Open-ReverseLab Puts Reverse-Engineering Knowledge and 100+ MCP Tools in One Workspace

Use this Skill when a user wants a "ready to run" reverse engineering workspace rather than just a tutorial. The underlying project is the open-source Open-ReverseLab (GPL-3.0): an executable knowledge base plus an MCP toolbox. The 180+ articles are grouped by attack surface into 5 boards (Web, Android, Windows PE, General, and Windows platform-specific). Each article follows the structure "scenario → input signals → method → attack chain → MCP tool mapping", and the project exposes 100+ MCP tools via reverse_lab_tools (Ghidra, Frida, Rizin, YARA, etc.).

Triggers

Use it when the user says things like "set up a reverse engineering lab", "analyze this sample with Ghidra / Frida", "produce a complete sample analysis report", or "I want the existing knowledge base for CTF Web, APK, or PE challenges".

Hard Rules

1. Only analyze your own targets, or targets you have explicit authorization for. If the scope of authorization is unclear, stop and ask the user before doing anything.
2. Do not scan, attack, bypass paid access or access controls, or perform denial of service against live systems. Read-only and local analysis come first.
3. Tell the user before installing anything or changing configuration. Proceed only after they agree.
4. Sort conclusions into three categories: what you directly observed (with file and location), what you inferred, and what you did not find (write "unknown", not "does not exist").
5. Do not output or log the full contents of any keys or tokens found. Report only where they are.
6. Use only on your own samples, lab targets, CTFs, and targets you are authorized to test. The knowledge base and tools in the repository include exploit samples and payload documentation, which are for authorized testing only.
7. Install tools by board, not all at once. If you are only doing Web CTF, do not install PE tools.
8. Antivirus software may raise alerts. Exploit samples and payload documentation in the repository will be falsely flagged; this is expected. The README recommends only minimal exclusions for specific paths, not excluding the whole repository. Ask the user before changing antivirus settings.
9. After changing machines or updating configuration, run a real MCP smoke test.
10. Before use, make sure the user knows the project is GPL-3.0, which affects the license that applies when you bring its content into your own project.

Installation

Clone into a dedicated directory, then:

• First-run check: On Windows, double-click START_HERE.bat; on macOS / Linux, run ./START_HERE.sh. It checks Python, uv, Git, and the MCP service, and writes a first-run report and a smoke test report.
• Install tools by board:

.\scripts\misc\bootstrap.ps1                  # core script wrapper, no downloads
.\scripts\misc\install_tools.ps1 -Android     # APK tools
.\scripts\misc\install_tools.ps1 -Common      # Ghidra + Maven

./scripts/misc/bootstrap.sh
export PATH="$PWD/tools/bin:$PWD/tools/ctf-website/bin:$PATH"
python scripts/misc/ai_toolcheck.py --board misc     # verify core

• Agent use: Start Claude Code in the cloned directory, or open the folder directly with Codex. To start a new task: python scripts/misc/new_task.py --board <board> --name <task name>. To verify that MCP is actually callable:

uv run --project tools/skills/mcp/ReverseLabToolsMCP python scripts/misc/mcp_smoke_check.py --write-report

Context Loading Order

CLAUDE.md → AGENTS.md → AI-USAGE.md → boards/<board>/AI-USAGE.md

When the project is first opened, the agent follows the protocol in AGENTS.md to check the local environment (OS, toolchain, devices, and sanitized environment variables), caching the results at ~/.open-reverselab/env/env.md. It does not re-probe for 7 days. For key variables, it records only "set".

Directory Conventions

Each type of artifact has a fixed location: samples/, exports/, patches/, kb/, and reports/. Put samples in, follow the attack chain, and produce the report at the end.

Output Format

1. Which board was used and which MCP tools.
2. Evidence chain: from input signals to each step's conclusion.
3. The report is written to reports/, with the path stated.