[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-105393":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":17,"stars30d":17,"stars90d":16,"forks30d":16,"starsTrendScore":18,"compositeScore":19,"rankGlobal":10,"rankLanguage":10,"license":20,"archived":21,"fork":21,"defaultBranch":22,"hasWiki":23,"hasPages":21,"topics":24,"createdAt":10,"pushedAt":10,"updatedAt":25,"readmeContent":26,"aiSummary":10,"trendingCount":16,"starSnapshotCount":16,"syncStatus":27,"lastSyncTime":28,"discoverSource":29},105393,"mcp-reverse","1llu50ry\u002Fmcp-reverse","1llu50ry","MCP (Model Context Protocol) server for game hacking & reverse engineering. A structured knowledge base of 4,100+ skills with full source code archives, specialized agents, and workflow tools -- designed to be plugged into Claude, Cursor, or any MCP-compatible client.","",null,"TypeScript",508,99,3,1,0,61,183,87.96,"MIT License",false,"main",true,[],"2026-11-01 00:15:42","\u003Cdiv align=\"center\">\n\n# 🎮 mcp-reverse\n\n### The MCP server that turns Claude, Codex, and Cursor into a reverse-engineering team.\n\n**180+ MCP tools · 56 RE\u002Fdebug backends · 9 host-side plugins · 4,200+ skills · multi-agent mesh · native x86-64 + ARM64 emulators**\n\n[![version](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fversion-5.0.1-blue)](CHANGELOG.md) [![tests](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Ftests-91%2F91-success)](tests\u002F) [![tools](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FMCP%20tools-180%2B-blue)](src\u002F) [![backends](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FRE%20backends-56-blueviolet)](src\u002Fretools.ts) [![skills](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fskills-4%2C200%2B-orange)](skills\u002F) [![docker](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fdocker-multi--arch-informational)](Dockerfile) [![license](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-MIT-green)](LICENSE) [![audit](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fnpm%20audit-0-brightgreen)](package.json)\n\n> **v5.0.0 released.** 19 GiB → 3.3 GiB working tree (83% smaller via gzipped source archives), + four feature waves: host plugin build systems, Frida bridge + dynamic analysis, ARM64 emulator + decompile cache + chunking, bindiff \u002F ROP \u002F game-engine metadata \u002F MCP sampling \u002F SVG visualization. See [CHANGELOG](CHANGELOG.md).\n\n[Quickstart](#30-second-quickstart) · [Architecture](docs\u002Farchitecture.md) · [Comparison](#comparison) · [Agent Mesh](docs\u002Fagent-mesh.md) · [MCP Hub](docs\u002Fmcp-hub.md) · [Ethics](#ethics--responsible-use)\n\n[English](README.md) · [Русский](README-ru.md) · [简体中文](README-zh.md)\n\n\u003C\u002Fdiv>\n\n---\n\n## Why this exists\n\nReverse engineering a modern game involves five static tools (Ghidra, IDA, Binary Ninja, radare2, Hopper), three debuggers (x64dbg, WinDbg, GDB\u002FLLDB), a hex-editor, a memory scanner (Cheat Engine), an instrumentation framework (Frida), and a stack of format parsers (PE, ELF, Mach-O, DEX, Minidump, Unity AssetBundle, UE `.pak`). Switching between them costs hours. Teaching a model to drive even one of them well costs more.\n\n**This server:**\n\n1. **Aggregates 59 existing RE \u002F debug MCP backends** behind one connection — `smart_decompile` picks IDA when running, falls back to Ghidra, then Binja, then RetDec.\n2. **Ships 111 native MCP tools** so most answers don't need an external backend at all — PE \u002F ELF \u002F Mach-O \u002F DEX \u002F WASM \u002F Minidump \u002F ZIP \u002F .NET \u002F IL2CPP metadata parsers, AoB signature scan, Shannon entropy, crypto-constant identification, PDB70 → Microsoft symbol server URL.\n3. **Lets Claude, Codex, and Cursor collaborate** through a shared mesh — DM, channels, task handoff, adversarial voting, shared KV knowledge-base, named locks for coordination. Zero-dep JSON persistence.\n4. **Curates 4,200+ skills** — 246 hand-written deep references on anti-cheat (BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron, Ricochet, mhyprot) and 3,985 archived open-source projects with full source dumps.