---

Why this exists

Reverse engineering a modern game involves five static tools (Ghidra, IDA, Binary Ninja, radare2, Hopper), three debuggers (x64dbg, WinDbg, GDB/LLDB), a hex-editor, a memory scanner (Cheat Engine), an instrumentation framework (Frida), and a stack of format parsers (PE, ELF, Mach-O, DEX, Minidump, Unity AssetBundle, UE .pak). Switching between them costs hours. Teaching a model to drive even one of them well costs more.

This server:

1. Aggregates 59 existing RE / debug MCP backends behind one connection — smart_decompile picks IDA when running, falls back to Ghidra, then Binja, then RetDec.
2. Ships 111 native MCP tools so most answers don’t need an external backend at all — PE / ELF / Mach-O / DEX / WASM / Minidump / ZIP / .NET / IL2CPP metadata parsers, AoB signature scan, Shannon entropy, crypto-constant identification, PDB70 → Microsoft symbol server URL.
3. Lets Claude, Codex, and Cursor collaborate through a shared mesh — DM, channels, task handoff, adversarial voting, shared KV knowledge-base, named locks for coordination. Zero-dep JSON persistence.
4. Curates 4,200+ skills — 246 hand-written deep references on anti-cheat (BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron, Ricochet, mhyprot) and 3,985 archived open-source projects with full source dumps.

If you’re on security-research, cheat-detection, defensive-engineering, or game-SDK work — this collapses a day of tool-shuffling into one MCP connection.

30-second quickstart

# clone + build
git clone https://github.com/1llu50ry/mcp-reverse && cd mcp-reverse
npm install && npx tsc
npm test            # 20/20 should pass

# wire into Claude Code / Codex / Cursor (stdio mode)
# (add this JSON to your client's MCP config)
#   { "mcp-reverse": { "command": "node", "args": ["/path/to/dist/index.js"] } }

# OR run over HTTP (Docker-friendly)
docker compose up

# OR drive it from the CLI (no MCP client needed)
./bin/mcp-reverse.mjs stats
./bin/mcp-reverse.mjs search battleye
./bin/mcp-reverse.mjs tools    # list every registered MCP tool

Point your MCP client at it, then ask any of:

• “Analyze C:\game\binary.exe and tell me what packer it uses.” → calls analyze_binary (entropy + Rich Header + Debug Directory + imports + crypto constants)
• “Decompile 0x401000 using every connected backend and spot disagreements.” → hub_consensus_call matcher=decompile
• “Alice, hand off driver.sys unpacking to Bob; Cursor review the result.” → mesh orchestration
• “BM25 search ‘battleye shellcode detection’.” → bm25_search ranks 4,230 docs by BM25 relevance

Architecture

flowchart LR
  subgraph clients[" MCP clients "]
    C1[Claude Code]
    C2[Codex / ChatGPT]
    C3[Cursor]
    C4[Copilot CLI]
    C5[custom]
  end

  subgraph server[" mcp-reverse (this repo) "]
    direction TB
    T[111 MCP tools]
    M[Agent MeshDM · channels · tasks · votes · KB · locks]
    H[MCP Hubsmart_decompile · consensus_call]
    N[Native parsersPE · ELF · Mach-O · DEX · WASM · Minidump · ZIP · .NET]
    S[Skill library4,200+ docs · BM25]
  end

  subgraph backends[" 59 RE / debug MCP backends "]
    B1[Ghidra · IDA · Binja]
    B2[x64dbg · WinDbg · GDB · LLDB]
    B3[Cheat Engine · Frida]
    B4[PCILeech · Memflow]
    B5[Volatility · YARA · angr]
  end

  C1 & C2 & C3 & C4 & C5 -->|stdio or HTTP| server
  server -->|hub_connect| B1 & B2 & B3 & B4 & B5

Verticals

The game-hacking framing is historical — the tooling covers every RE discipline:

Comparison

Ethics & responsible use

This project exists for security research, cheat detection, defensive engineering, game-preservation, and reverse-engineering education. Specifically:

• Anti-cheat engineers use it to understand bypass vectors and harden their systems.
• Red teams use it on binaries they are authorized to analyze.
• Students use it to learn how PE / ELF / IL2CPP / UE4 / Source2 actually work.
• Preservation groups use it to document archived game ecosystems.

