Mcp Capstone

io.github.daedalusPublished by GitHub account daedalusv0.1.0Updated Oct 24, 2026

MCP server exposing Capstone 5.0.7 disassembly framework

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.daedalus/mcp-capstone
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account daedalus for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.daedalus%2Fmcp-capstone.svg)](https://sourceweft.com/mcp/io.github.daedalus%2Fmcp-capstone?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server wrapping the Capstone 5.0.7 disassembly framework so an assistant can disassemble binary code across many CPU architectures.

What you can do: Disassemble raw machine code bytes for a chosen architecture and mode, with full detail, lightweight, or quick variants
Check whether a given architecture is supported and list all available architectures
Look up Capstone constants for architectures, modes, options, operand types, instruction groups and errors
Report the bundled Capstone version
When to use it: Useful when an assistant needs to turn hex bytes or extracted code into readable assembly during reverse engineering, malware triage, firmware or exploit analysis, or when checking which architectures Capstone supports.
Requirements: Runs as a local stdio process installed from PyPI (pip install mcp-capstone), so Python and the package are needed; no accounts, API keys or environment variables are declared. Desktop only.

Before you install

It only disassembles bytes supplied to it and does not read files or fetch binaries itself; review any binary data you pass in, since it goes to the local server process.

Installation

In SourceWeft

Open Mcp Capstone in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-capstone

MCP server that exposes Capstone 5.0.7 disassembly framework functionalities as tools and resources, enabling LLMs to perform binary disassembly, reverse engineering, and instruction analysis.

[PyPI] [Python]

Install

Usage

CLI

Python

python

from mcp_capstone import disasm, get_version
# Get versionversion = get_version()print(f"Capstone {version['major']}.{version['minor']}")
# Disassemble x86-64 codeinstructions = disasm("8b440404", arch="x86", mode="64")for insn in instructions:    print(f"0x{insn['address']:x}: {insn['mnemonic']} {insn['op_str']}")

from mcp_capstone import disasm, get_version
# Get versionversion = get_version()print(f"Capstone {version['major']}.{version['minor']}")
# Disassemble x86-64 codeinstructions = disasm("8b440404", arch="x86", mode="64")for insn in instructions:    print(f"0x{insn['address']:x}: {insn['mnemonic']} {insn['op_str']}")

Supported Architectures

x86 (16/32/64-bit)
ARM (ARM, Thumb, ARM mode)
AArch64 (ARMv8)
MIPS (MIPS32/64, MIPS2/3, R6)
PowerPC (32/64-bit, SPE, QPX)
RISC-V (RV32/64GC)
SPARC (V8/V9)
SystemZ
M68K (68000-68060)
M680X (6301/6309/6800/6805/6808/6809/6811/CPU12/HCS08)
TriCore
TMS320C64X
WebAssembly
XCore
BPF (Classic/Extended)
EVM (Ethereum Virtual Machine)

Tools

Tool	Description
`get_version`	Get Capstone version
`check_support`	Check architecture support
`list_architectures`	List all architectures
`disasm`	Full disassembly with details
`disasm_lite`	Lightweight disassembly
`disasm_quick`	Quick disassembly
`get_architectures`	All architecture constants
`get_modes`	All mode constants
`get_options`	All option constants
`get_operands`	All operand type constants
`get_groups`	All instruction group constants
`get_errors`	All error constants

Development

bash

git clone https://github.com/daedalus/mcp-capstone.gitcd mcp-capstonepip install -e ".[test]"
# run testspytest
# formatruff format src/ tests/
# lintruff check src/ tests/
# type checkmypy src/

git clone https://github.com/daedalus/mcp-capstone.gitcd mcp-capstonepip install -e ".[test]"
# run testspytest
# formatruff format src/ tests/
# lintruff check src/ tests/
# type checkmypy src/

mcp-name: io.github.daedalus/mcp-capstone

Source: README.md at commit d39906a

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts