Open-ReverseLab — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track analyzer and lab-tool coverage with attention to target isolation

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Security researchers and reverse engineers

What we know

Open-source reverse-engineering lab with a large MCP tool surface for binary, Android, web and CTF workflows.

Maintenance / activity evidence

Observed Sep 29, 2026 (UTC)fix(desktop): resolve TokenRhythm CSRF INVALID in proxy and redesign …

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Local samples, binaries and configured reverse-engineering tools. Writes: Security tooling may execute analyses/payloads.
Not stated for local use.
Sensitive access: Malware samples, Binaries, Exploit artifacts

Run in isolated environments because the tool surface can handle executable samples and offensive-security artifacts.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,221 repository stars

Stars observed Oct 6, 2026.

No canonical package metric applied.

All limitations / Review context

Which binary-analysis tools and scope controls does the current MCP lab provide?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Run in isolated environments because the tool surface can handle executable samples and offensive-security artifacts.
Local samples, binaries and configured reverse-engineering tools.
Not stated for local use.
Processes local samples and writes reports/artifacts.
Reviewed write actions: Security tooling may execute analyses/payloads
Sensitive access: Malware samples, Binaries, Exploit artifacts
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Exact MCP invocation/auth
External-data-flow details
Optional boards may include exploit samples/payload docs.
Toolchain is modular/platform dependent.

Original activity observations

2026-09-29T15:34:45Z: fix(desktop): resolve TokenRhythm CSRF INVALID in proxy and redesign …

Technical identity

github.com/ling71671/open-reverselab

Exact implementation source: https://github.com/ling71671/open-reverselab ↗
Reviewed resource type: MCP Server
Repository identity: LING71671/open-reverselab

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
ling71671/open-reverselab
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

workspace

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Open ReverseLab is a full reverse-engineering workspace with an optional MCP tool surface; install only chosen tool boards.
Clone Open-ReverseLab, run its first-run PowerShell setup and explicitly select desired tool boards; connect generated MCP entry. This is a workstation toolkit, not a one-command hosted MCP.
Configure / authenticate
Publisher instructions
Open-ReverseLab is a broad reverse-engineering lab/tool suite. Official START_HERE script performs installs and writes reports, so treat as explicit local onboarding, not a read-only health check.
Check connection
Suggested check
Use publisher ai_toolcheck --board misc / lab_healthcheck on an isolated environment only.
Remove / uninstall / revoke
Suggested check
Remove specifically generated reverse-lab MCP connection(s) from the AI client configuration; optional board dependencies installed by individual scripts must be removed separately. Do not erase workspace samples and findings.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.

Official Documentation & Sources

What it does

Open-source reverse-engineering lab with a large MCP tool surface for binary, Android, web and CTF workflows.

Capability: Security & Testing
Resource type: MCP Server
Industry: Cybersecurity
Best fit: Security researchers and reverse engineers

Representative uses

Sample triage and binary analysis
Use Frida/Ghidra/Rizin/YARA wrappers
Route work through knowledge boards
Generate reports

Limitations

Optional boards may include exploit samples/payload docs.
Toolchain is modular/platform dependent.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not stated for local use.
Permissions: Local samples, binaries and configured reverse-engineering tools.
Data handling: Processes local samples and writes reports/artifacts.
Cost: free
Risk and cautions: Run in isolated environments because the tool surface can handle executable samples and offensive-security artifacts.

Access scope and cautions

Write actions: Security tooling may execute analyses/payloads
Sensitive access: Malware samples Binaries Exploit artifacts
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Sample triage and binary analysis; Use Frida/Ghidra/Rizin/YARA wrappers; Route work through knowledge boards; Generate reports.

What authentication is documented?

Local MCP; exact auth not stated.

Can it modify data or perform write operations?

Documented write actions include: Security tooling may execute analyses/payloads. Recorded permission boundary: Local samples, binaries and configured reverse-engineering tools.

What data-handling boundary should I consider?

Processes local samples and writes reports/artifacts. Recorded sensitive-access context: Malware samples; Binaries; Exploit artifacts.

What limitations and risks should I check before use?

Run in isolated environments because the tool surface can handle executable samples and offensive-security artifacts. Optional boards may include exploit samples/payload docs. Toolchain is modular/platform dependent. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

LING71671 is listed as Community implementation in MCP100’s current evidence.