Reverse Engineering MCP: APK, Smart Contract, WASM

What this is

Reverse Engineering MCP is a production MCP server that turns 18 reverse-engineering capabilities into tools an AI agent can call directly — no install, no Ghidra setup, no Java.

Every call runs the full REA toolchain in the cloud (Ghidra 12.1.4, evmole 0.9.3, apktool 2.11.1, WABT 1.0.42, TShark 4.2.2, Rizin) and returns a signed evidence record: an evidence_id, the provider that produced it, a SHA-256 digest of the artifact, and explicit limitations.

Price: $0.15 per tool call.

What it analyzes

Artifact	Tools	Engines
Binaries	decompile to pseudocode, Go/Rust module inspection, Mach-O, PE resources, .NET, signatures	Ghidra, Rizin, REA
Smart contracts	function selectors, proxy patterns, callable interface	evmole
Android	permissions, activities, services, receivers, Dart AOT	apktool, REA Dart
iOS	bundle id, URL schemes, permissions, plist	REA plist
Network	pcap endpoints, protocols, DNS, TLS SNI, HTTP URIs	TShark
WebAssembly	sections, exports, WAT reconstruction	WABT
Data	SQLite schema and rows, archive structure	REA
Apps & firmware	Electron IPC surface, firmware regions, crash reports	REA JS analyzer

Tools

Binary analysis and decompilation

Tool	Returns
binary_decompile	Readable pseudocode for one procedure
go_binary_inspect	Compiler version, module graph, build settings
rust_binary_inspect	cargo-auditable dependency list
macho_inspect	Load commands, segments, symbols
pe_resources_inspect	Resources, payload ranges, hashes
dotnet_inspect	Identity, target framework, declared members
signature_inspect	Signing identity, entitlements, seal status

Smart contracts and blockchain

Tool	Returns
evm_contract_scan	Selectors, proxy patterns, callable interface

Mobile

Tool	Returns
apk_audit	Permissions, activities, services, receivers
dart_aot_inspect	Flutter Dart AOT snapshot sections and string pool
plist_inspect	Bundle id, version, URL schemes, permissions

Network

Tool	Returns
pcap_analyze	Endpoints, protocol distribution, DNS, TLS SNI, HTTP URIs

Documents and data

Tool	Returns
wasm_inspect	Sections, exports, reconstructed WAT
sqlite_inspect	Schema, tables, rows
archive_inspect	Structure plus the next probes worth running

Applications and firmware

Tool	Returns
electron_audit	Modules, IPC channels, context-bridge APIs
firmware_regions_inspect	Firmware regions and signature candidates
crash_report_inspect	Faulting thread, exception type, stack frames

Quick start

Connect an MCP client

https://saleck--rea-reverse-engineering-mcp.apify.actor/sse

Add it as a remote SSE server in Claude Desktop, Cursor, OpenCode, or Cline.

Call a tool

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "evm_contract_scan",
    "arguments": { "bytecode": "6080604052600436101561001057600080fd5b50" }
  }
}

Run it locally

Requires Node.js 20+ and the REA agent on PATH.

npm install
npm start

Example output

{
  "evidence_id": "ev_539e262747811055fbe77064f796b0577a0ce46d74456d0262a3920fad190dd7",
  "subject": {
    "name": "evm_1792458621289.hex",
    "digest": { "sha256": "6a9e7e82ba185df8dd6902a14166f88735cb81766e90977bb21..." }
  },
  "provider": { "id": "evmole-interface", "name": "REA EVM interface adapter", "version": "evmole@0.9.3" },
  "operation": "inspect_evm_interface"
}

Output you get

• evidence_id — content-addressed; the same input always yields the same id
• provider — which engine produced the result and its version
• subject.digest — SHA-256 of the artifact, for independent verification
• normalized_result — the structured findings
• error — present only when analysis could not complete, with the reason

The analysis index

Every completed analysis is recorded in a public, content-addressed index. The code is a wrapper around the REA toolchain; the index is the part that cannot be copied — it only exists because real work was done.

Endpoint	Returns
GET /index?limit=50	Recent analyses with tool, subject, evidence_id, provider, SHA-256
GET /evidence/<id>	One analysis, looked up by its evidence_id
GET /stats	Totals by tool and the providers used
GET /health	Server health and call counters

Each record carries the evidence_id, the provider and version that produced it, the SHA-256 of the subject, the tool that ran, and how long it took.

Who uses this

• Security researchers auditing contracts, binaries and packages
• Malware analysts triaging mobile and firmware samples
• Incident responders working from packet captures and crash reports
• Smart contract auditors screening before manual review
• CTF players needing fast triage across formats
• AI agents that must analyse an artifact without local tooling

Security controls

Control	Behaviour
Path traversal	rejected
Shell metacharacters	rejected in paths
Bytecode input	hex only, even length, ≤ 512 KB
Timeouts	per-tool, 3–5 minutes
Concurrency	64 concurrent sessions
Session lifetime	30-minute TTL
Errors	structured { "error": "..." }
Health	GET /health

Licence

MIT. The underlying tools retain their own licences — Ghidra, WABT and apktool are Apache-2.0; TShark is GPL-2.0; REA and evmole are MIT.

Responsible use

Reverse engineering is dual-use. This server is intended for security research, malware analysis, incident response, and auditing artifacts you own or are authorised to examine.