\n\nIf you're on security-research, cheat-detection, defensive-engineering, or game-SDK work — this collapses a day of tool-shuffling into one MCP connection.\n\n## 30-second quickstart\n\n[![Open in GitHub Codespaces](https:\u002F\u002Fgithub.com\u002Fcodespaces\u002Fbadge.svg)](https:\u002F\u002Fcodespaces.new\u002F1llu50ry\u002Fmcp-reverse?quickstart=1)\n\n\n```bash\n# clone + build\ngit clone https:\u002F\u002Fgithub.com\u002F1llu50ry\u002Fmcp-reverse && cd mcp-reverse\nnpm install && npx tsc\nnpm test            # 20\u002F20 should pass\n\n# wire into Claude Code \u002F Codex \u002F Cursor (stdio mode)\n# (add this JSON to your client's MCP config)\n#   { \"mcp-reverse\": { \"command\": \"node\", \"args\": [\"\u002Fpath\u002Fto\u002Fdist\u002Findex.js\"] } }\n\n# OR run over HTTP (Docker-friendly)\ndocker compose up\n\n# OR drive it from the CLI (no MCP client needed)\n.\u002Fbin\u002Fmcp-reverse.mjs stats\n.\u002Fbin\u002Fmcp-reverse.mjs search battleye\n.\u002Fbin\u002Fmcp-reverse.mjs tools    # list every registered MCP tool\n```\n\nPoint your MCP client at it, then ask any of:\n\n- *\"Analyze `C:\\game\\binary.exe` and tell me what packer it uses.\"* → calls `analyze_binary` (entropy + Rich Header + Debug Directory + imports + crypto constants)\n- *\"Decompile `0x401000` using every connected backend and spot disagreements.\"* → `hub_consensus_call matcher=decompile`\n- *\"Alice, hand off driver.sys unpacking to Bob; Cursor review the result.\"* → mesh orchestration\n- *\"BM25 search 'battleye shellcode detection'.\"* → `bm25_search` ranks 4,230 docs by BM25 relevance\n\n## Architecture\n\n```mermaid\nflowchart LR\n  subgraph clients[\" MCP clients \"]\n    C1[Claude Code]\n    C2[Codex \u002F ChatGPT]\n    C3[Cursor]\n    C4[Copilot CLI]\n    C5[custom]\n  end\n\n  subgraph server[\" mcp-reverse (this repo) \"]\n    direction TB\n    T[111 MCP tools]\n    M[Agent Mesh\u003Cbr\u002F>DM · channels · tasks · votes · KB · locks]\n    H[MCP Hub\u003Cbr\u002F>smart_decompile · consensus_call]\n    N[Native parsers\u003Cbr\u002F>PE · ELF · Mach-O · DEX · WASM · Minidump · ZIP · .NET]\n    S[Skill library\u003Cbr\u002F>4,200+ docs · BM25]\n  end\n\n  subgraph backends[\" 59 RE \u002F debug MCP backends \"]\n    B1[Ghidra · IDA · Binja]\n    B2[x64dbg · WinDbg · GDB · LLDB]\n    B3[Cheat Engine · Frida]\n    B4[PCILeech · Memflow]\n    B5[Volatility · YARA · angr]\n  end\n\n  C1 & C2 & C3 & C4 & C5 -->|stdio or HTTP| server\n  server -->|hub_connect| B1 & B2 & B3 & B4 & B5\n```\n\n## Verticals\n\nThe game-hacking framing is historical — the tooling covers every RE discipline:\n\n| Vertical | Why this project fits | Docs |\n|---|---|---|\n| 🎮 **Game security + anti-cheat** | 4,200+ hand-written skills across BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron, Ricochet, mhyprot, Hyperion. | this README |\n| 🦠 **Malware analysis** | PE \u002F minidump \u002F Rich Header \u002F Debug Directory parsers + 59-backend hub (YARA, Volatility, angr, Qiling). | [docs\u002Fverticals\u002Fmalware-analysis.md](docs\u002Fverticals\u002Fmalware-analysis.md) |\n| 📱 **Mobile security (iOS + Android)** | Mach-O (fat + arm64e) + DEX + APK parsers + Hopper + Frida + JADX + Magisk + idevice MCPs. | [docs\u002Fverticals\u002Fmobile-security.md](docs\u002Fverticals\u002Fmobile-security.md) |\n| 🔧 **Firmware \u002F IoT** | ELF + Qiling + Unicorn + angr for embedded. | [docs\u002Fverticals\u002Ffirmware-iot.md](docs\u002Fverticals\u002Ffirmware-iot.md) |\n| 🏁 **CTF \u002F exploit development** | pwndbg + GEF + angr + AFL++ + honggfuzz + LibAFL + Unicorn + ret-sync all behind one hub. | [docs\u002Fverticals\u002Fctf-pwn.md](docs\u002Fverticals\u002Fctf-pwn.md) |\n\n## Comparison\n\n| Project | Scope | Tools | Backends | Multi-agent | Skills archive |\n|---|---|---:|---:|:---:|---:|\n| **mcp-reverse** (this repo) | Game RE + anti-cheat + mesh orchestration | **111** | **59** | ✅ | **4,200+** |\n| [GhidraMCP](https:\u002F\u002Fgithub.com\u002FLaurieWired\u002FGhidraMCP) | Ghidra bridge | 5 | 1 | — | — |\n| [ida-pro-mcp](https:\u002F\u002Fgithub.com\u002Fmrexodia\u002Fida-pro-mcp) | IDA bridge | ~50 | 1 | — | — |\n| [SuperghidraMCP](https:\u002F\u002Fgithub.com\u002Fyuatemycat\u002FSuperGhidraMCP) | pyghidra | 38 | 1 | — | — |\n| [REA](https:\u002F\u002Frea.tools) | Cross-stack RE (native + Electron + .NET) | ~40 | 3 | — | — |\n| [Vibe-RE](https:\u002F\u002Fgithub.com\u002Fwit-x\u002FVibe-Reverse-Engineering) | PE triage pipeline | ~30 | 1 | — | — |\n\n## Ethics & responsible use\n\nThis project exists for **security research, cheat detection, defensive engineering, game-preservation, and reverse-engineering education**. Specifically:\n\n- Anti-cheat engineers use it to understand bypass vectors and harden their systems.\n- Red teams use it on binaries they are authorized to analyze.\n- Students use it to learn how PE \u002F ELF \u002F IL2CPP \u002F UE4 \u002F Source2 actually work.\n- Preservation groups use it to document archived game ecosystems.\n\n**It is not a cheat.** It writes no code into any game. It automates no play. Use it against binaries you own or are authorized to analyze. Do not use it to grief, de-fraud, or harm other players.\n\nRead [SECURITY.md](SECURITY.md) for responsible disclosure. By contributing you agree to [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).\n\n---\n\n## Features\n\n### Skill Library\n\n- **177 hand-written skills** -- deep technical references on injection, hooking, kernel drivers, anti-cheat internals, ESP\u002Faimbot architecture, and more\n- **3,985 archived projects** -- full source code snapshots from the game security ecosystem (prefixed `ags-`)\n- Each skill has a `SKILL.md` (description, metadata, topics) and optionally a `source.txt` (complete source tree dump)\n\n### Agents\n\n| Agent | Description |\n|-------|------------|\n| `reverse-engineer` | Disassembly analysis, struct recovery, offset hunting, binary patching |\n| `exploit-developer` | Kernel exploits, BYOVD chains, EFI persistence, privilege escalation |\n| `anti-cheat-analyst` | BattlEye, EAC, Vanguard, VAC, FACEIT internals and bypass research |\n| `malware-analyst` | Cheat binary analysis, unpacking, IOC extraction, technique classification |\n| `cheat-developer` | ESP, aimbot, triggerbot, overlay rendering, UE\u002FUnity\u002FSource engine internals |\n| `driver-developer` | WDM\u002FKMDF drivers, IOCTL comm, memory R\u002FW, stealth loading |\n| `hypervisor-researcher` | Intel VMX, AMD SVM, EPT\u002FNPT hooks, HV-based memory access |\n| `android-researcher` | Zygisk, KernelSU, frida, IL2CPP dumping, native hooking |\n| `network-analyst` | Game protocol RE, packet capture, MITM proxy, server emulation |\n| `cs2-specialist` | Counter-Strike 2 \u002F Source 2 internals |\n| `valorant-specialist` | Valorant \u002F UE4 fork \u002F Vanguard interaction |\n| `fortnite-specialist` | Fortnite \u002F UE5 \u002F EAC interaction |\n| `apex-specialist` | Apex Legends \u002F Source fork internals |\n| `unreal-engine-specialist` | UE4\u002FUE5 GObjects, GNames, ProcessEvent, SDK gen |\n| `unity-specialist` | Unity Mono\u002FIL2CPP, GameObjectManager, metadata |\n| `source-engine-specialist` | Source 1\u002F2 ConVar, NetVar, ClientClass |\n| `injection-specialist` | All injection methods (manual map, reflective, APC, EFI) |\n| `hooking-specialist` | All hook types (VMT, IAT, inline, EPT, syscall) |\n| `obfuscation-analyst` | VMProtect, Themida, OLLVM analysis and unpacking |\n| `windows-internals-agent` | EPROCESS, PEB\u002FTEB, system calls, object manager |\n| `ida-specialist` | IDA Pro scripting, plugins, FLIRT, type libraries |\n| `ghidra-specialist` | Ghidra scripting, P-code, extensions |\n| `dma-specialist` | DMA\u002FFPGA memory access (PCILeech, Screamer) |\n| ...and 52 more game-specific, engine-specific, technique-specific, and tool-specific agents |\n\n### Subagents (161)\n\n| Subagent | Purpose |\n|----------|---------|\n| `offset-finder` | Cross-reference game offsets across 3,900+ archived sources |\n| `code-analyzer` | Classify technique, hook method, stealth measures |\n| `pattern-scanner` | Generate and validate IDA-style byte patterns |\n| `detection-assessor` | Assess detection risk per anti-cheat system |\n| `vulnerability-scanner` | Find exploitable