BinSight

io.github.AlessioluciniPublished by GitHub account Alessioluciniv6.6.0Updated Oct 26, 2026

The AI X-ray for any file: what is it, what does it hide, what changed. Built on REA.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.Alessiolucini/binsight
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Oct 17, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account Alessiolucini for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.Alessiolucini%2Fbinsight.svg)](https://sourceweft.com/mcp/io.github.Alessiolucini%2Fbinsight?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

BinSight statically analyzes binaries and any file locally, letting an assistant identify, inspect and diff them without executing them.

What you can do: Triage and inspect executables: type, architecture, entry point, sections, imports/exports, hashes, hardening and code signatures for ELF, PE and Mach-O.
Detect what a file hides: toolchain and packer fingerprints, entropy, import-derived capabilities, crypto constants, IOC strings and embedded files.
Compare files: byte-level diffs of any two files plus import, export, section and hardening deltas for executables.
Search and fingerprint: byte, hex-wildcard, text and regex scans, similarity hashes, Go symbol recovery and SBOM generation.
Report: a shareable Markdown triage report, with observations, inferences and unknowns kept separate.
When to use it: Useful when you need to understand an unfamiliar download, driver, firmware dump or app update, check whether a binary is packed or signed, or see what changed between two builds — all offline and without running the file.
Requirements: Runs as a local stdio process via npx (Node.js). Desktop only; no authentication, environment variables or headers declared. Works offline on macOS, Windows and Linux.

Before you install

It reads the files you point it at and sends their contents to the assistant as analysis results, so avoid pointing it at sensitive files you would not share with the model. It is detection only: nothing is unpacked, decrypted or executed, and results are evidence and inference rather than a verdict.

Installation

In SourceWeft

Open BinSight in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

BinSight

The AI X-ray for any file. Point it at a binary and ask: what is it, what does it hide, and what changed?

Offline · cross-platform · with evidence. It never runs the file.

[MCP tool catalog] [license MIT]

Built on REA (morluto/rea) · MIT

Most files are black boxes: an .exe you downloaded, a firmware dump, a driver, a game, an ECU calibration, an app update. BinSight opens the box — statically, on your own machine, without ever running the file — and answers the three questions that matter, in plain language and with the evidence to back them up.

text

You: What is this file? Is it hiding anything? And what changed vs the old version?
BinSight: PE/Windows x64, compiled with MSVC, UPX-packed (entropy 7.9),          imports consistent with network + process injection, Authenticode          signature present, and vs the previous build 3 regions changed —          here are the offsets. All static, all offline, with evidence.

You: What is this file? Is it hiding anything? And what changed vs the old version?
BinSight: PE/Windows x64, compiled with MSVC, UPX-packed (entropy 7.9),          imports consistent with network + process injection, Authenticode          signature present, and vs the previous build 3 regions changed —          here are the offsets. All static, all offline, with evidence.

The three questions

🔎 What is it?

triage_file and inspect_executable read ELF, PE/Windows and Mach-O (and raw blobs) and tell you the type, architecture, entry point, imports/exports, sections, hashes, and a compiler/packer fingerprint — without starting Ghidra or IDA, on macOS, Windows or Linux.

🕵️ What does it hide?

detect_binary_toolchain, measure_binary_entropy, classify_import_capabilities, identify_crypto_constants, extract_binary_strings, inspect_code_signature and scan_embedded_content surface packing, high-entropy regions, imported capabilities (network, process, crypto…), IOC strings, embedded files, and whether a signature is real — reported as evidence and inference, never as a verdict.

🔁 What changed?

compare_binaries diffs any two files byte-for-byte and explains the change — which regions moved, what was zeroed or maxed out, the before/after values. Works on app updates, drivers, firmware and ECU calibration dumps alike. compare_executables adds import/export/section/hardening deltas for executables.

All 17 tools

Tool	What it answers
`triage_file`	One call: type, hashes, structure, entropy, packing, capabilities, signature, strings, next steps
`generate_triage_report`	A shareable Markdown triage report
`compare_binaries`	Diff any two files and explain what changed (firmware, ECU dumps, updates)
`compare_executables`	Diff two executables: imports, exports, sections, hardening, entropy
`inspect_executable`	Sections, imports, exports, libraries, symbols, entry point, overlay — ELF/PE/Mach-O
`inspect_binary_hardening`	checksec for every OS: PIE, canary, NX, RELRO, CFG, ASLR, hardened runtime
`measure_binary_entropy`	File / section / block Shannon entropy + chi-square
`detect_binary_toolchain`	Compiler, packer, installer, language (UPX, MSVC, PyInstaller, Go…)
`extract_binary_strings`	ASCII/UTF-16 strings classified into IOCs (URL, IP, path, registry…)
`identify_crypto_constants`	AES S-box, SHA/MD5, CRC32, ChaCha, curve parameters…
`classify_import_capabilities`	Capabilities inferred from imports ("consistent with", never a verdict)
`scan_byte_patterns`	Byte / hex-wildcard / text / regex search, no provider needed
`compute_similarity_hashes`	imphash, Rich hash, symhash, telfhash, ssdeep, TLSH
`inspect_code_signature`	Authenticode + Mach-O code signature — on any host
`scan_embedded_content`	binwalk-style embedded-file identification (offsets only)
`generate_sbom`	CycloneDX / SPDX component inventory from embedded metadata
`recover_go_symbols`	Function names from a stripped Go `pclntab`

Every result separates observations, inferences and unknowns, carries file offsets, and states its limitations. Detection only — nothing is unpacked, decrypted, cracked or executed.

Quickstart

bash

npx binsight triage-file /path/to/file --jsonnpx binsight compare-binaries /path/to/old /path/to/new --jsonnpx binsight generate-triage-report /path/to/file --json

npx binsight triage-file /path/to/file --jsonnpx binsight compare-binaries /path/to/old /path/to/new --jsonnpx binsight generate-triage-report /path/to/file --json

Register BinSight as an MCP server for your AI agent, then just ask it in plain language ("what is this file, what does it hide, what changed?"):

BinSight supports the same agents as REA — see supported agents; other clients can use manual MCP registration.

Verified against the reference tools

BinSight's parsers and hashes are checked against the tools analysts already trust: imphash matches pefile byte-for-byte, structure matches LIEF / readelf / otool, and hardening and packing results match checksec and Detect It Easy on a real corpus of ELF, PE and Mach-O binaries.

Documentation

Static intelligence suite: the 17 tools, with CLI and MCP examples.
Tool catalog: generated inventory of tools, providers and CLI commands.
Installation and setup: providers, agents and manual registration.

Built on REA

BinSight builds on REA and adds the static intelligence suite above. REA is MIT-licensed; this project keeps that license and attribution. This is not an official REA release — for REA itself, go to morluto/rea.

License

Source: README.md at commit 70eeea2

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v6.6.0LatestOct 18, 2026
v6.5.1Oct 17, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts