# Reverse Engineering MCP: APK, Smart Contract, WASM (`saleck/rea-reverse-engineering-mcp`) Actor

Reverse engineering MCP server: 18 tools — smart contract analysis (Solidity, EVM, blockchain), binary analysis & decompilation (Ghidra), static analysis, APK audit, WebAssembly (WASM) analysis, Electron security audit, pcap packet capture & network analysis, SQLite forensics, binary inspection.

- **URL**: https://apify.com/saleck/rea-reverse-engineering-mcp.md
- **Developed by:** [Saleck](https://apify.com/saleck) (community)
- **Categories:** MCP servers, Agents, Developer tools
- **Features:** Limited permissions, Single-tenant, Server interface
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $150.00 / 1,000 price for one rea tool calls

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

### What this is

**Reverse Engineering MCP** is a production MCP server that turns 18 reverse-engineering
capabilities into tools an AI agent can call directly — no install, no Ghidra setup, no Java.

Every call runs the full REA toolchain in the cloud (Ghidra 12.1.4, evmole 0.9.3, apktool 2.11.1,
WABT 1.0.42, TShark 4.2.2, Rizin) and returns a **signed evidence record**: an `evidence_id`, the
provider that produced it, a SHA-256 digest of the artifact, and explicit limitations.

**Price: $0.15 per tool call.**

### What it analyzes

| Artifact | Tools | Engines |
|---|---|---|
| **Binaries** | decompile to pseudocode, Go/Rust module inspection, Mach-O, PE resources, .NET, signatures | Ghidra, Rizin, REA |
| **Smart contracts** | function selectors, proxy patterns, callable interface | evmole |
| **Android** | permissions, activities, services, receivers, Dart AOT | apktool, REA Dart |
| **iOS** | bundle id, URL schemes, permissions, plist | REA plist |
| **Network** | pcap endpoints, protocols, DNS, TLS SNI, HTTP URIs | TShark |
| **WebAssembly** | sections, exports, WAT reconstruction | WABT |
| **Data** | SQLite schema and rows, archive structure | REA |
| **Apps & firmware** | Electron IPC surface, firmware regions, crash reports | REA JS analyzer |

### Tools

**Binary analysis and decompilation**

| Tool | Returns |
|---|---|
| `binary_decompile` | Readable pseudocode for one procedure |
| `go_binary_inspect` | Compiler version, module graph, build settings |
| `rust_binary_inspect` | cargo-auditable dependency list |
| `macho_inspect` | Load commands, segments, symbols |
| `pe_resources_inspect` | Resources, payload ranges, hashes |
| `dotnet_inspect` | Identity, target framework, declared members |
| `signature_inspect` | Signing identity, entitlements, seal status |

**Smart contracts and blockchain**

| Tool | Returns |
|---|---|
| `evm_contract_scan` | Selectors, proxy patterns, callable interface |

**Mobile**

| Tool | Returns |
|---|---|
| `apk_audit` | Permissions, activities, services, receivers |
| `dart_aot_inspect` | Flutter Dart AOT snapshot sections and string pool |
| `plist_inspect` | Bundle id, version, URL schemes, permissions |

**Network**

| Tool | Returns |
|---|---|
| `pcap_analyze` | Endpoints, protocol distribution, DNS, TLS SNI, HTTP URIs |

**Documents and data**

| Tool | Returns |
|---|---|
| `wasm_inspect` | Sections, exports, reconstructed WAT |
| `sqlite_inspect` | Schema, tables, rows |
| `archive_inspect` | Structure plus the next probes worth running |

**Applications and firmware**

| Tool | Returns |
|---|---|
| `electron_audit` | Modules, IPC channels, context-bridge APIs |
| `firmware_regions_inspect` | Firmware regions and signature candidates |
| `crash_report_inspect` | Faulting thread, exception type, stack frames |

### Quick start

#### Connect an MCP client

```
https://saleck--rea-reverse-engineering-mcp.apify.actor/sse
```

Add it as a remote SSE server in Claude Desktop, Cursor, OpenCode, or Cline.

