Bootstrap Manifest for Reverse-Skill: Complete Guide to 70+ Security Tools

The bootstrap manifest for reverse-skill (kali/scripts/bootstrap-manifest.json) catalogs over 70 distinct capabilities across five logical sections, governing how tools from frida to ghidra-mcp install and register on Kali Linux hosts.

The reverse-skill platform uses this manifest as the single source of truth for provisioning security analysis environments. Located at kali/scripts/bootstrap-manifest.json, the file drives the automated bootstrap process executed by kali/scripts/bootstrap-reverse.sh, ensuring every analyst works with a consistent, reproducible toolchain for reverse engineering and penetration testing.

Anatomy of the Bootstrap Manifest

The manifest follows a structured JSON schema that separates tools by provenance and installation mechanism. This division allows the bootstrap script to apply the correct package manager—whether apt, pip, npm, or raw GitHub releases—for each component.

Kali Release Tools

Two arrays track tools introduced in specific Kali Linux releases:

• kaliNewTools2026_1: Contains packages like adaptixc2, a post‑exploitation framework added in the 2026.1 release (line 7)
• kaliNewTools2025_4: Includes utilities such as bpf-linker, a BPF static linker introduced in 2025.4 (line 17)

These entries install via standard apt commands during the bootstrap phase.

Native MCP Services

The kaliNativeMCP section lists Machine‑Control‑Protocol services bundled directly with Kali distributions. The primary entry is mcp-kali-server (line 22), which exposes Kali‑native functionality through the MCP interface without requiring external downloads.

Bootstrap Dependencies

Before installing security tools, the script validates bootstrapDependencies. This section pins host‑level requirements such as pipx==1.16.5 (line 28), ensuring isolated Python package management is available for subsequent pipx‑based tool installations.

Security Capabilities Inventory

The capabilities array constitutes the bulk of the manifest, defining individual security tools with metadata including installation method, verification commands, and documentation URLs.

Reverse Engineering and Binary Analysis

Static and dynamic analysis tools dominate this category:

• jadx (lines 38‑48): Installs via GitHub release tarball for Android decompilation
• apktool (lines 51‑64): Uses apt with fallback to GitHub jar downloads for APK reverse engineering
• frida (lines 66‑73): Installed via pip as a dynamic instrumentation toolkit
• idalib-mcp (lines 85‑93): A Python package pulled from a Git repository enabling IDA Pro MCP integration
• r2 / rabin2 (lines 208‑230): Radare2 components installed via apt with optional GitHub release fallback
• ghidra-mcp (lines 251‑274): Ghidra integration supporting both apt and GitHub release channels
• binwalk and yara (lines 332‑376): Firmware extraction and pattern matching utilities via apt

MCP Bridges and AI Integration

Several entries register Model Context Protocol servers for AI‑driven analysis:

• jshookmcp (lines 130‑147): An npm‑based MCP bridge for JavaScript instrumentation
• xquik-mcp (lines 151‑160): Remote‑HTTP MCP registration requiring no local binaries
• anything-analyzer (lines 164‑184): Local‑HTTP MCP service for general‑purpose analysis
• idapro (lines 186‑205): Local‑HTTP MCP depending on idalib-mcp for IDA Pro automation
• hexstrike-ai: AI‑driven MCP bridge for binary analysis (referenced in capabilities)

Network Pentesting and Exploitation

Standard offensive security tools with automated verification:

• nmap, sqlmap, hashcat, hydra, gobuster, ffuf, and msfconsole (lines 311‑371): Pre‑installed Kali essentials verified during bootstrap
• nuclei (lines 374‑386): Installed via go install with GitHub release fallback for vulnerability scanning
• pentestswarm (lines 505‑530): Go‑installed MCP server (or Docker alternative) for distributed testing
• coercer, pwntools, bkcrack: Additional apt‑based utilities for Active Directory and CTF workflows

Mobile and Web Testing

Specialized frameworks for device and application testing:

• adb (lines 232‑238): Android Debug Bridge via apt
• agent-browser (lines 241‑248): npm‑global tool requiring Playwright post‑installation (npx playwright install chromium)
• burpsuite-mcp (lines 296‑308): Manual installation entry for the Burp Suite MCP plugin
• proxycat (lines 286‑294): Git‑clone based proxy utility

How the Bootstrap Process Executes

The kali/scripts/bootstrap-reverse.sh script parses the manifest sequentially, handling dependencies, version pinning, and post‑install actions. For each capability, the script checks the specified installation method—whether apt, pip, pipx, npm, go install, git clone, or http registration—and executes the appropriate commands.

After installation, kali/scripts/refresh-tool-index.sh generates a cached index of installed tools, keeping the platform’s registry synchronized with the actual filesystem state.

Installation Methods Supported

The manifest supports seven distinct installation strategies:

1. apt: System packages from Kali repositories (e.g., nmap, apktool)
2. pip/pipx: Python packages in isolated environments (e.g., frida, idalib-mcp)
3. npm: Node.js global packages or npx executables (e.g., jshookmcp, agent-browser)
4. go install: Compiled Go binaries (e.g., nuclei, pentestswarm)
5. github-release: Direct tarball or binary downloads (e.g., jadx, ghidra-mcp)
6. git-clone: Source repositories (e.g., proxycat)
7. http: Remote MCP registration without local installation (e.g., xquik-mcp)

Key Files in the Bootstrap System

File	Role
kali/scripts/bootstrap-manifest.json	Master inventory defining all tools, versions, and metadata
kali/scripts/bootstrap-reverse.sh	Driver script that reads the manifest and executes installations
kali/scripts/refresh-tool-index.sh	Post‑bootstrap indexer that updates the tool registry
README-kali.md	Setup documentation for the Kali environment
AGENTS.md	Routing documentation for skill entry points dependent on manifest tools

Summary

• The bootstrap manifest at kali/scripts/bootstrap-manifest.json serves as the authoritative inventory for the reverse-skill platform, containing over 70 distinct capabilities.
• Tools are organized into five sections: Kali release packages, native MCP services, bootstrap dependencies, and the primary capabilities array.
• Installation methods span apt, pipx, npm, go install, GitHub releases, and git clones, allowing heterogeneous toolchains to provision consistently.
• The bootstrap-reverse.sh script automates the entire process, while refresh-tool-index.sh maintains the runtime registry.
• Key reverse‑engineering tools include jadx, apktool, frida, r2, and ghidra-mcp; AI‑driven MCP bridges include jshookmcp and hexstrike-ai.

Frequently Asked Questions

What is the bootstrap manifest in reverse-skill?

The bootstrap manifest is a JSON configuration file (kali/scripts/bootstrap-manifest.json) that declares every security tool, dependency, and MCP service the reverse-skill platform needs to install on a Kali Linux host. It functions as a declarative infrastructure spec, enabling the bootstrap-reverse.sh script to provision environments reproducibly across different systems.

How do I add a new tool to the reverse-skill bootstrap manifest?

Add a new entry to the appropriate section—typically the capabilities array—specifying the tool name, installation method (e.g., apt, pipx, github-release), version constraints, and verification command. For MCP services, include the server configuration block; for standard binaries, provide the package name or GitHub repository URL.

What is the difference between kaliNativeMCP and capabilities in the manifest?

The kaliNativeMCP section lists MCP services bundled directly with Kali Linux distributions (like mcp-kali-server), while the capabilities array includes individual security tools that may require download, compilation, or registration (like frida, nuclei, or ghidra-mcp). The bootstrap script treats native MCP entries as pre‑installed services versus capabilities that often need active provisioning.

Which installation methods does the bootstrap script support?

The bootstrap script supports seven methods: apt for system packages, pip/pipx for Python tools, npm for Node.js utilities, go install for compiled Go binaries, github-release for direct binary downloads, git-clone for source repositories, and http for remote MCP registration that requires no local files.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}