# What MCP Services Are Integrated with reverse-skill and What Are Their Purposes?

> Explore the 20+ MCP services integrated with reverse-skill. Discover how these tools expose AI agents to security and reverse-engineering capabilities for comprehensive analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: api-reference
- Published: 2026-08-31

---

**The reverse-skill repository integrates 20+ MCP (Model-Context-Protocol) services that expose security and reverse-engineering tools to AI agents, ranging from Android decompilers to browser automation and penetration testing suites.**

Reverse-engineering workflows increasingly rely on AI agents to automate repetitive tasks. The `reverse-skill` project, hosted at `zhaoxuya520/reverse-skill`, solves this by acting as a **skill-router** that abstracts dozens of specialized tools through a unified JSON-RPC interface. Each MCP service runs locally or in a container, registering endpoints that AI agents can discover and invoke programmatically.

## Complete List of MCP Services in reverse-skill

All services below are documented in **[`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md)** unless otherwise noted. Each entry reflects the canonical capability mapping used by the bootstrap system.

### Android Reverse Engineering

| MCP Service | Purpose |
|-------------|---------|
| **jadx** | Decompiles Android DEX/APK files to Java source code for static analysis. |
| **apktool** | Disassembles APK packages into readable resources and Smali bytecode for manual inspection. |
| **jeb-pro** | Provides interactive Java bytecode debugging through the JEB decompiler. |

### Dynamic Instrumentation and Runtime Analysis

| MCP Service | Purpose |
|-------------|---------|
| **frida** | Enables dynamic instrumentation of native and managed processes, supporting runtime hooking and memory read/write operations. |
| **frida-ps** | Lists running processes and performs basic inspection via Frida scripts. |
| **adb** | Controls Android devices remotely through the Android Debug Bridge, executing shell commands and managing app lifecycle. |

### Binary Analysis and Disassembly

| MCP Service | Purpose |
|-------------|---------|
| **idalib-mcp** (IDA MCP) | Exposes IDA Pro's full API over JSON-RPC, allowing AI agents to drive decompilation, cross-references, and graph navigation. Documented in **[`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md)**. |
| **idapro** | Launches the native IDA Pro GUI directly when interactive analysis is required (no JSON-RPC wrapper). |
| **ghidra-mcp** | Provides a free alternative to IDA Pro by exposing Ghidra's headless analysis engine to the MCP protocol. Documented in **[`skills/ghidra-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md)**. |
| **r2** | Integrates the Radare2 CLI/GUI engine for binary analysis, disassembly, and scripting. |
| **rabin2** | Offers Radare2's command-line utilities for rapid information extraction—strings, sections, imports, and exports. |
| **binwalk** | Extracts and analyzes firmware images and embedded files. |
| **yara** | Performs signature-based malware detection and classification. |

### Web and Browser Security

| MCP Service | Purpose |
|-------------|---------|
| **jshookmcp** | A comprehensive browser-side toolkit including: CDP debugging, network interception, JavaScript runtime hooking, AST deobfuscation, source-map reconstruction, Frida-style memory inspection, WASM reversing, and Android ADB bridging. Documented in **[`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md)**. |
| **agent-browser** | Drives headless Chromium to render pages, capture screenshots, and extract DOM data for automated reconnaissance. |
| **anything-analyzer** | Runs a lightweight HTTP server on port 23816 providing browser automation, HTTP capture/replay, and optional AI-driven traffic analysis. |

### Network and Penetration Testing

| MCP Service | Purpose |
|-------------|---------|
| **reqable-mcp** | Bridges the Reqable desktop client to MCP, enabling traffic capture, API debugging, and breakpoint control. Documented in **[`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md)**. |
| **burpsuite-mcp** | Full-control bridge to Burp Suite exposing approximately 78 tools including Proxy, Intruder, Repeater, Scanner, and Collaborator. Documented in **[`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md)**. |
| **nmap** | Network mapper for host discovery, port scanning, and service/version detection. |
| **pentestswarm** | Automates enumeration of common web application vulnerabilities including SQL injection and XSS via MCP-driven scripts. |
| **proxycat** | Simple HTTP/HTTPS proxy with request/response logging and replay capabilities. |

### Exploitation and Cryptography

| MCP Service | Purpose |
|-------------|---------|
| **pwntools** | Python library tailored for CTF-style exploitation, providing shellcraft generation, ROP chain construction, and remote process interaction. |
| **bkcrack** | Brute-force password recovery for encrypted ZIP archives. |
| **seclists** | Curated word-list collections for brute-force attacks and reconnaissance tasks. |

## How to Invoke MCP Services from AI Agents

The `reverse-skill` platform provides bootstrap scripts and JSON-RPC endpoints for service discovery and execution.