#### Call a tool

```json
{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "evm_contract_scan",
    "arguments": { "bytecode": "6080604052600436101561001057600080fd5b50" }
  }
}
```

#### Run it locally

Requires Node.js 20+ and the [REA](https://github.com/morluto/rea) agent on `PATH`.

```bash
npm install
npm start
```

### Example output

```json
{
  "evidence_id": "ev_539e262747811055fbe77064f796b0577a0ce46d74456d0262a3920fad190dd7",
  "subject": {
    "name": "evm_1792458621289.hex",
    "digest": { "sha256": "6a9e7e82ba185df8dd6902a14166f88735cb81766e90977bb21..." }
  },
  "provider": { "id": "evmole-interface", "name": "REA EVM interface adapter", "version": "evmole@0.9.3" },
  "operation": "inspect_evm_interface"
}
```

### Output you get

- **`evidence_id`** — content-addressed; the same input always yields the same id
- **`provider`** — which engine produced the result and its version
- **`subject.digest`** — SHA-256 of the artifact, for independent verification
- **`normalized_result`** — the structured findings
- **`error`** — present only when analysis could not complete, with the reason

### The analysis index

Every completed analysis is recorded in a public, content-addressed index. The
code is a wrapper around the REA toolchain; the index is the part that cannot be
copied — it only exists because real work was done.

| Endpoint | Returns |
|---|---|
| `GET /index?limit=50` | Recent analyses with tool, subject, evidence_id, provider, SHA-256 |
| `GET /evidence/<id>` | One analysis, looked up by its `evidence_id` |
| `GET /stats` | Totals by tool and the providers used |
| `GET /health` | Server health and call counters |

Each record carries the `evidence_id`, the provider and version that produced it,
the SHA-256 of the subject, the tool that ran, and how long it took.

### Who uses this

- **Security researchers** auditing contracts, binaries and packages
- **Malware analysts** triaging mobile and firmware samples
- **Incident responders** working from packet captures and crash reports
- **Smart contract auditors** screening before manual review
- **CTF players** needing fast triage across formats
- **AI agents** that must analyse an artifact without local tooling

### Security controls

| Control | Behaviour |
|---|---|
| Path traversal | rejected |
| Shell metacharacters | rejected in paths |
| Bytecode input | hex only, even length, ≤ 512 KB |
| Timeouts | per-tool, 3–5 minutes |
| Concurrency | 64 concurrent sessions |
| Session lifetime | 30-minute TTL |
| Errors | structured `{ "error": "..." }` |
| Health | `GET /health` |

### Licence

MIT. The underlying tools retain their own licences — Ghidra, WABT and apktool are Apache-2.0;
TShark is GPL-2.0; REA and evmole are MIT.

### Responsible use

Reverse engineering is dual-use. This server is intended for security research, malware analysis,
incident response, and auditing artifacts you own or are authorised to examine.

# Actor input Schema

## Actor input object example

```json
{}
```

# Actor output Schema

## `evidence_id` (type: `string`):

Content-addressed identifier for this result. Deterministic: the same input always produces the same evidence_id.

## `provider` (type: `string`):

The analysis engine that produced this result (e.g. evmole-interface, Ghidra, apktool, TShark).

## `operation` (type: `string`):

The REA operation performed, e.g. inspect_evm_interface.

## `subject` (type: `string`):

The artifact that was analysed, with its SHA-256 digest for independent verification.

## `normalized_result` (type: `string`):

The structured findings: functions, permissions, endpoints, exports, decompiled procedures, etc.

## `error` (type: `string`):

Present only when the analysis could not be completed. Explains what failed and why.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("saleck/rea-reverse-engineering-mcp").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("saleck/rea-reverse-engineering-mcp").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call saleck/rea-reverse-engineering-mcp --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,saleck/rea-reverse-engineering-mcp"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/O5roFp4zrdmITt3Nd/builds/1QtysvGt4Vf6w8dNk/openapi.json