cervonwong

MARE MCP Toolbox — Development skill for Claude Code

Development community

Agentic malware analysis environment with MCP-connected disassemblers, RE tooling, and structured workflows for Claude Code and Codex CLI.

How to install MARE MCP Toolbox

This entry records only its repository, not the path inside it, so there is no exact command to give. Open cervonwong/MARE-MCP-Toolbox and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What MARE MCP Toolbox does

Agentic malware analysis environment with MCP-connected disassemblers, RE tooling, and structured workflows for Claude Code and Codex CLI.

Alternatives in Development

OpenAI Codex CLI — (Rust implementation) 67.8k ★
Tempest — Agentic Engineering that actually scales 161 ★
Damon Ade — ADE — an agentic development environment for macOS 95 ★

README

MARE-MCP-Toolbox

Agentic malware analysis on a Kali Linux Docker container with 50+ reverse engineering tools and three disassembler backends (IDA Pro, Binary Ninja, Ghidra), exposed both to in-container agents AND to external MCP clients.

The gateway ships **54 curated MCP tools** by default (61 with dynamic mode enabled, +1 with the env-gated unsafe r2 tool) on top of the active disassembler's native MCP surface, over Streamable HTTP with bearer auth.

Two ways to use this

Mode	Who's running	When to use	Entrypoint
Local	Claude Code or Codex inside the container	Hands-on triage from a single workstation; the agent has full filesystem + tool access	`./run_docker.sh`
Remote	Claude Code on the host, mastra.ai agents, or any MCP client outside the container	Multi-client / fleet workflows; CI; integration into your own agent framework	`./run_docker.sh --remote`

Both modes can run from the same image. Local agents talk to the disassembler MCP backends directly over stdio/SSE; remote clients talk to the gateway over Streamable HTTP with bearer auth. Dynamic-analysis tools (strace, ltrace, qemu-user, gdb sessions) are an MCP-only surface enabled via `./run_docker.sh --remote --dynamic`.

Prerequisites

Docker + Docker Compose v2
Optional: binaryninja.zip and/or idapro.zip in the repo root for paid disassembler backends (auto-detected at build)
For remote mode: a host port reachable by your MCP client (default 8080)
For the mastra.ai starter: Node.js 20+
For dynamic mode: host kernel.yama.ptrace_scope <= 1; for foreign-arch samples, host-side binfmt registration via docker run --rm --privileged multiarch/qemu-user-static --reset -p yes

Quick start — local mode

The default `./run_docker.sh` invocation builds the image (if needed) and drops you into an interactive Kali shell. Claude Code and Codex are pre-wired to the disassembler backend via `.