Connect Claude Desktop, MCP-compatible IDEs, or custom tooling to a broad reverse engineering backend through the [Model Context
Connect Claude Desktop, MCP-compatible IDEs, or custom tooling to a broad reverse engineering backend through the Model Context Protocol. Exposed over MCP by the revula mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.
Everything the assistant can do here goes through one of these:
Disassembly — ** Multi-backend support including Capstone (always available), radare2, and objdump for x86/x64/ARM/MIPS/RISC-VDecompilation — ** Ghidra (headless), RetDec, Binary Ninja with cachingQEMU — ** User-mode emulation (4 actions) and full system emulation (5 actions)Shellcode — ** Generation, encoding, bad-char analysis, extraction, and emulation testingDetection — ** Scan for anti-debug, anti-VM, anti-tamper, and packing indicatorsTriage — ** Multi-hash, IoC extraction, suspicious import scoring, and risk assessmentExtraction — ** binwalk scan/extract, entropy analysis, and filesystem identificationWebAssembly — ** WASM section parsing, import/export extraction, and disassemblyCrypto — ** Hashing (MD5/SHA/TLSH/ssdeep), XOR analysis, and crypto constant scanningPatching — ** Binary patching with backup and NOP-sled supportNetwork — ** PCAP analysis with protocol stats, DNS extraction, and C2 beacon detectionPrerequisites — The Prerequisites tool exposed by this serverInstallation goes through your MCP client rather than a global install: point it at revula on PyPI and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
You will need 8 environment variables: GHIDRA_HEADLESS, RADARE2_PATH, RIZIN_PATH, RETDEC_PATH, RZ_DIFF_PATH, MSFVENOM_PATH, REVULA_DEFAULT_TIMEOUT, REVULA_MAX_MEMORY_MB. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
pip (or uv / pipx for isolated installs)Among the browser automation options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Revula's toolset — Disassembly, Decompilation, QEMU and 9 more — is a fair guide to whether it matches your workflow. It is maintained by president-xd; worth a glance at recent repository activity before you build anything load-bearing on it.
This entry was verified against Revula's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| Disassembly | ** Multi-backend support including Capstone (always available), radare2, and objdump for x86/x64/ARM/MIPS/RISC-V |
| Decompilation | ** Ghidra (headless), RetDec, Binary Ninja with caching |
| QEMU | ** User-mode emulation (4 actions) and full system emulation (5 actions) |
| Shellcode | ** Generation, encoding, bad-char analysis, extraction, and emulation testing |
| Detection | ** Scan for anti-debug, anti-VM, anti-tamper, and packing indicators |
| Triage | ** Multi-hash, IoC extraction, suspicious import scoring, and risk assessment |
| Extraction | ** binwalk scan/extract, entropy analysis, and filesystem identification |
| WebAssembly | ** WASM section parsing, import/export extraction, and disassembly |
| Crypto | ** Hashing (MD5/SHA/TLSH/ssdeep), XOR analysis, and crypto constant scanning |
| Patching | ** Binary patching with backup and NOP-sled support |
| Network | ** PCAP analysis with protocol stats, DNS extraction, and C2 beacon detection |
| Prerequisites | The Prerequisites tool exposed by this server. |
If revula is in a virtualenv:
```json
{
"mcpServers": {
"revula": {
"command": "/home/you/venvs/revula/bin/revula",
"args": []
}
}
}Configuration as documented by the project. Restart the client after saving.
pip (or uv / pipx for isolated installs)| Variable | Description | Required |
|---|---|---|
| GHIDRA_HEADLESS | Configuration value read at startup. | Optional |
| RADARE2_PATH | Filesystem location the server is allowed to use. | Optional |
| RIZIN_PATH | Filesystem location the server is allowed to use. | Optional |
| RETDEC_PATH | Filesystem location the server is allowed to use. | Optional |
| RZ_DIFF_PATH | Filesystem location the server is allowed to use. | Optional |
| MSFVENOM_PATH | Filesystem location the server is allowed to use. | Optional |
| REVULA_DEFAULT_TIMEOUT | Configuration value read at startup. | Optional |
| REVULA_MAX_MEMORY_MB | Configuration value read at startup. | Optional |
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
Industrial-strength web extraction — render, scrape, crawl and search entire sites into clean markdown.
The original Chromium automation reference server — simple, screenshot-driven browser control.
Give your coding agent the full DevTools toolbox: traces, network, console, heap snapshots and Lighthouse.
Puppeteer-powered browser control that drives pages from the accessibility tree instead of pixels.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.