kaitai-mcp

MCP server for binary file format reverse engineering using Kaitai Struct.

Exposes 12 tools for binary analysis, from low-level hex inspection to structured parsing with Kaitai Struct format specifications. Works with any MCP-compatible client (Claude Desktop, Claude Code, etc.).

Tools

Binary Inspection

| Tool | Description | |---|---| | hex_dump | View raw bytes as hex dump with ASCII sidebar | | file_info | File size, magic bytes, detected MIME type | | find_strings | Extract ASCII/UTF-16 strings with offsets | | search_bytes | Find byte patterns/signatures (supports wildcards) | | read_as | Read typed values (u8, u16, u32, float, string, etc.) at offsets | | entropy_analysis | Shannon entropy per block to detect compression/encryption | | binary_diff | Compare two binary files, show difference regions |

Kaitai Struct

| Tool | Description | |---|---| | compile_ksy | Compile .ksy format spec to 15 target languages | | parse_binary | Parse a binary file with a .ksy spec, return structured JSON | | validate_ksy | Validate a .ksy spec for correctness |

Format Library

| Tool | Description | |---|---| | list_formats | Browse ~400 known format specs by category | | get_format_info | Get full .ksy spec for a known format (PNG, ZIP, ELF, etc.) |

Installation

git clone --recurse-submodules https://github.com/midi12/kaitai-mcp.git
cd kaitai-mcp
npm install
npm run build

Configuration

Claude Desktop / Claude Code

Add to your MCP settings:

{
  "mcpServers": {
    "kaitai": {
      "command": "node",
      "args": ["/path/to/kaitai-mcp/dist/index.js"]
    }
  }
}

Example Workflow

1. Identify file type: file_info to detect magic bytes
2. Browse known formats: list_formats + get_format_info to find a matching .ksy
3. Inspect raw bytes: hex_dump to view headers, read_as to decode specific fields
4. Find patterns: search_bytes for signatures, find_strings for embedded text
5. Analyze regions: entropy_analysis to find compressed/encrypted sections
6. Parse structure: parse_binary with a .ksy spec for full structured output
7. Iterate: validate_ksy + compile_ksy to develop custom format specs
8. Compare files: binary_diff to understand format variations

Development

npm run dev    # Watch mode for TypeScript compilation
npm run build  # One-time build
npm start      # Run the server

License

MIT