mcp-capstone

MCP server that exposes Capstone 5.0.7 disassembly framework functionalities as tools and resources, enabling LLMs to perform binary disassembly, reverse engineering, and instruction analysis.

Install

pip install mcp-capstone

Usage

CLI

mcp-capstone

Python

from mcp_capstone import disasm, get_version

# Get version
version = get_version()
print(f"Capstone {version['major']}.{version['minor']}")

# Disassemble x86-64 code
instructions = disasm("8b440404", arch="x86", mode="64")
for insn in instructions:
    print(f"0x{insn['address']:x}: {insn['mnemonic']} {insn['op_str']}")

Supported Architectures

• x86 (16/32/64-bit)
• ARM (ARM, Thumb, ARM mode)
• AArch64 (ARMv8)
• MIPS (MIPS32/64, MIPS2/3, R6)
• PowerPC (32/64-bit, SPE, QPX)
• RISC-V (RV32/64GC)
• SPARC (V8/V9)
• SystemZ
• M68K (68000-68060)
• M680X (6301/6309/6800/6805/6808/6809/6811/CPU12/HCS08)
• TriCore
• TMS320C64X
• WebAssembly
• XCore
• BPF (Classic/Extended)
• EVM (Ethereum Virtual Machine)

Tools

Tool	Description
get_version	Get Capstone version
check_support	Check architecture support
list_architectures	List all architectures
disasm	Full disassembly with details
disasm_lite	Lightweight disassembly
disasm_quick	Quick disassembly
get_architectures	All architecture constants
get_modes	All mode constants
get_options	All option constants
get_operands	All operand type constants
get_groups	All instruction group constants
get_errors	All error constants

Development

git clone https://github.com/daedalus/mcp-capstone.git
cd mcp-capstone
pip install -e ".[test]"

# run tests
pytest

# format
ruff format src/ tests/

# lint
ruff check src/ tests/

# type check
mypy src/

mcp-name: io.github.daedalus/mcp-capstone