Styx

冥河。二进制是彼岸，逆向是渡河。

MCP stdio server exposing 7 reverse-engineering tools for LLM agents (hermes-agent, Claude Desktop, etc.).

Tools

Tool	Description	Dependency
hexdump	Hex dump + magic detection + Shannon entropy	(stdlib)
disasm	Capstone linear disassembly + function boundary detection	capstone
strings	Multi-encoding (ASCII/UTF-16LE/UTF-8) string extraction + classification	(stdlib)
xref	Cross-reference analysis: call-graph overview + per-address callers/callees/string refs	capstone
ghidra	Ghidra headless decompiler — C pseudocode	Ghidra binary
angr	Symbolic execution: CFG extraction / explore / avoid	angr (optional)
deobfuscate	OLLVM control-flow flattening recovery via PyGhidra	pyghidra (optional)

Install

# Minimal — hexdump, disasm, strings, xref
pip install styx-mcp

# With angr
pip install styx-mcp[angr]

# With PyGhidra (deobfuscate)
pip install styx-mcp[pyghidra]

# Everything
pip install styx-mcp[all]

Ghidra tool requires Ghidra headless: pacman -S ghidra (Arch) or download from ghidra-sre.org.

Usage

hermes-agent

# config.yaml
mcp_servers:
  styx:
    command: ["python", "-m", "styx.mcp_server"]

Claude Desktop

{
  "mcpServers": {
    "styx": {
      "command": "python",
      "args": ["-m", "styx.mcp_server"]
    }
  }
}

Standalone

python -m styx.mcp_server

Python API

from styx.tools.hexdump import hexdump
from styx.pipeline import run_pipeline

result = hexdump("/bin/ls")
print(result["output"])

# Batch pipeline
result = run_pipeline("/bin/ls", ["hexdump", "disasm", "strings", "xref"])

Protocol

JSON-RPC 2.0 over stdin/stdout (MCP stdio transport). Each tool returns:

{
  "success": true,
  "error": null,
  "output": "...",
  "discovered_nodes": [],
  "discovered_edges": [],
  "hypothesis_updates": []
}

License

MIT