Rogue Binary MCP

Death to Malware.

rbinmcp is Rogue Binary Model Context Protocol (MCP): a Docker-packaged binary analysis lab that AI agents can call as tools. It is built for reverse engineering, malware triage, and artifact comparison, with compact responses that let an agent start cheap and ask for heavier evidence only when it needs it.

Instead of asking an agent to juggle local installs of radare2, Ghidra, ILSpy, binutils, and helper scripts, rbinmcp ships them together behind one MCP server. The tools are shaped for investigation: quick triage first, then focused r2, Ghidra, ILSpy, native, and Rust-backed views.

Public documentation: Rogue Binary Wiki

Contents

• Why Use It
• Quick Start
• Add It To Your Agent
• Use The Tools
• How It Works
• First Analysis
• What It Can Analyze
• Common Workflows
• Tool Map
• Cache And Paths
• Local Development

Why Use It

• Give agents one repeatable binary analysis runtime through Docker.
• Keep large reverse-engineering outputs bounded and searchable.
• Move from a first-pass triage result into the exact backend view that answers the next question.
• Reuse cache-backed Ghidra imports, r2 sessions, and overflow files across runs.
• Inspect native PE, ELF, Mach-O, firmware-like blobs, binary diffs, and managed .NET assemblies from the same MCP surface.

Quick Start

Rogue Binary MCP runs through Docker, but you do not need to learn Docker to use it. Docker is just how your AI app starts the analysis server.

1. Make sure Docker is installed and running.
2. Add Rogue Binary MCP to your AI agent as an MCP server.
3. Ask your agent to use the rbinmcp tools.

The registry name is:

io.github.kirkderp/rbinmcp

The Docker image is:

ghcr.io/kirkderp/rbinmcp:1.1.0

Optional check that Docker can fetch the image:

docker pull ghcr.io/kirkderp/rbinmcp:1.1.0

Optional check that the image starts:

docker run --rm ghcr.io/kirkderp/rbinmcp:1.1.0 --version

Add It To Your Agent

If your AI app supports the MCP registry, add:

io.github.kirkderp/rbinmcp

Some clients still ask for a command and arguments. In that case, use Docker as the MCP server launcher. Replace /absolute/path/to/samples with the folder that contains the files you want the agent to analyze.

Mounts used below:

Claude Code

claude mcp add rbinmcp -- \
  docker run --rm -i \
  -v /absolute/path/to/samples:/samples:ro \
  -v rbinmcp-cache:/cache/rbinmcp \
  ghcr.io/kirkderp/rbinmcp:1.1.0

Then run /mcp in Claude Code and confirm rbinmcp is connected.

Claude Desktop And JSON MCP Clients

Add this to your MCP server c

... View full README on GitHub