vulns in drivers and binaries |\n| `struct-recovery` | Recover C++ structures from memory dumps or IDA |\n| `binary-differ` | Diff game updates to track offset changes |\n| `source-grep` | Deep search across all 3,985 source archives |\n| `hook-planner` | Plan hook chains for specific objectives |\n| `import-resolver` | Resolve imports for manual-mapped modules |\n| `vtable-mapper` | Map virtual function tables |\n| `syscall-stub-generator` | Generate direct\u002Findirect syscall stubs |\n| `bone-mapper` | Map skeleton bone indices per game |\n| `ac-driver-analyzer` | Deep analysis of anti-cheat kernel driver |\n| `stack-spoofer` | Spoof call stack for AC evasion |\n| `shellcode-encoder` | Encode shellcode to evade signatures |\n| ...and 145 more focused subagents across 16 categories |\n\n### Plugins (114)\n\n| Plugin | Purpose |\n|--------|---------|\n| `game-offset-db` | Cross-reference offset database for 60+ games |\n| `technique-finder` | Find implementation examples across all source code |\n| `yara-generator` | Generate YARA detection rules from cheat patterns |\n| `driver-catalog` | Vulnerable driver database with exploit primitives |\n| `hook-library` | All hook types with code examples and detection vectors |\n| `struct-database` | Known game engine structures (UE4\u002FUE5, Source, Unity) |\n| `anti-cheat-timeline` | AC update tracking and bypass shelf-life |\n| `exploit-chain-builder` | Compose multi-stage exploit chains |\n| `signature-generator` | Generate and validate byte patterns |\n| `cs2-offsets` \u002F `valorant-offsets` \u002F ... | Per-game offset databases (10 games) |\n| `ue4-sdk-reference` \u002F `ue5-sdk-reference` | Engine SDK structure references |\n| `ntapi-reference` | Undocumented NT API reference |\n| `syscall-table` | Windows syscall numbers per OS build |\n| `battleye-detection-db` \u002F `eac-detection-db` \u002F ... | Per-AC detection databases |\n| `offset-header-generator` \u002F `hook-template-generator` | Code generation tools |\n| ...and 99 more data, reference, and code generation plugins across 11 categories |\n\n### Prompts (148)\n\n| Prompt | Purpose |\n|--------|---------|\n| `analyze-cheat` | Full architecture analysis of a cheat project |\n| `find-bypass` | Find bypass techniques for specific anti-cheat |\n| `build-cheat` \u002F `build-esp` \u002F `build-aimbot` | Design cheat systems |\n| `reverse-binary` \u002F `reverse-unity-game` \u002F `reverse-unreal-game` | RE workflows |\n| `write-driver` \u002F `write-injector` \u002F `write-hook` | Implementation guides |\n| `bypass-battleye` \u002F `bypass-eac` \u002F `bypass-vanguard` | AC bypass strategies |\n| `spoof-hardware` | HWID spoofing design |\n| `analyze-update` | Game update offset migration |\n| `exploit-vuln-driver` \u002F `exploit-kernel-bug` | Exploitation guides |\n| `implement-backtrack` \u002F `implement-autowall` \u002F `implement-prediction` | Feature implementation |\n| ...and 138 more prompts across 14 categories for every game hacking task |\n\n---\n\n## Tools (111 total)\n\n### Workflow Tools\n\n| Tool | Description |\n|------|------------|\n| `research_technique` | End-to-end technique research with scored keyword ranking |\n| `analyze_project` | Full project analysis (SKILL.md + source code) |\n| `get_agent_briefing` | Load agent definition with available subagents and plugins |\n\n### Skill Tools\n\n| Tool | Description |\n|------|------------|\n| `list_skills` | List\u002Ffilter skills by name or type |\n| `read_skill` | Read a skill SKILL.md |\n| `read_source` | Read source code with pagination (50KB chunks) |\n| `search_skills` | Multi-keyword scored search across names, descriptions, topics |\n| `skill_stats` | Library statistics |\n\n### Component Tools\n\n| Tool | Description |\n|------|------------|\n| `list_agents` \u002F `read_agent` | Browse and read agent definitions |\n| `list_subagents` \u002F `read_subagent` | Browse and read subagent definitions |\n| `list_plugins` \u002F `read_plugin` | Browse and read plugin definitions |\n| `list_prompts` \u002F `read_prompt` | Browse and read prompt templates |\n\n### RE \u002F Debug MCP Integrations (v4.1)\n\nLaunch and drive **43** external RE and debugging MCP servers directly from this server. Supported backends: **GhidraMCP, SuperghidraMCP (pyghidra-mcp, +gui), Ghidrathon MCP, ida-pro-mcp, Hex-Rays IDA MCP, Binary Ninja MCP, radare2 MCP, x64dbg MCP Server, WinDbg MCP, Cheat Engine MCP, Frida MCP, Hopper MCP, REA, Vibe-RE, JADX MCP, angr MCP, Capstone MCP, PCILeech\u002FMemProcFS MCP, Memflow MCP, Scylla MCP, dnSpyEx MCP, ReClass.NET MCP, Volatility3 MCP, Wireshark\u002Ftshark MCP, mitmproxy MCP, dotPeek MCP, Unicorn MCP, ret-sync MCP, BinDiff MCP, Diaphora MCP, Qiling MCP, unidbg MCP, Reko (OpenReality) MCP, QEMU trace MCP, LLDB MCP, GDB MCP, Burp MCP, YARA MCP, ClrMD MCP, Binja-Ghidra sync MCP, Dolphin DME MCP, Cemu IPC MCP**.\n\n| Tool | Description |\n|------|------------|\n| `list_re_backends` | List every known RE\u002Fdebug MCP backend (filter by kind\u002Fos\u002Ftag) |\n| `describe_re_backend` | Full detail for one backend (install, launch, HTTP endpoint, config snippet) |\n| `pick_re_backend` | Recommend backend(s) for a described task |\n| `re_mcp_config` | Emit a Claude Desktop \u002F Claude Code \u002F Cursor \u002F Codex MCP config snippet |\n| `launch_re_backend` | Spawn a backend as a managed child process |\n| `stop_re_backend` | Terminate a backend (SIGTERM → SIGKILL after grace) |\n| `re_backend_status` | Process status + recent stdout\u002Fstderr tail |\n| `re_backend_health` | HTTP reachability probe for every backend that declares an endpoint |\n| `re_http_call` | Proxy an HTTP request to a running backend |\n| `x64dbg_cmd` | Send a command to a running x64dbg plugin (GetDebugState, SetBreakpoint, …) |\n| `ghidra_decompile` | Decompile a function via a running pyghidra-mcp \u002F superghidra-mcp |\n| `cheat_engine_aob` | AoB (array-of-bytes) scan through a running Cheat Engine bridge |\n| `frida_eval` | Evaluate a Frida JS snippet in a target process |\n| `vibe_re_run` | Run a Vibe-RE Python module (`retools.disasm`, `retools.callgraph`, `livetools.analyze`, …) from vendored `tools\u002Fvendor\u002Fvibe-re` |\n| `ida_run_script` | Run an IDAPython script headless via `idat64` |\n| `ghidra_run_script` | Run a Ghidra script via `analyzeHeadless` |\n| `install_re_backend` | Run the install commands from the catalog for one backend (with `dryRun` preview) |\n\n### Native TypeScript RE Tools (always available)\n\nZero-dependency Node TypeScript. No Python, no Ghidra, no IDA needed.\n\n| Tool | Description |\n|------|------------|\n| `pe_parse` | Parse PE\u002FPE+ -- machine, bits, timestamp, sections (name\u002FVA\u002Fsize\u002Fentropy), imports (DLL + names), exports, overlay, Authenticode |\n| `elf_parse` | Parse ELF (32\u002F64, little-endian) -- machine, segments, sections, DT_NEEDED, SONAME, interpreter |\n| `macho_parse` | Parse Mach-O (thin + fat) -- CPU, filetype, segments, load commands, LC_LOAD_DYLIB list |\n| `dex_parse` | Parse Android DEX -- version, counts, first class names |\n| `wasm_parse` | Parse WebAssembly -- version, section layout (standard + custom) |\n| `file_identify` | Magic-byte sniff: PE, ELF, Mach-O (thin+fat), DEX, WASM, ZIP\u002FAPK\u002FJAR, 7-Zip, gzip, zstd, LZ4, PDF, scripts, Switch NSO\u002FNCA, Xbox 360 XEX, PS4\u002FPS5 FSELF |\n| `aob_scan` | IDA-style AoB signature scan over any file (`48 8B ?? ?? ?? ?? ?? E8`) |\n| `entropy_scan` | Sliding-window Shannon entropy; flag windows above threshold (packed\u002Fencrypted detection) |\n| `string_extract` | ASCII + UTF-16LE strings with minimum-length filter |\n| `hash_identify` | Scan for MD5\u002FSHA-1\u002FSHA-256\u002FCRC-32\u002FFNV-1a\u002FChaCha20\u002FBlowfish\u002FAES crypto constants with byte offsets |\n| `signature_make` | Make an IDA-style byte signature for a region of a file (with uniqueness check) |\n| `file_summary` | Size, SHA-256, Shannon H, magic bytes, head\u002Ftail hex |\n\nVendored tool trees live under `tools\u002Fvendor\u002F` (currently `vibe-re`, `ida-pro-mcp`). External backends install via `install_re_backend` or `describe_re_backend` → \"Install\" section. `tools\u002Flaunchers\u002Finstall-all.{ps1,sh}` bootstraps every pip\u002Fnpm backend in one shot.