Tag : reverse-engineering

Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Open-source reverse engineering framework and CLI: disassemble, debug, emulate and patch binaries across many architectures and file formats, scriptable through r2pipe or built-in JavaScript.

Lets agents decompile, disassemble and query cross-references in IDA Pro, and rename variables, change types and add comments, including headless idalib mode. Requires IDA Pro 8.3+ (IDA Free is not supported); the author now recommends Hex-Rays' official IDA MCP instead.

Plugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.

250+ MCP tools for Ghidra: decompilation, cross-references, data-flow analysis, bulk renaming and commenting, P-code emulation and live debugging, with headless mode support. Requires Java 21 and Ghidra 12.1, and the plugin must be built and deployed first.

Skills for solving CTF challenges across web, pwn, crypto, reverse engineering, forensics, OSINT and malware analysis, plus a script that installs common CTF tools in one go. Follows the Agent Skills spec and installs with npx skills.

A JADX decompiler plugin plus companion MCP server that lets agents read an APK's classes, methods, Smali and resources to assist Android reverse engineering and vulnerability hunting. Requires JADX-GUI and uv.

A native x64dbg plugin that works as an MCP server, exposing dozens of debugging tools: agents can set breakpoints, step through code, read and write memory, analyze PE structure and locate the OEP of packed binaries. Windows only; install the plugin in x64dbg, then connect with a token.

Lets agents drive WinDbg's CDB/KD to analyze crash dumps, debug user-mode processes remotely and debug kernels, and triage many dumps in a batch. Windows only; requires WinDbg or Debugging Tools for Windows.

radare2's official MCP server, written in C on the native r2 API: agents open binaries to disassemble, decompile and analyze them, with read-only mode, sandboxing and connections to remote r2 sessions. Install radare2 first, then r2mcp via r2pm.