re_pe_elfLABSCO SUMMARY
Wide surface, honest about what it cannot reach.
The breadth only pays off if the backends are there, which is why the availability report matters more than the tool count — it tells you before you start which half of this is live on your machine.
What it is
A Python MCP server that wires a broad set of reverse-engineering backends to an MCP client. It runs stdio only, and degrades gracefully: a tool whose backend is missing returns a clear error rather than taking the server down.
What you get
- Static analysis: PE, ELF and Mach-O parsing through LIEF, disassembly across x86, x64, ARM, MIPS and RISC-V with Capstone always available, FLOSS string extraction with 17 classifier patterns, Shannon entropy and packing detection, YARA, capa with ATT&CK mapping, and decompilation via Ghidra headless, RetDec or Binary Ninja
- Dynamic analysis: GDB over the MI protocol, LLDB through the native SB API, Frida spawn and attach with interception and memory scan, and coverage through DynamoRIO drcov or Frida Stalker
- Android RE: APK manifest and DEX parsing, jadx and apktool, smali disassembly and patching, an ADB bridge with 12 actions, Frida for SSL pinning and root bypass, traffic interception with SSL key extraction, repack and sign, and MobSF, Quark-Engine and Semgrep scanning
- Exploit development: ROP chain building across x86, x64, ARM and ARM64 with bad-character avoidance and pwntools output, heap templates including House of Force and Tcache Poisoning, a libc database with one-gadget, shellcode and format-string helpers
- Unpacking, deobfuscation, firmware, protocol work, malware triage, symbolic execution with angr and Triton, and format specialisations for APK/DEX, .NET IL, Java class and WebAssembly
- Rate limiting built in —
REVULA_GLOBAL_RPM,REVULA_PER_TOOL_RPMandREVULA_BURST_SIZE— with subprocess timeout, memory cap and retries alongside
Requirements
Python 3.11 or later, Linux recommended with macOS and WSL2 supported, plus a Docker image that ships the external tools preinstalled. Transport is stdio only — there is no HTTP or SSE mode. A core install already covers parsing, disassembly, YARA, ROP building, heap and libc helpers and deobfuscation; decompilation, debuggers, Android work, symbolic execution, firmware extraction and network analysis each need their own backend on the machine. Run python scripts/test/validate_install.py to see what was detected.
Setup effort
Build from source — git clone https://github.com/president-xd/revula.git
USE CASES
01
First look at an unknown binary
Parse the headers, extract and classify the strings, check entropy for packing, and score the imports for risk.
02
Reading a function you cannot follow in assembly
Send it through Ghidra headless, RetDec or Binary Ninja, with the result cached so a second look is free.
03
Watching a program run instead of guessing
Drive GDB or LLDB with breakpoints, stepping, registers and heap inspection, or attach Frida and intercept the calls.
04
Getting inside an Android app
Parse the APK and its permissions, decompile with jadx, patch smali, then rebuild and sign it.
05
Building an exploit chain
Find gadgets, classify them, generate the chain around bad characters, and get a pwntools script out the other end.
06
Pulling a firmware image apart
Extract with binwalk, recover the base address from string references, then scan for hardcoded credentials and weak crypto.
22 tools
Listed in project docs. Your client may show a different list.
re_stringsre_entropyre_yara_scanre_capa_scanre_gdbre_disasmre_apk_parsere_dex_analyzere_android_decompilere_android_scannerre_antianalysis_detectre_malware_triagere_malware_configre_malware_yara_genre_malware_sandboxre_rop_gadgetsre_rop_chainre_libc_offsetsre_aslr_defeatre_heap_chunkre_heap_techniqueBEFORE YOU INSTALL
What to know first
Tools you get
22 tools named in the project's documentation.
Requires
- revula on PATH
- Python 3.11 or later
INSTALLATION
Connect your client
Server setup
TERMINAL
# Clone
git clone https://github.com/president-xd/revula.git
cd revula
# Option 1: Automated install (recommended)
bash scripts/install/install_all.sh
# Option 2: Manual install
pip install -e .
# Option 3: Install with all optional dependencies
pip install -e ".[full]"
# Verify installation
python scripts/test/validate_install.pyMCP Clients
Claude Desktop, Claude Code, Cursor, Windsurf
JSON
{
"mcpServers": {
"revula": {
"command": "revula",
"args": []
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"revula": {
"command": "revula",
"args": [],
"env": {}
}
}
}Continue
CONTINUE · JSON
{
"mcpServers": [
{
"name": "revula",
"command": "revula",
"args": []
}
]
}Zed
ZED · JSON
{
"context_servers": {
"revula": {
"command": "revula",
"args": []
}
}
}
