RE-AI/docs/MCP_SERVERS.md

MCP Servers Reference

The RE-AI plugin ships 8 MCP servers. Each one exposes a set of tools to Claude Code via the standard Model Context Protocol stdio JSON-RPC transport.

Server	Wraps	Status
re-lief	LIEF (in-process)	always available
re-llm-decompile	OpenAI-compatible HTTP	needs a running endpoint
re-rizin	rizin / rz-bin CLI	needs rizin on PATH
re-capa	capa (Mandiant) CLI	needs pip install flare-capa
re-mitm2swagger	mitmproxy + mitmproxy2swagger	needs pip install mitmproxy mitmproxy2swagger
re-kaitai	kaitai-struct-compiler + kaitaistruct	needs kaitai-struct-compiler on PATH
re-gdb	GDB + GEF	needs gdb on PATH and ~/.gdb/gef.py
re-triton	Triton (in-process)	needs pip install triton

Servers that are missing dependencies will report it cleanly from their check_<name>() tool rather than crashing. The plugin is usable in degraded mode with only the no-deps servers (re-lief and re-llm-decompile).

---

re-lief

Pure Python (no system deps). Wraps LIEF for cross-format binary analysis: PE, ELF, MachO, COFF, DEX, ART, OAT in a single, normalized API. Also includes a Capstone fallback for disassembly.

Tools

Tool	Description
check_lief	Health check — return LIEF version, supported formats
parse_binary	Auto-detect format and return normalized header
get_sections	Section list with permissions, virtual vs raw size, entropy, W^X flag
get_imports_exports	Symbol-level import/export tables
get_imphash	PE import hash (MD5 of normalized import table)
get_overlay	Appended data after the last section (PE)
get_authenticode	PE signature details
list_dex_classes	All classes in a Dalvik DEX file
list_dex_methods	Methods of a DEX class by FQN
list_oat_art	Methods in an OAT/ART file
disasm_capstone	Capstone disassembly (works for any LIEF-parsed binary)
extract_strings	ASCII + UTF-16LE strings, section-aware
normalize_for_diff	Structural snapshot for cross-binary diffing

Replaces v1 code

The pefile + capstone code from backend/analysis/native.py was ported into parsers.py and disasm.py. LIEF supersedes pefile (same data for PE, plus ELF/MachO/DEX/ART/OAT). The string-extraction algorithm (ASCII + UTF-16LE, regex-driven) is salvaged from v1 and generalized.

LIEF API quirks (v0.16+)

• The format enum is lief.Binary.FORMATS (not lief.FORMATS or lief.Formats)
• Section is a base class; concrete sections are ELF.Section, PE.Section, MachO.Section — each with its own FLAGS constant
• has_dynamic, has_relro, has_bind_now were dropped from the public API in 0.17. We work around this with getattr(elf, name, False)

---

re-llm-decompile

HTTP-only (no system deps). Wraps any OpenAI-compatible chat-completions API — LLM4Decompile served via vLLM, Ollama with OPENAI_COMPAT=1, OpenAI itself, etc.

Tools

Tool	Description
check_endpoint	Hit /v1/models, return the list of available models
decompile_function	Send disassembly to the LLM, return C-like pseudocode
explain_function	Have the LLM explain disassembly (no rewrite)
rename_variables	LLM proposes better names for compiler-generated symbols
summarize_binary	Whole-binary summary from strings + imports + entry-point disasm

Configuration

Env var	Default	Purpose
LLM_DECOMPILE_ENDPOINT	http://localhost:11434/v1	OpenAI-compatible base URL
LLM_DECOMPILE_MODEL	llm4decompile	Model name to request
LLM_DECOMPILE_API_KEY	(empty)	API key (use sk-... for OpenAI; empty for Ollama)

Choosing a model

• LLM4Decompile 22B (Ref): best quality for Linux x86_64 binaries, ~44GB VRAM (or AWQ/GPTQ).
• LLM4Decompile 6.7B (Ref): good middle ground, ~14GB VRAM.
• Ollama + Qwen2.5-Coder 7B: general-purpose code model, lower decompile quality but good at explanation.
• Claude / GPT (via this server): not recommended — call Claude directly through Claude Code.

---

re-rizin

Subprocess wrapper around the rizin CLI. 12 tools covering the most common static-analysis operations.