\n\n### Advanced Native Parsers\n\n| Tool | Description |\n|------|------------|\n| `minidump_parse` | Parse Windows minidump (.dmp): streams, modules, threads, exception, system info |\n| `pdb70_identify` | RSDS record -> GUID + age + PDB path + Microsoft symbol server URL |\n| `rich_header_parse` | Rich header entries (MSVC build fingerprint) |\n| `demangle` | MSVC + Itanium (GCC\u002FClang) C++ name demangler |\n| `assetbundle_parse` | Unity AssetBundle header (UnityFS\u002FWeb\u002FRaw\u002FArchive) |\n| `pak_parse` | UE4\u002FUE5 .pak footer (magic 0x5A6F12E1, index offset+size+SHA1) |\n| `il2cpp_metadata_parse` | Unity IL2CPP global-metadata.dat header (unencrypted) |\n| `nso_parse` | Switch NSO header (segments + module id) |\n\n### Workflow Tools\n\n| Tool | Description |\n|------|------------|\n| `offset_diff` | Diff two offset JSON maps (added\u002Fremoved\u002Fchanged) |\n| `offset_merge` | Merge N offset sources with voting quorum |\n| `sig_validate_cross_build` | Check an AoB signature is unique across several builds |\n| `ac_risk_report` | Risk matrix: technique × AC → tier (A\u002FB\u002FC\u002FX) |\n| `generate_cheat_sheet` | Markdown cheat sheet per game |\n\n### Agent Mesh — multi-agent collaboration\n\nLets Claude Code, Codex\u002FChatGPT, Cursor, Copilot, Gemini CLI and custom bots share one workspace through MCP: register, DM + channel broadcast, task handoff with status machine, adversarial voting on findings, shared KV knowledge base, named locks. Persistence to JSON (zero npm deps). See [docs\u002Fagent-mesh.md](docs\u002Fagent-mesh.md).\n\nTools (15): `mesh_agent_register`, `mesh_agent_list`, `mesh_agent_heartbeat`, `mesh_send`, `mesh_read`, `mesh_task_create`, `mesh_task_update`, `mesh_task_list`, `mesh_task_vote`, `mesh_kb_set`, `mesh_kb_get`, `mesh_lock_acquire`, `mesh_lock_release`, `mesh_lock_list`, `mesh_stats`.\n\n### MCP Hub — aggregate backend MCPs\n\nOur server connects to other MCPs (ghidra, ida, x64dbg, binja, radare2, cheat-engine, frida, …) as a CLIENT and re-exposes their tools. Composable: `smart_decompile` picks the first available decompiler backend; `hub_consensus_call` fans out across backends for adversarial comparison. See [docs\u002Fmcp-hub.md](docs\u002Fmcp-hub.md).\n\nTools (6): `hub_connect`, `hub_list`, `hub_call`, `hub_disconnect`, `smart_decompile`, `hub_consensus_call`.\n\n### CLI\n\n```bash\nmcp-reverse stats                 # library counts\nmcp-reverse lookup battleye       # print SKILL.md\nmcp-reverse search anti-cheat     # keyword search\nmcp-reverse tools                 # list every MCP tool\nmcp-reverse health [url]          # probe \u002Fhealthz\nmcp-reverse serve                 # start the MCP server\n```\n\n### Path sandbox (security)\n\nFile-reading tools (`pe_parse`, `elf_parse`, `aob_scan`, `zip_parse`, …) obey `MCP_FS_ALLOW` and `MCP_FS_DENY`. Default is open mode. Set `MCP_FS_ALLOW=\u002Fpath\u002Fa,\u002Fpath\u002Fb` to restrict reads when exposing the server over HTTP.\n\n### HTTP transport, health, metrics\n\nSet `MCP_TRANSPORT=http` to run the server over Streamable HTTP instead of stdio:\n\n```bash\nMCP_TRANSPORT=http MCP_HTTP_PORT=7777 MCP_HTTP_HOST=127.0.0.1 node dist\u002Findex.js\n# → MCP endpoint:  POST http:\u002F\u002F127.0.0.1:7777\u002Fmcp\n# → readiness:     GET  http:\u002F\u002F127.0.0.1:7777\u002Fhealthz\n# → Prometheus:    GET  http:\u002F\u002F127.0.0.1:7777\u002Fmetrics\n```\n\n### Tests\n\n```\nnpm test\n```\n\nNode's built-in test runner over `tests\u002F*.test.mjs` (17 cases covering pattern parse, AoB scan, Shannon, string extraction, crypto-constant ID, signature make, PE parse, WASM parse, ELF rejection).\n\nCI runs on push + PR (Node 18\u002F20\u002F22 matrix): [.github\u002Fworkflows\u002Fci.yml](.github\u002Fworkflows\u002Fci.yml).