mcp-capstone
MCP server that exposes Capstone 5.0.7 disassembly framework functionalities as tools and resources, enabling LLMs to perform binary disassembly, reverse engineering, and instruction analysis.
Install
pip install mcp-capstone
Usage
CLI
mcp-capstone
Python
from mcp_capstone import disasm, get_version
# Get version
version = get_version()
print(f"Capstone {version['major']}.{version['minor']}")
# Disassemble x86-64 code
instructions = disasm("8b440404", arch="x86", mode="64")
for insn in instructions:
print(f"0x{insn['address']:x}: {insn['mnemonic']} {insn['op_str']}")
Supported Architectures
- x86 (16/32/64-bit)
- ARM (ARM, Thumb, ARM mode)
- AArch64 (ARMv8)
- MIPS (MIPS32/64, MIPS2/3, R6)
- PowerPC (32/64-bit, SPE, QPX)
- RISC-V (RV32/64GC)
- SPARC (V8/V9)
- SystemZ
- M68K (68000-68060)
- M680X (6301/6309/6800/6805/6808/6809/6811/CPU12/HCS08)
- TriCore
- TMS320C64X
- WebAssembly
- XCore
- BPF (Classic/Extended)
- EVM (Ethereum Virtual Machine)
Tools
| Tool | Description |
|---|---|
get_version | Get Capstone version |
check_support | Check architecture support |
list_architectures | List all architectures |
disasm | Full disassembly with details |
disasm_lite | Lightweight disassembly |
disasm_quick | Quick disassembly |
get_architectures | All architecture constants |
get_modes | All mode constants |
get_options | All option constants |
get_operands | All operand type constants |
get_groups | All instruction group constants |
get_errors | All error constants |
Development
git clone https://github.com/daedalus/mcp-capstone.git
cd mcp-capstone
pip install -e ".[test]"
# run tests
pytest
# format
ruff format src/ tests/
# lint
ruff check src/ tests/
# type check
mypy src/
mcp-name: io.github.daedalus/mcp-capstone