How to Bootstrap Missing Tools in reverse-skill on Windows, macOS, and Linux

Use bash skills/scripts/bootstrap-reverse.sh on Linux/macOS or powershell -ExecutionPolicy Bypass -File skills/scripts/bootstrap-reverse.ps1 on Windows to automatically detect and install missing reverse-engineering tools defined in the bootstrap manifest.

The reverse-skill repository automates tool provisioning across operating systems through platform-specific bootstrap scripts. These scripts parse bootstrap-manifest.json to resolve capabilities, install missing dependencies, and configure MCP servers without manual intervention. Whether you are using APT, Homebrew, winget, or direct GitHub releases, the bootstrapper selects the appropriate supply chain for your platform.

Bootstrap Commands for Linux and macOS

On Unix-like systems, the entry point is skills/scripts/bootstrap-reverse.sh. This Bash script detects the operating system via uname -s and dispatches to helper functions such as install_apt for Debian-based distributions or install_brew for macOS.

Invoke the bootstrapper with a space-separated list of capabilities:

bash skills/scripts/bootstrap-reverse.sh jadx apktool frida --start-services

Key helper functions inside the script include:

• install_github_release – Downloads and extracts ZIP assets from GitHub releases
• install_git_commit – Clones repositories and checks out specific commits
• ensure_python_runtime and ensure_node_runtime – Install Python and Node.js runtimes via pipx, npm, or pnpm
• install_apt and install_brew – Wrap system package managers

By default, tools install under $HOME/tools, keeping the system package manager clean.

Bootstrap Commands for Windows

Windows hosts use the PowerShell implementation located at skills/scripts/bootstrap-reverse.ps1. The script requires an execution policy bypass to run unsigned local scripts and loads helper libraries from skills/scripts/lib/.

The standard invocation pattern is:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/bootstrap-reverse.ps1 -Capability "idapro,burpsuite-mcp" -McpHostTarget Both

Core functions defined in lib/ToolDiscovery.ps1 and lib/BootstrapSupplyChain.ps1 include:

• Ensure-WingetPackage – Installs software via winget (e.g., winget install OpenJS.NodeJS.22)
• Ensure-GitHubZipInstall – Handles github-release-zip bootstrap kinds
• Ensure-PythonRuntime, Ensure-JavaRuntime, and Ensure-NodeRuntime – Verify or install language runtimes
• Expand-CapabilityDependencies – Recursively resolves implicit dependencies (e.g., frida-ps requires frida)

Kali Linux Specialization

For Kali Linux environments, the repository provides kali/scripts/bootstrap-reverse.sh. This script reuses the generic Bash implementation but loads kali/scripts/bootstrap-manifest.json, which may override package IDs or versions specific to the Kali distribution.

bash kali/scripts/bootstrap-reverse.sh android-tools --start-services

How the Bootstrap Process Works

Both the Bash and PowerShell implementations follow an identical eight-stage workflow defined in the source code:

1. Parse arguments – Accept capability names, --start-services (or -StartServices), --skip-refresh (or -SkipRefresh), and MCP host selection flags.
2. Detect platform – Bash uses uname -s; PowerShell inspects $env:OS.
3. Load the manifest – Read bootstrap-manifest.json to map capability names to bootstrapKind, source URLs, and verification commands.
4. Expand dependencies – Call expand_capabilities (Bash) or Expand-CapabilityDependencies (PowerShell) to add transitive requirements.
5. Ensure runtimes – Install Python, Node.js, Java, Go, Git, or Docker if the capability requires them.
6. Install the capability – Dispatch to the appropriate installer based on the bootstrapKind:
   • github-release-zip → install_github_release / Ensure-GitHubZipInstall
   • git-clone → install_git_commit / Ensure-GitCloneInstall
   • pip-package → pipx install / pip install
   • npm-global → npm install -g
   • winget-package → winget install ...
   • go-install → go install ... or Docker fallback
   • local-http-mcp, remote-http-mcp, npm-mcp → Registers MCP servers without binary downloads
7. Optional service start – When --start-services is provided, the script launches background processes (e.g., anything-analyzer, idapro) and blocks until the TCP port is reachable.
8. Refresh the tool index – Execute refresh-tool-index.sh (or the PowerShell equivalent) to regenerate tool-index.json with newly installed paths.

Practical Usage Examples

Install jadx and apktool on macOS or Linux:

bash skills/scripts/bootstrap-reverse.sh jadx apktool

Install Frida with Python runtime and start associated services:

bash skills/scripts/bootstrap-reverse.sh frida --start-services

Register the XQuik MCP server on macOS without downloading a binary:

bash skills/scripts/bootstrap-reverse.sh xquik-mcp --mcp-host=both

Install BurpSuite MCP bridge on Windows for Claude Desktop:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/bootstrap-reverse.ps1 -Capability burpsuite-mcp -McpHostTarget Claude

Install all capabilities defined in the manifest on Windows:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/bootstrap-reverse.ps1 -Capability *

Summary

• Linux and macOS use skills/scripts/bootstrap-reverse.sh with Bash helper functions like install_apt, install_brew, and install_github_release.
• Windows uses skills/scripts/bootstrap-reverse.ps1 with PowerShell functions such as Ensure-WingetPackage and Ensure-GitHubZipInstall.
• Kali Linux uses kali/scripts/bootstrap-reverse.sh with a specialized manifest at kali/scripts/bootstrap-manifest.json.
• The bootstrap workflow parses arguments, detects the platform, loads bootstrap-manifest.json, expands dependencies, ensures language runtimes, installs the capability, optionally starts services, and refreshes the tool index.
• Bootstrap kinds include github-release-zip, git-clone, pip-package, npm-global, winget-package, go-install, and MCP registration types.

Frequently Asked Questions

Can I run the bootstrap scripts on any Linux distribution?

Yes. The Bash script in skills/scripts/bootstrap-reverse.sh detects the distribution using uname -s and selects the appropriate package manager. It supports APT for Debian-based systems and Homebrew for macOS. Other distributions may require adding custom helper functions to the script.

How does reverse-skill handle tool dependencies automatically?

The scripts call expand_capabilities (Bash) or Expand-CapabilityDependencies (PowerShell) to recursively resolve implicit requirements. For example, declaring frida-ps automatically triggers the installation of the frida base package because the manifest defines this relationship.

What is the purpose of the MCP host flags in the bootstrap commands?

The --mcp-host (Bash) and -McpHostTarget (PowerShell) arguments specify which Model-Client-Protocol host should receive the server registration—Claude, Cline, or Both. This allows the bootstrapper to configure MCP servers like burpsuite-mcp or xquik-mcp in the correct IDE configuration files without manual editing.

Where are installed tools stored by default?

Tools install under $HOME/tools on Linux and macOS, and into user-scoped directories on Windows (managed by winget or the script's download logic). This isolation prevents conflicts with system package managers while keeping the tools available in the user PATH after the script runs refresh-tool-index.sh.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}