An MCP (Model Context Protocol) server based on the Capstone disassembly engine, providing binary analysis capabilities for large language models.
{
"mcpServers": {
"capstone-mcp-server": {
"command": "<see-readme>",
"args": []
}
}
}No install config available. Check the server's README for setup instructions.
Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
An MCP (Model Context Protocol) server based on the Capstone disassembly engine, providing binary analysis capabilities for large language models.
Is it safe?
No package registry to scan.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 41 days ago. 6 stars.
Will it work with my client?
Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
No automated test available for this server. Check the GitHub README for setup instructions.
No known vulnerabilities.
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationHave you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Dynamic problem-solving through sequential thought chains
A Model Context Protocol server for searching and analyzing arXiv papers
An open-source AI agent that brings the power of Gemini directly into your terminal.
The official Python SDK for Model Context Protocol servers and clients
MCP Security Weekly
Get CVE alerts and security updates for Capstone Mcp Server and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
中文 | English
基于 Capstone 反汇编引擎的 MCP (Model Context Protocol) 服务器,为大语言模型提供二进制分析能力。
| 工具 | 说明 |
|------|------|
| list_supported_architectures | 列出所有支持的 CPU 架构 |
| disassemble_hex | 反汇编十六进制字节串 |
| disassemble_file_section | 反汇编二进制文件的指定区段 |
| disassemble_at_address | 反汇编文件中指定虚拟地址处的代码 |
| disassemble_entrypoint | 反汇编二进制文件入口点 |
| disassemble_raw_offset | 反汇编文件偏移处的原始字节 |
| get_binary_info | 获取二进制文件元信息(格式、架构、区段、导入/导出) |
| search_instructions | 在 hex 字节串中搜索指令模式 |
| search_instructions_in_file | 在二进制文件中搜索指令模式 |
| analyze_code_flow | 对机器码进行控制流分析 |
| find_xrefs_hex | 在 hex 字节串中搜索对目标地址的交叉引用 |
| find_xrefs_in_file | 在二进制文件中搜索对目标地址的交叉引用 |
| 工具 | 说明 | CTF 场景 |
|------|------|----------|
| find_rop_gadgets_hex | 在 hex 字节串中搜索 ROP gadgets | Pwn - ROP 链构造 |
| find_rop_gadgets_in_file | 在二进制文件中搜索 ROP gadgets | Pwn - ROP 链构造 |
| extract_strings_from_file | 提取可读字符串(类似 strings) | RE / Misc / Forensics |
| xor_brute_force | 单字节 XOR 暴力破解 | Crypto / RE |
| xor_encode_decode | 指定密钥 XOR 编解码 | Crypto / RE |
| buffer_overflow_pattern | 生成/查找缓冲区溢出 pattern(De Bruijn) | Pwn - 偏移计算 |
| check_security | 检测安全特性(类似 checksec) | Pwn - 漏洞利用前置 |
| analyze_plt_got_table | 分析 ELF PLT/GOT 或 PE IAT 表 | Pwn - GOT overwrite |
| hex_dump_file | 十六进制转储查看文件内容 | RE / Forensics |
| detect_crypto_in_file | 检测加密算法常量(AES/SHA/MD5/TEA 等) | Crypto / RE |
| analyze_shellcode_hex | Shellcode 综合分析(模式检测+统计) | Pwn / RE |
| syscall_lookup | Linux 系统调用查找(按编号或名称) | Pwn / RE |
| syscall_list | 列出平台全部系统调用表 | Pwn / RE |
# 克隆项目
git clone <repo-url>
cd capstone-mcp-server
# 安装依赖
pip install -e .
capstone-mcp
python -m capstone_mcp.server
mcp dev src/capstone_mcp/server.py
在 MCP 配置文件中添加:
{
"mcpServers": {
"capstone-disasm": {
"command": "python",
"args": ["-m", "capstone_mcp.server"],
"cwd": "/path/to/capstone-mcp-server"
}
}
}
或者使用 uv 运行:
{
"mcpServers": {
"capstone-disasm": {
"command": "uv",
"args": ["run", "--directory", "/path/to/capstone-mcp-server", "capstone-mcp"]
}
}
}
大模型可调用 disassemble_hex 工具:
输入: hex_code="554889e54883ec10c745fc00000000b8000000004883c4105dc3", arch="x86_64"
输出:
Architecture: x86_64
Base Address: 0x0
Input Size: 25 bytes
────────────────────────────────────────────────────────────────
0x00000000: 55 push rbp
0x00000001: 4889e5 mov rbp, rsp
0x00000004: 4883ec10 sub rsp, 0x10
0x00000008: c745fc00000000 mov dword ptr [rbp - 4], 0
0x0000000f: b800000000 mov eax, 0
0x00000014: 4883c410 add rsp, 0x10
0x00000018: 5d pop rbp
0x00000019: c3 ret
1. 调用 get_binary_info("C:/path/to/program.exe") → 获取文件概要
2. 调用 disassemble_ent
... [View full README on GitHub](https://github.com/Tokeii0/capstone-mcp-server#readme)