It is not a cheat. It writes no code into any game. It automates no play. Use it against binaries you own or are authorized to analyze. Do not use it to grief, de-fraud, or harm other players.

Read SECURITY.md for responsible disclosure. By contributing you agree to CODE_OF_CONDUCT.md.

---

Features

Skill Library

• 177 hand-written skills – deep technical references on injection, hooking, kernel drivers, anti-cheat internals, ESP/aimbot architecture, and more
• 3,985 archived projects – full source code snapshots from the game security ecosystem (prefixed ags-)
• Each skill has a SKILL.md (description, metadata, topics) and optionally a source.txt (complete source tree dump)

Agents

Subagents (161)

Plugins (114)

Prompts (148)

---

Tools (111 total)

Workflow Tools

Skill Tools

Component Tools

RE / Debug MCP Integrations (v4.1)

Launch and drive 43 external RE and debugging MCP servers directly from this server. Supported backends: GhidraMCP, SuperghidraMCP (pyghidra-mcp, +gui), Ghidrathon MCP, ida-pro-mcp, Hex-Rays IDA MCP, Binary Ninja MCP, radare2 MCP, x64dbg MCP Server, WinDbg MCP, Cheat Engine MCP, Frida MCP, Hopper MCP, REA, Vibe-RE, JADX MCP, angr MCP, Capstone MCP, PCILeech/MemProcFS MCP, Memflow MCP, Scylla MCP, dnSpyEx MCP, ReClass.NET MCP, Volatility3 MCP, Wireshark/tshark MCP, mitmproxy MCP, dotPeek MCP, Unicorn MCP, ret-sync MCP, BinDiff MCP, Diaphora MCP, Qiling MCP, unidbg MCP, Reko (OpenReality) MCP, QEMU trace MCP, LLDB MCP, GDB MCP, Burp MCP, YARA MCP, ClrMD MCP, Binja-Ghidra sync MCP, Dolphin DME MCP, Cemu IPC MCP.

Native TypeScript RE Tools (always available)

Zero-dependency Node TypeScript. No Python, no Ghidra, no IDA needed.

Vendored tool trees live under tools/vendor/ (currently vibe-re, ida-pro-mcp). External backends install via install_re_backend or describe_re_backend → “Install” section. tools/launchers/install-all.{ps1,sh} bootstraps every pip/npm backend in one shot.

Advanced Native Parsers

Workflow Tools

Agent Mesh — multi-agent collaboration

Lets Claude Code, Codex/ChatGPT, Cursor, Copilot, Gemini CLI and custom bots share one workspace through MCP: register, DM + channel broadcast, task handoff with status machine, adversarial voting on findings, shared KV knowledge base, named locks. Persistence to JSON (zero npm deps). See docs/agent-mesh.md.

Tools (15): mesh_agent_register, mesh_agent_list, mesh_agent_heartbeat, mesh_send, mesh_read, mesh_task_create, mesh_task_update, mesh_task_list, mesh_task_vote, mesh_kb_set, mesh_kb_get, mesh_lock_acquire, mesh_lock_release, mesh_lock_list, mesh_stats.

MCP Hub — aggregate backend MCPs

Our server connects to other MCPs (ghidra, ida, x64dbg, binja, radare2, cheat-engine, frida, …) as a CLIENT and re-exposes their tools. Composable: smart_decompile picks the first available decompiler backend; hub_consensus_call fans out across backends for adversarial comparison. See docs/mcp-hub.md.

Tools (6): hub_connect, hub_list, hub_call, hub_disconnect, smart_decompile, hub_consensus_call.

CLI

mcp-reverse stats                 # library counts
mcp-reverse lookup battleye       # print SKILL.md
mcp-reverse search anti-cheat     # keyword search
mcp-reverse tools                 # list every MCP tool
mcp-reverse health [url]          # probe /healthz
mcp-reverse serve                 # start the MCP server

Path sandbox (security)

File-reading tools (pe_parse, elf_parse, aob_scan, zip_parse, …) obey MCP_FS_ALLOW and MCP_FS_DENY. Default is open mode. Set MCP_FS_ALLOW=/path/a,/path/b to restrict reads when exposing the server over HTTP.