\n\n---\n\n## Installation\n\n### Requirements\n\n- Node.js 18+\n- npm\n\n### Build\n\n```bash\ncd mcp-reverse\nnpm install\nnpm run build\n```\n\n### Connect to Claude Code\n\nAdd to your MCP settings:\n\n```json\n{\n  \"mcpServers\": {\n    \"gamehacking\": {\n      \"command\": \"node\",\n      \"args\": [\"\u002Fpath\u002Fto\u002Fmcp-reverse\u002Fdist\u002Findex.js\"]\n    }\n  }\n}\n```\n\n### Connect to Claude Desktop\n\nAdd to `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"gamehacking\": {\n      \"command\": \"node\",\n      \"args\": [\"\u002Fpath\u002Fto\u002Fmcp-reverse\u002Fdist\u002Findex.js\"]\n    }\n  }\n}\n```\n\n### Connect to Cursor\n\nAdd to `.cursor\u002Fmcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"gamehacking\": {\n      \"command\": \"node\",\n      \"args\": [\"\u002Fpath\u002Fto\u002Fmcp-reverse\u002Fdist\u002Findex.js\"]\n    }\n  }\n}\n```\n\n---\n\n## Usage Examples\n\n### Research a technique\n\n```\n> research_technique(\"EPT hook\")\n\nFound 12 relevant skills (showing top 10):\n- ags-budget-ept (score:7) -- BudgetEPT: stealthy inline EPT-like hooks...\n- ags-hyper-deceit (score:6) -- HyperDeceit: HvcallCodeVa hook framework...\n```\n\n### Analyze a project\n\n```\n> analyze_project(\"ags-kdmapper\", focus=\"architecture\")\n\n# kdmapper\nMost popular kernel driver mapper using iqvw64e.sys...\n## Source Code (first 300 lines)\n...\n```\n\n### Search skills\n\n```\n> search_skills(\"valorant vanguard bypass\")\n\nFound 23 skills:\n- vgk-internals-callbacks (score:7)\n- ags-valorant-external (score:4)\n```\n\n### Agent briefing\n\n```\n> get_agent_briefing(\"exploit-developer\")\n\n# Agent: exploit-developer\nKernel exploit and driver development agent...\n## Available Subagents: offset-finder, detection-assessor\n## Available Plugins: game-offset-db, technique-finder\n```\n\n---\n\n## Project Structure\n\n```\nmcp-reverse\u002F\n+-- src\u002Findex.ts              # MCP server (16 tools)\n+-- dist\u002F                      # Compiled JS\n+-- skills\u002F                    # 4,161 skill directories\n|   +-- \u003Chand-written>\u002F        #   177 curated deep-dive skills\n|   +-- ags-*\u002F                 #   3,985 archived projects\n|       +-- SKILL.md           #     description + metadata\n|       +-- source.txt         #     full source tree snapshot\n+-- agents\u002F                    # 75 agents across 7 categories\n|   +-- games\u002F        (15)     #   CS2, Valorant, Fortnite, Apex, etc.\n|   +-- engines\u002F      (10)     #   UE4\u002F5, Unity, Source, CryEngine, etc.\n|   +-- anti-cheat\u002F   (10)     #   EAC, BE, Vanguard, FACEIT, Byfron, etc.\n|   +-- kernel\u002F       (10)     #   drivers, HV, firmware, DMA, EPT\n|   +-- techniques\u002F   (10)     #   injection, hooking, obfuscation, etc.\n|   +-- tools\u002F        (10)     #   IDA, Ghidra, WinDbg, Frida, x64dbg\n|   +-- core\u002F         (10)     #   RE, exploits, cheatdev, malware, etc.\n+-- subagents\u002F                 # 161 subagents across 16 categories\n|   +-- offsets\u002F      (10)     +-- patterns\u002F     (10)\n|   +-- code-analysis\u002F(10)     +-- anti-cheat\u002F   (11)\n|   +-- kernel\u002F       (10)     +-- injection\u002F    (10)\n|   +-- hooks\u002F        (10)     +-- rendering\u002F    (10)\n|   +-- memory\u002F       (10)     +-- network\u002F      (10)\n|   +-- game-data\u002F    (10)     +-- stealth\u002F      (10)\n|   +-- reversing\u002F    (10)     +-- platform\u002F     (10)\n|   +-- build\u002F        (10)     +-- testing\u002F      (10)\n+-- plugins\u002F                   # 114 plugins across 11 categories\n|   +-- game-offsets\u002F (11)     +-- engine-sdks\u002F  (10)\n|   +-- anti-cheat\u002F   (10)     +-- windows-int\u002F  (10)\n|   +-- technique-ref\u002F(13)     +-- tool-finders\u002F (10)\n|   +-- code-gen\u002F     (10)     +-- binary-anal\u002F  (10)\n|   +-- crypto\u002F       (10)     +-- detection\u002F    (10)\n|   +-- rendering\u002F    (10)\n+-- prompts\u002F                   # 148 prompts across 14 categories\n|   +-- build\u002F        (11)     +-- write\u002F        (16)\n|   +-- implement\u002F    (11)     +-- reverse\u002F      (10)\n|   +-- bypass\u002F       (10)     +-- analyze\u002F      (10)\n|   +-- design\u002F       (10)     +-- exploit\u002F      (10)\n|   +-- compare\u002F      (10)     +-- debug\u002F        (10)\n|   +-- generate\u002F     (10)     +-- migrate\u002F      (10)\n|   +-- optimize\u002F     (10)     +-- setup\u002F        (10)\n+-- package.json\n+-- tsconfig.json\n```\n\n---\n\n## Skill Categories\n\n### Hand-Written (177)\n\n| Category | Examples |\n|----------|---------|\n| Kernel \u002F Drivers | kernel-cr3-physmem, kernel-hooks-ssdt, vulnerable-driver-exploits |\n| Injection | reflective-dll, pe-injection-remote, early-bird-apc, threadpool-wait |\n| Anti-Cheat | vanguard (15+ vgk-* skills), battleye, eac, patchguard, hvci |\n| Game Engines | unreal-object-model, source-netvars, world-to-screen, present-hook |\n| Obfuscation | fix-vmp-themida-ollvm, control-flow-flattening, mixed-boolean-arithmetic |\n| UEFI \u002F EFI | efi-driver-bootkit, vgk-secure-boot-spoof |\n| DMA | dma, iommu, iommu-state-verification |\n\n### Archived Projects (3,985)\n\nSourced from [awesome-game-security](https:\u002F\u002Fgithub.com\u002Fgmh5225\u002Fawesome-game-security):\n\n- **60+ games**: CS2, Valorant, Fortnite, Apex, PUBG, Rust, R6, EFT, Overwatch, Genshin, etc.\n- **Techniques**: injection, hooking, DMA\u002FFPGA, driver comm, overlays, kernel exploits\n- **Anti-cheat research**: BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron\n- **Tools**: IDA plugins, Ghidra scripts, debugger extensions, dumpers, unpackers\n- **Platforms**: Windows kernel, Android (Zygisk\u002FKernelSU\u002FMagisk), iOS, Linux\n\n---\n\n## Tech Stack\n\n- **Runtime**: Node.js 18+\n- **Language**: TypeScript\n- **Protocol**: MCP via `@modelcontextprotocol\u002Fsdk`\n- **Transport**: stdio\n\n---\n\n## License\n\nThis project aggregates publicly available research materials and open-source project snapshots for educational and security research purposes.\n\n---\n\n# mcp-reverse (RU)\n\nMCP-сервер для геймхакинга и реверс-инжиниринга. База знаний из **4,100+ скиллов** с полными архивами исходного кода, специализированными агентами и инструментами.\n\n## Возможности\n\n- **177 вручную написанных скиллов** -- инъекции, хуки, ядерные драйверы, внутренности античитов, архитектура ESP\u002Fаимбота\n- **3,985 архивированных проектов** -- полные снимки исходного кода из экосистемы игровой безопасности\n- **75 агентов** (7 категорий) -- по играм (CS2, Valorant, Fortnite, Apex...), движкам (UE, Unity, Source, CryEngine...), античитам (EAC, BE, Vanguard, FACEIT...), ядру (драйверы, HV, DMA, EPT), техникам (инъекции, хуки, обфускация), инструментам (IDA, Ghidra, WinDbg, Frida)\n- **161 субагент** (16 категорий) -- поиск офсетов, анализ кода, паттерны, диффы бинарников, grep по 3985 архивам, планирование хуков, восстановление структур, аудит драйверов, стелс, рендеринг, сеть и ещё 145\n- **114 плагинов** (11 категорий) -- базы офсетов по 10+ играм, справочники SDK, каталог уязвимых драйверов, детект-базы по каждому античиту, генераторы кода, анализаторы бинарников, крипто, рендеринг\n- **148 промптов** (14 категорий) -- байпасс каждого античита, билд ESP\u002Fаимбота\u002Fтриггера, реверс Unity\u002FUE\u002FSource игр, написание драйверов\u002Fинжекторов\u002Fоверлеев, эксплуатация, HWID спуф, миграция, оптимизация, дизайн\n- **16 MCP-инструментов** -- воркфлоу-тулы, скиллы, компоненты\n\n## Установка\n\n```bash\nnpm install\nnpm run build\n```\n\nДобавьте в настройки MCP-клиента:\n\n```json\n{\n  \"mcpServers\": {\n    \"gamehacking\": {\n      \"command\": \"node\",\n      \"args\": [\"\u002Fpath\u002Fto\u002Fmcp-reverse\u002Fdist\u002Findex.js\"]\n    }\n  }\n}\n```\n\n## Категории скиллов\n\n- **Ядро \u002F Драйверы**: CR3, SSDT, уязвимые драйверы, BYOVD\n- **Инъекции**: рефлективная DLL, manual map, APC, thread hijack\n- **Античиты**: Vanguard, BattlEye, EAC, PatchGuard, HVCI\n- **Игровые движки**: Unreal, Source, Unity -- офсеты, нетвары, w2s\n- **Обфускация**: VMProtect, Themida, OLLVM -- распаковка и деобфускация\n- **UEFI \u002F EFI**: буткиты, EFI-маперы, спуф SecureBoot\n- **DMA \u002F FPGA**: прямой доступ к памяти, IOMMU\n- **60+ игр**: CS2, Valorant, Fortnite, Apex, PUBG, Rust, R6, EFT и др.\n\n## Лицензия\n\nПроект агрегирует публично доступные исследовательские материалы и open-source проекты в образовательных целях и для исследований безопасности.",2,"2026-10-31 04:26:37","CREATED_QUERY"]