Interposer V2

Interposer V2 is an MCP-powered reverse engineering workstation for Windows binary analysis, malware analysis, debugger orchestration, and tool automation. It combines a desktop client with a Model Context Protocol (MCP) server so Codex, Claude, and other AI agents can drive Ghidra, x64dbg, Frida, and static binary triage from one place.

If someone is searching GitHub for an MCP server for reverse engineering, binary analysis, Ghidra automation, x64dbg automation, Frida workflows, or malware triage, this repo is meant to be that result.

Interposer has three practical faces:

• a desktop client for no-code use
• a dedicated MCP server that Codex, Claude, and other MCP clients can drive directly
• a portable bundle layout that can travel to another Windows workstation

It coordinates a local reverse engineering toolchain across:

• BinaryAnalysis-MCP
• Ghidra / GhidraMCP
• x64dbg
• Frida

Search-friendly keywords:

• MCP
• Model Context Protocol
• reverse engineering
• binary analysis
• malware analysis
• Ghidra
• x64dbg
• Frida
• Windows RE
• AI agent tooling

What Works Today

• Target triage and analysis packets
• Registry-backed adapter action catalog
• Investigation cases, recent activity, and workflows
• Desktop operator client
• Dedicated MCP server entrypoint
• Cleanup/reset actions for stateful adapters

Validated live adapter flows:

• Ghidra: launch/reuse, read, write, read-back, cleanup
• x64dbg: start, read, write, read-back, cleanup
• Frida: enumerate, spawn, attach/session, execute, cleanup

Install

From the project root:

python -m pip install --upgrade pip
python -m interposer.bootstrap prepare-layout
python -m pip install -r requirements.txt
python -m pip install -e .

Run

Desktop client:

.\Launch Interposer.cmd

MCP server:

$env:INTERPOSER_ROOT = (Get-Location).Path
.\Launch Interposer MCP.cmd

Health check:

.\Interposer Doctor.cmd

Portable bundle:

.\Build Interposer Bundle.cmd

Portable zip release:

.\Build Interposer Release Zip.cmd

Portable workstation setup:

1. Unzip the Interposer bundle.
2. Drop third-party tools into Tools\ inside the bundle:
   • Tools\Ghidra\
   • Tools\X64dbg\
   • Tools\DIE\
3. Run .\Install Interposer.cmd
4. Run .\Interposer Doctor.cmd
5. Point Claude or Codex MCP at that bundle root
6. Use the generated config at mcp-config.generated.json inside the bundle as your ready-to-paste starting point

Interposer now prefers a bundle-local Tools\ directory before falling back to Desktop\Tools, so a downloaded zip can stay self-contained.

First Useful Tests

Basic target analysis:

python -m interposer.cli analyze ".\samples\target.exe" --root "$PWD"

Ghidra read/write validation:

1. ghidra_launch_mcp
2. ghidra_get_program_info
3. ghidra_set_bookmark
4. ghidra_get_bookmarks
5. ghidra_remove_bookmark

x64dbg read/write validation:

1. x64dbg_start_session
2. x64dbg_get_debugger_status
3. x64dbg_set_comment
4. x64dbg_get_comment
5. x64dbg_cleanup

Frida validation:

1. frida_spawn_process
2. frida_create_interactive_session
3. frida_execute_in_session
4. frida_cleanup
5. frida_kill_process

Files

• MCP packaging guide: README-MCP.md
• portable setup guide: PORTABLE-INSTALL.txt
• operator notes: INTERPOSER-OPS.txt
• desktop quickstart: START HERE.txt