{"name":"GINE","description":"Reverse-engineering as a service: drop a binary + an objective, get an LLM-driven Ghidra analysis. Backed by 230+ Ghidra MCP tools, a curated catalogue of analysis workflows (malware triage, vulnerability research, license validation, cross-revision diff...) and live web search.","url":"http://regine.circle-cyber.com","version":"0.1.0","provider":{"organization":"GINE","url":"http://regine.circle-cyber.com"},"capabilities":{"streaming":true,"pushNotifications":false},"defaultInputModes":["text/plain","application/octet-stream"],"defaultOutputModes":["text/markdown","application/json"],"skills":[{"id":"analyze_binary","name":"Analyze a binary (auto workflow)","description":"Submit a binary and a natural-language objective; a router LLM picks the most appropriate analysis workflow. Returns a Markdown report.","tags":["reverse-engineering","ghidra","static-analysis"],"examples":["Reverse this ELF and list anti-debug techniques.","Identify the C2 protocol in this Windows binary."]},{"id":"analyze_binary_with_workflow","name":"Analyze a binary with a specific workflow","description":"Same as analyze_binary, but the caller selects the workflow id (e.g. malware-analysis, vulnerability-research, license-validation). Discover ids via the list_workflows MCP tool or the gine://workflows resource.","tags":["reverse-engineering","ghidra","malware","vulnerability","license"],"examples":["Triage this sample as malware and emit a YARA rule.","Audit this binary for memory-safety vulnerabilities.","Map the license-check routine and propose a bypass note."]},{"id":"compare_binaries","name":"Cross-revision binary comparison","description":"Submit two binaries; the agent runs a binary-comparison workflow that diffs functions, strings and behaviour between revisions. Optional language/compiler-spec hints apply to both binaries (useful for raw firmware).","tags":["reverse-engineering","diff","cross-version"],"examples":["Diff firmware rev1 vs rev2 and call out protocol changes.","Compare patched vs unpatched DLL; locate the fix."]},{"id":"chat_about_binary","name":"Chat about an analyzed binary","description":"Ask follow-up questions about a finished analysis job. The agent re-opens its Ghidra MCP tools so it can re-decompile or look up fresh xrefs.","tags":["chat","reverse-engineering"],"examples":["What encryption protects the firmware update payload?","Which function handles the heartbeat to the C2?"]},{"id":"ghidra_direct_access","name":"Direct access to the Ghidra MCP bridge","description":"Surface the 230+ raw Ghidra MCP tools to a caller that needs fine-grained control (decompile, search, rename, etc.). The orchestrator returns the bridge URL via the get_ghidra_bridge_info MCP tool.","tags":["ghidra","mcp","low-level"],"examples":["Give me the URL of the Ghidra MCP bridge.","Let me drive decompilation tool-by-tool from my own agent."]}],"endpoints":{"rest":"http://regine.circle-cyber.com/api/v1","mcp":"http://regine.circle-cyber.com/mcp/","websocket_job_stream":"http://regine.circle-cyber.com/api/v1/jobs/{job_id}/stream","openapi":"http://regine.circle-cyber.com/openapi.json"},"mcp_resources":[{"uri":"gine://guide/overview","description":"What GINE is, the 5-stage pipeline, status values, and links to the other guides."},{"uri":"gine://guide/usage","description":"Recipes for every MCP tool: submit, compare, follow progress, ask follow-ups, read the report."},{"uri":"gine://guide/ghidra-direct","description":"When and how to bypass the orchestrator and drive the raw Ghidra MCP bridge yourself."},{"uri":"gine://workflows","description":"JSON index of available analysis workflows."},{"uri":"gine://workflows/{workflow_id}","description":"Full Markdown body of one workflow (critical rules, strategy, expected output)."},{"uri":"gine://jobs/{job_id}/report","description":"Final Markdown report for a finished job (resource equivalent of the get_job_report tool)."}]}