Tools

Tool	Description
check_rizin	Confirm rizin + rz-bin are installed
get_file_info	rz-bin -I — arch, bits, type, pic, canary, nx
list_imports_exports	rz-bin -i / -E — symbol tables
list_strings	rz-bin -z/-zz/-zzz — ASCII / UTF-16 / all
analyze_function	aa + afl — list all functions
disassemble_function	pdf — full disassembly of one function
decompile_function	pdc — pseudo-C decompile (lower quality than IDA/Ghidra)
get_xrefs	axt / axf — cross-references
search_bytes	/x — hex pattern search
find_crypto_constants	Detect AES / SHA / CRC tables
emulate_esil	aefi — ESIL emulation
get_cfg_graph	agf — DOT-format CFG

Install

apt install rizin       # Debian/Ubuntu
brew install rizin       # macOS
scoop install rizin      # Windows

---

re-capa

Subprocess wrapper around capa (Mandiant). 4 tools for capability detection with MITRE ATT&CK and MBC mappings.

Tools

Tool	Description
check_capa	Version + rules path
detect_capabilities	Full capa report (JSON or vverbose)
extract_mbc	Just the Malware Behavior Catalog mappings
find_interesting	High-confidence / unique matches only

Install

pip install flare-capa

---

re-mitm2swagger

Wraps mitmproxy (live capture) + mitmproxy2swagger (spec derivation). 8 tools.

Tools

Tool	Description
check_mitm	Confirm mitmdump is on PATH
start_capture	Spawn mitmdump in the background
stop_capture	Stop a previously-started capture
parse_flows	Read a mitmproxy flow file
har_to_swagger	Convert HAR → OpenAPI 3.0 spec (with path templating)
flow_to_swagger	mitmproxy2swagger on a flow file → OAS
filter_flows	Filter flows by method/host/path/status/content-type
extract_secrets	Heuristically find tokens, JWTs, API keys

Path templating rules

har_to_swagger applies these in order:

1. /<digits> → /{id}
2. /<uuid> → /{uuid}
3. /<base64-looking> → /{token}
4. /<sha1/256 hex> → /{hash}

---

re-kaitai

Wraps the kaitai-struct-compiler (system) + kaitaistruct (Python). 6 tools for custom binary format reverse engineering.

Tools

Tool	Description
check_compiler	Confirm kaitai-struct-compiler is installed
list_known_formats	List bundled .ksy formats
download_format	Download a .ksy from the kaitai-formats gallery
compile_format	Compile .ksy → Python at runtime
parse_with_format	Parse a binary with a compiled or precompiled format
visualize	Same as parse_with_format, named for intent
diff_parses	Parse two files and return a structural diff

Install

brew install kaitai-struct-compiler   # macOS
scoop install kaitai-struct-compiler  # Windows
# Linux: download prebuilt from https://github.com/kaitai-io/kaitai_struct_compiler/releases
pip install kaitaistruct

---

re-gdb

Wraps GDB + GEF for dynamic analysis. 14 tools covering session lifecycle, breakpoints, stepping, memory, and GEF-specific commands.

Tools

Tool	Description
check_gdb	Confirm gdb + GEF
start_session	Open a session, optionally load a binary
end_session	Tear down a session
run_to_breakpoint	Set a BP and run
step_count	Single-step N times, return registers
read_memory	x/N fmt ADDR
gef_heap	GEF heap chunks
gef_canary	GEF canary
gef_registers	GEF registers
gef_vmmap	GEF vmmap
gef_nearpc	GEF nearpc
gef_pattern_create	Cyclic pattern generator
gef_pattern_offset	Find offset of a value in a pattern
attach_pid	Attach to a running process

Safety

Never run unsigned binaries on a host you care about. Use a sandbox.

Cross-platform

The server uses pexpect (POSIX) or pywinpty (Windows) for the GDB subprocess. On Windows gdb is rough; prefer WSL.

---

re-triton

Wraps the Triton library for symbolic execution. 6 tools.

Tools

Tool	Description
check_triton	Confirm Triton is importable
emulate_function	Concrete emulation (no sym)
symbolic_explore	Symbolic execution through a function
solve_constraint	Z3-based constraint solver
taint_analysis	Taint tracking through a function
find_magic_bytes	Solve for input that produces target bytes

Note

Triton operates on raw machine code, not files. Tools accept code_b64 (base64-encoded bytes) — the caller extracts the relevant bytes from the binary. Best-effort on Windows.