Arkana
An MCP server that gives Claude Code an entire malware-analysis lab of over 300 tools, covering decompilation, symbolic execution, interactive debugging, YARA and capa signatures, emulation and .NET, Go and Rust analysis, driven from natural-language prompts.
Arkana is an MCP server that exposes 308 binary-analysis and reverse-engineering tools to an AI assistant such as Claude Code, so a single natural-language prompt can trigger the same investigation that would otherwise mean switching between Ghidra, IDA, CyberChef, YARA and other separate tools. It can parse PE, ELF, Mach-O, .NET, Go, Rust and shellcode samples.
Capabilities include decompilation and symbolic execution with angr, data-flow analysis, YARA, capa and FLOSS signature matching, Binary Refinery's data transforms, Qiling and Speakeasy emulation, .NET deobfuscation and C# decompilation, function similarity matching, and an interactive, breakpoint-driven debugging session that can snapshot and diff memory before and after a decryption routine. A real-time web dashboard visualises the analysis.
It is aimed at security research and reverse engineering rather than at building attacks: a described workflow triages a malware sample, extracts its command-and-control server and encryption scheme, maps it to MITRE ATT&CK techniques, and recovers artefacts such as a developer path pointing to where the sample likely originated.