Capstone

MCP server that exposes Capstone 5.0.7 disassembly framework functionalities as tools and resources, enabling LLMs to perform binary disassembly, reverse engineering, and instruction analysis.

PyPI Python

Install

pip install mcp-capstone

Usage

CLI

mcp-capstone

Python

from mcp_capstone import disasm, get_version

# Get version
version = get_version()
print(f"Capstone {version['major']}.{version['minor']}")

# Disassemble x86-64 code
instructions = disasm("8b440404", arch="x86", mode="64")
for insn in instructions:
    print(f"0x{insn['address']:x}: {insn['mnemonic']} {insn['op_str']}")

Supported Architectures

• x86 (16/32/64-bit)
• ARM (ARM, Thumb, ARM mode)
• AArch64 (ARMv8)
• MIPS (MIPS32/64, MIPS2/3, R6)
• PowerPC (32/64-bit, SPE, QPX)
• RISC-V (RV32/64GC)
• SPARC (V8/V9)
• SystemZ
• M68K (68000-68060)
• M680X (6301/6309/6800/6805/6808/6809/6811/CPU12/HCS08)
• TriCore
• TMS320C64X
• WebAssembly
• XCore
• BPF (Classic/Extended)
• EVM (Ethereum Virtual Machine)

Tools

Tool	Description
get_version	Get Capstone version
check_support	Check architecture support
list_architectures	List all architectures
disasm	Full disassembly with details
disasm_lite	Lightweight disassembly
disasm_quick	Quick disassembly
get_architectures	All architecture constants
get_modes	All mode constants
get_options	All option constants
get_operands	All operand type constants
get_groups	All instruction group constants
get_errors	All error constants

Development

git clone https://github.com/daedalus/mcp-capstone.git
cd mcp-capstone
pip install -e ".[test]"

# run tests
pytest

# format
ruff format src/ tests/

# lint
ruff check src/ tests/

# type check
mypy src/

mcp-name: io.github.daedalus/mcp-capstone