HTTP transport, health, metrics

Set MCP_TRANSPORT=http to run the server over Streamable HTTP instead of stdio:

MCP_TRANSPORT=http MCP_HTTP_PORT=7777 MCP_HTTP_HOST=127.0.0.1 node dist/index.js
# → MCP endpoint:  POST http://127.0.0.1:7777/mcp
# → readiness:     GET  http://127.0.0.1:7777/healthz
# → Prometheus:    GET  http://127.0.0.1:7777/metrics

Tests

npm test

Node’s built-in test runner over tests/*.test.mjs (17 cases covering pattern parse, AoB scan, Shannon, string extraction, crypto-constant ID, signature make, PE parse, WASM parse, ELF rejection).

CI runs on push + PR (Node 18/20/22 matrix): .github/workflows/ci.yml.

---

Installation

Requirements

• Node.js 18+
• npm

Build

cd mcp-reverse
npm install
npm run build

Connect to Claude Code

Add to your MCP settings:

{
  "mcpServers": {
    "gamehacking": {
      "command": "node",
      "args": ["/path/to/mcp-reverse/dist/index.js"]
    }
  }
}

Connect to Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "gamehacking": {
      "command": "node",
      "args": ["/path/to/mcp-reverse/dist/index.js"]
    }
  }
}

Connect to Cursor

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "gamehacking": {
      "command": "node",
      "args": ["/path/to/mcp-reverse/dist/index.js"]
    }
  }
}

---

Usage Examples

Research a technique

> research_technique("EPT hook")

Found 12 relevant skills (showing top 10):
- ags-budget-ept (score:7) -- BudgetEPT: stealthy inline EPT-like hooks...
- ags-hyper-deceit (score:6) -- HyperDeceit: HvcallCodeVa hook framework...

Analyze a project

> analyze_project("ags-kdmapper", focus="architecture")

# kdmapper
Most popular kernel driver mapper using iqvw64e.sys...
## Source Code (first 300 lines)
...

Search skills

> search_skills("valorant vanguard bypass")

Found 23 skills:
- vgk-internals-callbacks (score:7)
- ags-valorant-external (score:4)

Agent briefing

> get_agent_briefing("exploit-developer")

# Agent: exploit-developer
Kernel exploit and driver development agent...
## Available Subagents: offset-finder, detection-assessor
## Available Plugins: game-offset-db, technique-finder

---

Project Structure

mcp-reverse/
+-- src/index.ts              # MCP server (16 tools)
+-- dist/                      # Compiled JS
+-- skills/                    # 4,161 skill directories
|   +-- /        #   177 curated deep-dive skills
|   +-- ags-*/                 #   3,985 archived projects
|       +-- SKILL.md           #     description + metadata
|       +-- source.txt         #     full source tree snapshot
+-- agents/                    # 75 agents across 7 categories
|   +-- games/        (15)     #   CS2, Valorant, Fortnite, Apex, etc.
|   +-- engines/      (10)     #   UE4/5, Unity, Source, CryEngine, etc.
|   +-- anti-cheat/   (10)     #   EAC, BE, Vanguard, FACEIT, Byfron, etc.
|   +-- kernel/       (10)     #   drivers, HV, firmware, DMA, EPT
|   +-- techniques/   (10)     #   injection, hooking, obfuscation, etc.
|   +-- tools/        (10)     #   IDA, Ghidra, WinDbg, Frida, x64dbg
|   +-- core/         (10)     #   RE, exploits, cheatdev, malware, etc.
+-- subagents/                 # 161 subagents across 16 categories
|   +-- offsets/      (10)     +-- patterns/     (10)
|   +-- code-analysis/(10)     +-- anti-cheat/   (11)
|   +-- kernel/       (10)     +-- injection/    (10)
|   +-- hooks/        (10)     +-- rendering/    (10)
|   +-- memory/       (10)     +-- network/      (10)
|   +-- game-data/    (10)     +-- stealth/      (10)
|   +-- reversing/    (10)     +-- platform/     (10)
|   +-- build/        (10)     +-- testing/      (10)
+-- plugins/                   # 114 plugins across 11 categories
|   +-- game-offsets/ (11)     +-- engine-sdks/  (10)
|   +-- anti-cheat/   (10)     +-- windows-int/  (10)
|   +-- technique-ref/(13)     +-- tool-finders/ (10)
|   +-- code-gen/     (10)     +-- binary-anal/  (10)
|   +-- crypto/       (10)     +-- detection/    (10)
|   +-- rendering/    (10)
+-- prompts/                   # 148 prompts across 14 categories
|   +-- build/        (11)     +-- write/        (16)
|   +-- implement/    (11)     +-- reverse/      (10)
|   +-- bypass/       (10)     +-- analyze/      (10)
|   +-- design/       (10)     +-- exploit/      (10)
|   +-- compare/      (10)     +-- debug/        (10)
|   +-- generate/     (10)     +-- migrate/      (10)
|   +-- optimize/     (10)     +-- setup/        (10)
+-- package.json
+-- tsconfig.json