### Python: Service Discovery and Browser Automation

```python

# Ask the MCP router to select a network capture tool

tool = agent.select_tool(category="network_capture")

# Returns: "anything-analyzer"

# Launch headless Chrome via the anything-analyzer MCP

response = agent.call_mcp(
    service="anything-analyzer",
    method="browser.launch",
    params={"url": "https://example.com", "headless": True}
)
print(response["screenshot"])  # Base64-encoded PNG

```

### Bash: Starting and Calling jshookmcp

```bash

# Start the jshook MCP server if not running

bash skills/scripts/bootstrap-reverse.sh jshookmcp --mcp-host=claude

# Invoke network interception via JSON-RPC

curl -X POST http://localhost:23816/jsonrpc \
     -d '{"jsonrpc":"2.0","id":1,"method":"jshookmcp.network.intercept","params":{"url":"*"}}'

```

### PowerShell: Registering IDA Pro MCP

```powershell

# Register idalib-mcp for AI-driven decompilation

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability idalib-mcp -McpHostTarget Claude

```

## Key Source Files for MCP Integration

| File Path | Contents |
|-----------|----------|
| [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) | Master registry of all supported MCP capabilities. |
| [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) | Detailed documentation for `jshookmcp` and browser tooling. |
| [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) | Pentesting services including Burp Suite and Nmap integration. |
| [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) | IDA Pro MCP (`idalib-mcp`) configuration and API reference. |
| [`skills/ghidra-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md) | Ghidra MCP setup and usage patterns. |
| [`skills/pentest-tools/references/burpsuite-mcp-guide.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/burpsuite-mcp-guide.md) | Comprehensive guide to the 78-tool Burp Suite bridge. |
| [`skills/pentest-tools/references/kali-mcp-ecosystem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/kali-mcp-ecosystem.md) | Extended ecosystem documentation for Kali Linux deployments. |
| [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) | Machine-readable mapping of capability names to bootstrap methods (`npm-mcp`, `local-http-mcp`, `pip-package`, etc.). |
| [`docs/OVERVIEW.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/OVERVIEW.md) | Architectural overview of how MCP services integrate with the broader reverse-skill platform. |

## Summary

- **reverse-skill manages 22 MCP services** spanning Android reverse engineering, binary analysis, browser automation, and penetration testing.
- **Each service exposes JSON-RPC endpoints** that AI agents discover through the capability registry in [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md).
- **Bootstrap scripts** in `skills/scripts/` handle service initialization with host-specific configuration (Claude, OpenAI, etc.).
- **Documentation is distributed across skill-specific markdown files**, with [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md), [`skills/ghidra-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md), and [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) providing deep dives for complex integrations.
- **The `anything-analyzer` service on port 23816** serves as a lightweight HTTP entry point for browser automation and traffic analysis.

## Frequently Asked Questions

### What is the difference between idalib-mcp and idapro in reverse-skill?

**idalib-mcp** exposes IDA Pro's API over JSON-RPC for programmatic control by AI agents, enabling automated decompilation and cross-reference analysis. **idapro** simply launches the native IDA Pro GUI without any wrapping interface, intended for interactive sessions where human analysts need full control. The former is defined in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md); the latter appears in the master [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md).

### How does jshookmcp differ from agent-browser?

**jshookmcp** is a comprehensive browser security toolkit supporting CDP debugging, network interception, JavaScript hooking, AST deobfuscation, and WASM analysis. **agent-browser** is a simpler headless Chromium driver focused on page rendering and DOM extraction. For deep JavaScript reverse engineering, use `jshookmcp`; for basic automation and screenshots, `agent-browser` suffices.

### Can I use reverse-skill MCP services without IDA Pro?

Yes. **ghidra-mcp** provides a fully free alternative that exposes Ghidra's headless analysis engine through the same JSON-RPC interface. It is documented in [`skills/ghidra-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md) and supports the core decompilation and analysis workflows available in the IDA Pro integration.

### What is the purpose of the bootstrap-manifest.json file?

[`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) maps each capability name to its initialization method—whether through npm packages, local HTTP servers, pip installations, or container launches. This allows the `reverse-skill` router to start the correct MCP service infrastructure based on the agent's request and host environment.