mcp-capstone

MCP server that exposes Capstone 5.0.7 disassembly framework functionalities as tools and resources, enabling LLMs to perform binary disassembly, reverse engineering, and instruction analysis.

 

Install

pip install mcp-capstone

Usage

CLI

mcp-capstone

Python

from mcp_capstone import disasm, get_version

# Get version
version = get_version()
print(f"Capstone {version['major']}.{version['minor']}")

# Disassemble x86-64 code
instructions = disasm("8b440404", arch="x86", mode="64")
for insn in instructions:
    print(f"0x{insn['address']:x}: {insn['mnemonic']} {insn['op_str']}")

Supported Architectures

• x86 (16/32/64-bit)
• ARM (ARM, Thumb, ARM mode)
• AArch64 (ARMv8)
• MIPS (MIPS32/64, MIPS2/3, R6)
• PowerPC (32/64-bit, SPE, QPX)
• RISC-V (RV32/64GC)
• SPARC (V8/V9)
• SystemZ
• M68K (68000-68060)
• M680X (6301/6309/6800/6805/6808/6809/6811/CPU12/HCS08)
• TriCore
• TMS320C64X
• WebAssembly
• XCore
• BPF (Classic/Extended)
• EVM (Ethereum Virtual Machine)

Tools

| Tool | Description | |------|-------------| | get_version | Get Capstone version | | check_support | Check architecture support | | list_architectures | List all architectures | | disasm | Full disassembly with details | | disasm_lite | Lightweight disassembly | | disasm_quick | Quick disassembly | | get_architectures | All architecture constants | | get_modes | All mode constants | | get_options | All option constants | | get_operands | All operand type constants | | get_groups | All instruction group constants | | get_errors | All error constants |

Development

git clone https://github.com/daedalus/mcp-capstone.git
cd mcp-capstone
pip install -e ".[test]"

# run tests
pytest

# format
ruff format src/ tests/

# lint
ruff check src/ tests/

# type check
mypy src/

mcp-name: io.github.daedalus/mcp-capstone