---

Skill Categories

Hand-Written (177)

Archived Projects (3,985)

Sourced from awesome-game-security:

• 60+ games: CS2, Valorant, Fortnite, Apex, PUBG, Rust, R6, EFT, Overwatch, Genshin, etc.
• Techniques: injection, hooking, DMA/FPGA, driver comm, overlays, kernel exploits
• Anti-cheat research: BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron
• Tools: IDA plugins, Ghidra scripts, debugger extensions, dumpers, unpackers
• Platforms: Windows kernel, Android (Zygisk/KernelSU/Magisk), iOS, Linux

---

Tech Stack

• Runtime: Node.js 18+
• Language: TypeScript
• Protocol: MCP via @modelcontextprotocol/sdk
• Transport: stdio

---

License

This project aggregates publicly available research materials and open-source project snapshots for educational and security research purposes.

---

mcp-reverse (RU)

MCP-сервер для геймхакинга и реверс-инжиниринга. База знаний из 4,100+ скиллов с полными архивами исходного кода, специализированными агентами и инструментами.

Возможности

• 177 вручную написанных скиллов – инъекции, хуки, ядерные драйверы, внутренности античитов, архитектура ESP/аимбота
• 3,985 архивированных проектов – полные снимки исходного кода из экосистемы игровой безопасности
• 75 агентов (7 категорий) – по играм (CS2, Valorant, Fortnite, Apex…), движкам (UE, Unity, Source, CryEngine…), античитам (EAC, BE, Vanguard, FACEIT…), ядру (драйверы, HV, DMA, EPT), техникам (инъекции, хуки, обфускация), инструментам (IDA, Ghidra, WinDbg, Frida)
• 161 субагент (16 категорий) – поиск офсетов, анализ кода, паттерны, диффы бинарников, grep по 3985 архивам, планирование хуков, восстановление структур, аудит драйверов, стелс, рендеринг, сеть и ещё 145
• 114 плагинов (11 категорий) – базы офсетов по 10+ играм, справочники SDK, каталог уязвимых драйверов, детект-базы по каждому античиту, генераторы кода, анализаторы бинарников, крипто, рендеринг
• 148 промптов (14 категорий) – байпасс каждого античита, билд ESP/аимбота/триггера, реверс Unity/UE/Source игр, написание драйверов/инжекторов/оверлеев, эксплуатация, HWID спуф, миграция, оптимизация, дизайн
• 16 MCP-инструментов – воркфлоу-тулы, скиллы, компоненты

Установка

npm install
npm run build

Добавьте в настройки MCP-клиента:

{
  "mcpServers": {
    "gamehacking": {
      "command": "node",
      "args": ["/path/to/mcp-reverse/dist/index.js"]
    }
  }
}

Категории скиллов

• Ядро / Драйверы: CR3, SSDT, уязвимые драйверы, BYOVD
• Инъекции: рефлективная DLL, manual map, APC, thread hijack
• Античиты: Vanguard, BattlEye, EAC, PatchGuard, HVCI
• Игровые движки: Unreal, Source, Unity – офсеты, нетвары, w2s
• Обфускация: VMProtect, Themida, OLLVM – распаковка и деобфускация
• UEFI / EFI: буткиты, EFI-маперы, спуф SecureBoot
• DMA / FPGA: прямой доступ к памяти, IOMMU
• 60+ игр: CS2, Valorant, Fortnite, Apex, PUBG, Rust, R6, EFT и др.

Лицензия

Проект агрегирует публично доступные исследовательские материалы и open-source проекты в образовательных целях и для исследований безопасности.