Summary

Wide surface, honest about what it cannot reach.

The breadth only pays off if the backends are there, which is why the availability report matters more than the tool count — it tells you before you start which half of this is live on your machine.

What it is

A Python MCP server that wires a broad set of reverse-engineering backends to an MCP client. It runs stdio only, and degrades gracefully: a tool whose backend is missing returns a clear error rather than taking the server down.

What you get

Static analysis (8 tools): PE, ELF and Mach-O parsing through LIEF, disassembly across x86, x64, ARM, MIPS and RISC-V with Capstone always available, FLOSS string extraction with 17 classifier patterns, Shannon entropy and packing detection, YARA, capa with ATT&CK mapping, and decompilation via Ghidra headless, RetDec or Binary Ninja
Dynamic analysis (29 tools): GDB over the MI protocol, LLDB through the native SB API, Frida spawn and attach with interception and memory scan, and coverage through DynamoRIO drcov or Frida Stalker
Android RE (24 tools): APK manifest and DEX parsing, jadx and apktool, smali disassembly and patching, an ADB bridge with 12 actions, Frida for SSL pinning and root bypass, traffic interception with SSL key extraction, repack and sign, and MobSF, Quark-Engine and Semgrep scanning
Exploit development (11 tools): ROP chain building across x86, x64, ARM and ARM64 with bad-character avoidance and pwntools output, heap templates including House of Force and Tcache Poisoning, a libc database with one-gadget, shellcode and format-string helpers
Unpacking (4 tools), deobfuscation (3), firmware (3), protocol work (3), malware triage (4), symbolic execution with angr and Triton (4), and format specialisations (4) for APK/DEX, .NET IL, Java class and WebAssembly
Rate limiting built in — `REVULA_GLOBAL_RPM`, `REVULA_PER_TOOL_RPM` and `REVULA_BURST_SIZE` — with subprocess timeout, memory cap and retries alongside

Requirements

Python 3.11 or later, Linux recommended with macOS and WSL2 supported, plus a Docker image that ships the external tools preinstalled. Transport is stdio only — there is no HTTP or SSE mode. A core install already covers parsing, disassembly, YARA, ROP building, heap and libc helpers and deobfuscation; decompilation, debuggers, Android work, symbolic execution, firmware extraction and network analysis each need their own backend on the machine. Run `python scripts/test/validate_install.py` to see what was detected.