Rekit
Perform safe, read-only static analysis and reverse engineering on binaries, firmware, APKs, PCAPs, and scripts via CLI or MCP.
Rekit is a read-only reverse-engineering toolkit and MCP server designed to provide security analysts and AI agents with a unified, safe interface for static analysis. It wraps industry-standard tools like Ghidra, radare2, capa, and YARA alongside native Python analyzers to perform file triage, IOC extraction, disassembly, and headless decompilation. Built around strict execution guarantees, Rekit never detonates samples, bounds resource usage with configurable timeouts and size limits, and transparently reports missing backends as tool_missing rather than fabricating findings.
Key Features
01Headless Ghidra decompilation for full binaries or target functions directly into C source code
02Specialized inspection for multi-format targets including APK/DEX files, firmware images, PCAP network captures, and JS bundles
03Static binary triage and disassembly using radare2, objdump, and LIEF without sample execution
04Comprehensive IOC and string extraction covering URLs, IPs, JWTs, crypto wallets, and hidden secrets
05Standardized JSON outputs and full MCP compliance for direct integration into AI agents and developer workflows
062 GitHub stars
Use Cases
01Extracting indicators of compromise (IOCs) and network communications from PCAP files or firmware
02Equipping AI agents with automated static malware analysis and file triage capabilities
03Auditing unknown binaries and mobile APKs safely without risk of execution