triage
Identify a file or directory: format, architecture, size, SHA-256, markers (Go, Rust, Electron, N-API, packers) and the next tool to call.
Parameters
pathrequired
Reverse Engineer
io.github.FirzusPublished by GitHub account Firzusv0.1.0-alpha.2Updated Oct 29, 2026
Read-only reverse engineering of Electron apps, PE/ELF/Mach-O binaries, Go/Rust, .NET and APKs.
Overview
AI-generated overview
A local MCP server that lets an assistant perform read-only reverse engineering of Electron apps, native binaries, Go/Rust, .NET and APKs.
- What you can do
- It exposes read-only reverse engineering capabilities to an assistant, covering Electron applications, PE, ELF and Mach-O binaries, Go and Rust builds, .NET assemblies, and Android APKs. The registry description lists no individual tools, so the exact operations are not documented here. It runs as a local process over stdio rather than as a remote service.
- When to use it
- Worth adding when you want an assistant to help inspect or analyze compiled software and packaged applications on your own machine, for example during security review, malware triage, or understanding an unfamiliar binary. It is not intended for modifying or rebuilding the artifacts it examines.
- Requirements
- A local runtime with Node.js, since it is distributed as the npm package reverse-engineer and communicates over stdio. No authentication, environment variables, or headers are declared. It is desktop-only and not available as a web executable.
Before you install
The description states the analysis is read-only, but the server still runs as a local process with access to the files you point it at, so avoid exposing sensitive binaries or directories. No credentials or API keys are declared. No tool list is published, so review the package before installing.
Installation
In SourceWeft
- Open Reverse Engineer in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
This repository has no README.
Tools
8electron_surface
Electron app map: extracts app.asar (cached), main entry, preloads and exposed APIs, native .node addons and the addon names called from JS, IPC channels grouped by call site, fuses, asar integrity. Use focus (one or more words) to filter on one feature.
Parameters
pathrequiredfocussearch
Search a directory, an extracted app, a .asar (auto-extracted) or one file. Hidden folders included, node_modules skipped by default. Returns file:line:col (or file@offset for binaries) with a short excerpt.
Parameters
maxglobpathrequiredregexcontextpatternrequiredignore_caseinclude_depsread
Read a slice: lines start..end; for minified code a column window (start=line, col, length); for binaries a hexdump at offset. A directory path lists its entries.
Parameters
colendpathrequiredstartlengthoffsetbinary_inventory
PE, ELF or Mach-O inventory. part=summary (default): format, sections, libraries with imports, exports, Node addon names, notable strings. Other parts list one table, paged with skip and filtered by a regex.
Parameters
maxpartpathrequiredskipfilterbuildinfo
Go build info (toolchain, main package, module, build settings, dependency versions) and Rust cargo-auditable dependencies, parsed from the binary without running it.
Parameters
pathrequiredfilterdecompile
Ghidra headless decompilation, cached per file. First call analyzes the binary (can take minutes). function=NAME|ADDRESS returns its C; containing=TEXT lists functions that reference a string; neither lists functions.
Parameters
maxpathrequiredskipfunctioncontainingmanaged
.NET assemblies (via ilspycmd) and APK/DEX/JAR (via jadx): decompile once into the cache, summarize namespaces, manifest, P/Invoke and native libraries; type=Name returns one type's source.
Parameters
pathrequiredtypeVersion history
2- v0.1.0-alpha.2LatestOct 23, 2026
- v0.1.0-alpha.1Oct 19, 2026
Score
65% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listedRequired15 pts
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
- License10 pts
Declare a license in the repository or the registry entry.