# Where to Find the MCP Service Registry and Ports in reverse-skill

> Discover MCP service registry and ports within the reverse-skill repository. Locate these details in bootstrap-manifest.json files under skills and kali scripts for mapping capability identifiers to ports, URLs, and logical names.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-27

---

**The MCP service registry and their ports are defined in the [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) files located under `skills/scripts/` and `kali/scripts/`, which map capability identifiers to their listening ports, URLs, and logical names.**

The reverse-skill repository implements a Micro-Capability Platform (MCP) architecture that requires precise port configuration for both local and remote services. Understanding where this registry lives and how to parse it is essential for troubleshooting connectivity issues or extending the platform with new capabilities according to the source code.

## Locating the MCP Service Registry Files

The authoritative list of all MCP services resides in JSON manifest files that act as the central service registry for the platform.

### Main Platform Manifest

The primary registry is stored at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json). This file contains the complete catalog of capabilities available in the standard reverse-skill distribution, including their network endpoints and port assignments.

### Kali-Specific Manifest

For Kali Linux environments, a separate registry exists at [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json). This variant maintains the same schema but may include security-focused tools specific to the Kali distribution.

## Understanding the Registry Structure

Each entry in the manifest follows a consistent schema that defines how clients connect to the service:

- **mcpNames**: Logical identifiers used by client configurations to reference the service
- **mcpUrl**: The base HTTP endpoint (e.g., `http://localhost:23816/mcp`)
- **servicePort** or **servicePortRange**: The TCP port on which the MCP server listens

### Example Registry Entries

The manifest defines ports for various capabilities:

- **anything-analyzer**: Listens on port **23816** with URLs accessible at `http://localhost:23816/mcp`
- **idapro**: Uses port **13337** with an available range up to 13350 for multi-instance scenarios
- **xquik-mcp**: Remote service accessed via OAuth without a local port assignment

## Burp MCP Implementation Details

The built-in Burp Suite MCP implementation uses a Java HTTP server class to expose the tool list. In [`burp-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java), the constructor accepts a port parameter that originates from the manifest:

```java
public McpHttpServer(MontoyaApi api, int port) {
    super("127.0.0.1", port);   // Port derived from manifest entry
    this.api = api;
    this.authToken = resolveAuthToken();
}

```

By default, the Burp MCP server initializes on port **9876**, though this value is configurable through the registry.

## Querying MCP Services and Ports

You can verify active services by querying their HTTP endpoints directly using the ports defined in the manifest.

### Listing Burp MCP Tools

To retrieve the tool list from the default Burp MCP endpoint:

```bash
curl -s -H "Authorization: Bearer $(cat ~/.burp-mcp-token)" \
     http://127.0.0.1:9876/tools | jq .

```

### Direct Capability Queries

For local HTTP services like the Anything Analyzer on port 23816:

```bash
curl -s http://localhost:23816/mcp/tools | jq .

```

### Programmatic Port Lookup

Extract port assignments dynamically from the registry using Python:

```python
import json
import pathlib

manifest = pathlib.Path('skills/scripts/bootstrap-manifest.json')
data = json.loads(manifest.read_text())

def get_port(name):
    for cap in data['capabilities']:
        if cap['name'] == name:
            return cap.get('servicePort')
    return None

print('Anything Analyzer port:', get_port('anything-analyzer'))  # 23816

print('IDA Pro port:', get_port('idapro'))                    # 13337

```

## Bootstrap and Service Discovery Mechanisms

The [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) and `bootstrap-reverse.ps1` scripts automate the initialization process by reading [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json), extracting the `servicePort` values, and launching the corresponding MCP processes on those ports.

Additionally, `skills/scripts/lib/ToolDiscovery.ps1` contains PowerShell helpers that validate TCP connectivity to these ports and perform HTTP-level MCP handshakes, ensuring services specified in the registry are actually reachable before client configuration proceeds.

## Summary

- The **MCP service registry** is stored in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) files under both `skills/scripts/` and `kali/scripts/`
- Each registry entry specifies **mcpNames**, **mcpUrl**, and **servicePort** (or **servicePortRange**)
- The **Burp MCP server** defaults to port **9876** as defined in [`McpHttpServer.java`](https://github.com/zhaoxuya520/reverse-skill/blob/main/McpHttpServer.java)
- Bootstrap scripts automatically read the registry to launch services on their designated ports
- Use the provided **curl** or **Python** examples to query services and verify port assignments programmatically

## Frequently Asked Questions

### Where is the MCP service registry stored in reverse-skill?

The registry is located in [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) for the main platform and [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) for Kali-specific tools. These JSON files contain the complete mapping of capability names to their listening ports and endpoint URLs.

### What port does the Burp MCP server use by default?

The Burp MCP server uses port **9876** by default. This value is passed to the `McpHttpServer` class constructor in [`burp-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java`](https://github.com/zhaoxuya520/reverse-skill/blob/main/burp-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java), though it can be configured via the manifest entry if needed.

### How do I find the port for a specific MCP capability?

Open [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) and locate the capability entry by its `name` field. The `servicePort` field contains the TCP port number. For services supporting multiple instances, check the `servicePortRange` field instead, which lists the available port range.

### What is the difference between the main and Kali manifests?

Both files use identical schemas to define the MCP service registry, but [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) typically includes penetration testing tools specific to the Kali Linux distribution, while [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) contains the general reverse-skill capability set used across platforms.