifest prioritizes industry-standard reverse-engineering utilities and modern MCP services.

Reverse Engineering and Decompilation Tools

jadx uses github-release-zip to install the decompiler from skylot/jadx (version 1.5.6) into %USERPROFILE%\Tools\jadx. apktool employs github-release-jar-wrapper to download the JAR wrapper for iBotPeaches/Apktool (version 3.0.2). For binary analysis, r2 and rabin2 retrieve the latest Windows zip from radareorg/radare2, while ghidra-mcp installs Ghidra from the NSA's releases and adds the Ghidra-MCP plugin via github-release-zip.

Dynamic Analysis and Frida Ecosystem

Mobile and dynamic analysis capabilities include:

frida and frida-ps install via pip-package using frida-tools==14.10.4. The idalib-mcp capability installs the IDA Pro MCP plugin from a specific git commit using pip-package, while idapro registers as a local-http-mcp service depending on idalib-mcp.

MCP-Based Services and APIs

Modern Model Context Protocol services integrate external tools:

reqable-mcp deploys via npm-mcp using reqable-mcp-server@1.0.1. jshookmcp deploys via npm-mcp using @jshookmcp/jshook@0.3.4. xquik-mcp registers as a remote-http-mcp service requiring no local installation. anything-analyzer clones and runs the web service on port 23816 using local-http-mcp. burpsuite-mcp registers a local MCP endpoint that requires manual enablement within Burp Suite.

System Utilities and Package Managers

Platform-specific installation methods include:

adb installs Android platform-tools via the winget-package bootstrap kind. nmap similarly uses winget-package for network scanning capabilities. agent-browser installs agent-browser@0.31.1 globally via npm-global and pulls Playwright Chromium binaries.

Security Testing and Wordlists

Penetration testing resources include:

seclists clones the SecLists repository via git-clone for word-list resources. proxycat clones ProxyCat and installs Python dependencies. pentestswarm installs via go-install with Docker fallback, exposing an MCP server for AI-assisted penetration testing.

Commercial and Manual Tools

Not all tools support automated installation:

jeb-pro marks canAutoInstall as false using the manual bootstrap kind, requiring user installation of the commercial reverse-engineering suite. Similarly, tools like binwalk, yara, pwntools, and bkcrack use various methods (Winget, Pip, GitHub) depending on platform requirements.

Automating Environment Setup with bootstrap-manifest.json

The manifest drives the refresh-tool-index and verify-capability scripts for hands-free environment provisioning.

Refreshing the Tool Index

The skills/scripts/refresh-tool-index.ps1 (PowerShell) and skills/scripts/refresh-tool-index.sh (Bash) scripts parse bootstrap-manifest.json to install all capabilities marked with canAutoInstall: true. This single command provisions the entire reverse-engineering environment:

# PowerShell: Install all auto-installable capabilities

.\skills\scripts\refresh-tool-index.ps1

# Bash/Linux/macOS equivalent

bash skills/scripts/refresh-tool-index.sh

Verification Workflows

Post-installation validation uses skills/scripts/verify-capability.ps1 (or .sh), which executes the verifyCommand specified in the manifest for each capability:

# Verify JADX installation

.\skills\scripts\verify-capability.ps1 -Name jadx

# Verify Frida installation

bash skills/scripts/verify-capability.sh frida

Programmatic Access

Applications can parse the manifest directly to build user interfaces or validation pipelines:

import json
import pathlib

manifest_path = pathlib.Path("skills/scripts/bootstrap-manifest.json")
with open(manifest_path) as f:
    manifest = json.load(f)

cap_names = [c["name"] for c in manifest["capabilities"]]
print(f"Available capabilities: {cap_names}")

Integration with Skill Routing

The manifest integrates with skills/config/routing.json, which references these capabilities for skill dispatch. This separation allows the routing logic to reference abstract capability names (like jadx or frida) while the manifest handles the concrete installation details, enabling the framework to bootstrap a complete environment on fresh hosts with guaranteed reproducible versions.

Summary

• The bootstrap-manifest.json file at skills/scripts/bootstrap-manifest.json defines 38 distinct capabilities for the reverse-skill framework
• Each capability specifies bootstrapKind (github-release-zip, pip-package, npm-mcp, winget-package, git-clone, etc.) and canAutoInstall flags
• Tools include JADX, Apktool, Frida, Ghidra, IDA Pro, Radare2, plus MCP services like Reqable and JSHook
• Version pinning via pinnedVersion, pinnedCommit, and assetSha256 ensures reproducible environments
• refresh-tool-index scripts automate installation, while verify-capability scripts confirm functionality using manifest-defined verifyCommand values

Frequently Asked Questions

What is the bootstrap-manifest.json file in reverse-skill?

The bootstrap-manifest.json file serves as the central registry located at skills/scripts/bootstrap-manifest.json that enumerates all tools and services the reverse-skill framework can automatically provision. It defines 38 capabilities ranging from decompilers to MCP servers, specifying installation methods, version constraints, and verification commands for each tool.

How does reverse-skill install tools automatically?

The framework uses the refresh-tool-index.ps1 (Windows) or refresh-tool-index.sh (Linux/macOS) scripts to read the manifest and execute installations based on each capability's bootstrapKind field. Supported methods include downloading GitHub releases, installing via pip/npm, cloning git repositories, and using Windows Package Manager (Winget).

What types of bootstrapKind are supported in the manifest?

The manifest supports multiple installation strategies: github-release-zip and github-release-jar-wrapper for GitHub releases, pip-package for Python tools, npm-mcp and npm-global for Node.js packages, winget-package for Windows tools, git-clone for repositories, local-http-mcp and remote-http-mcp for services, go-install for Go tools, and manual for commercial software requiring user intervention.

Can commercial tools like JEB Pro be auto-installed?

No. Commercial tools such as jeb-pro set canAutoInstall to false and use the manual bootstrap kind, requiring users to install the software themselves. The manifest includes these entries for routing completeness but provides manualInstallHint and postInstallSteps to guide users through manual setup.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}