headless-re-mcp (kumburovicbranko682-boop/headless-re-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 204 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Emerging
74/100
8 days ago

headless-re-mcp

Headless reverse engineering MCP server integrating IDA Pro for static analysis and x64dbg for dynamic debugging via controlled MCP tools.

→ kumburovicbranko682-boop/headless-re-mcp· listed on glama

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

kumburovicbranko682-boop

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: HEADLESS_RE_PROVIDER_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configHEADLESS_RE_IDA_HOME解压后执行 activate_deps.ps1，再设置 。
configHEADLESS_RE_X64DBG_SOURCE
configHEADLESS_RE_ARTIFACT_ROOT
configHEADLESS_RE_X64DBG_HEADLESS_X64
configHEADLESS_RE_X64DBG_HEADLESS_X86
configHEADLESS_RE_DIEC
configHEADLESS_RE_EXEINFOPE
configHEADLESS_RE_UPX
configHEADLESS_RE_DE4DOT
configHEADLESS_RE_NET_REACTOR_SLAYER
configHEADLESS_RE_XVLKC
configHEADLESS_RE_VMP_DUMPER
configHEADLESS_RE_SCYLLA
configHEADLESS_RE_R2
configHEADLESS_RE_GHIDRA_HOME
configHEADLESS_RE_GHIDRA_WASM_PLUGIN
configHEADLESS_RE_CDB
configHEADLESS_RE_ADB
configHEADLESS_RE_FRIDA_SERVER
configHEADLESS_RE_JADX
configHEADLESS_RE_APKTOOL
configHEADLESS_RE_APKSIGNER
configHEADLESS_RE_WABT
configHEADLESS_RE_WEBCRACK
configHEADLESS_RE_WINDBG_ALLOW_KERNEL
configHEADLESS_RE_PERSIST_DEBUG_EVENTS
configHEADLESS_RE_DEBUG_EVENT_BACKGROUND_DRAIN
configHEADLESS_RE_HIDDEN_DESKTOP它们枚举的是当前桌面，所以和 =1 互斥：开着隐藏桌面时被调试进程
configHEADLESS_RE_HEALTH_CHECK_INTERVAL_S
configHEADLESS_RE_LOCAL_FULL_ACCESS
configHEADLESS_RE_AGENT_AUTO_APPROVE_EFFECTS
configHEADLESS_RE_AGENT_AUTO_APPROVE_TOOLS
configHEADLESS_RE_AGENT_NEVER_AUTO_APPROVE
configHEADLESS_RE_WATCHDOG_INTERVAL_S
configHEADLESS_RE_WATCHDOG_AUTO_RECOVER_BACKENDS
configHEADLESS_RE_ISOLATION_COMMAND
configHEADLESS_RE_ISOLATION_TIMEOUT_S
configHEADLESS_RE_ISOLATION_REQUIRED
configHEADLESS_RE_HTTP_HOST
configHEADLESS_RE_HTTP_PORT
configHEADLESS_RE_WORKSPACE_PROFILE
configHEADLESS_RE_ARTIFACT_MAX_TOTAL_BYTES
configHEADLESS_RE_X64DBG_STEALTH_ENABLED
configHEADLESS_RE_X64DBG_STEALTH_PROFILE
configPROGRAMFILES
configHEADLESS_RE_LOG_DIR
configHEADLESS_RE_TELEMETRY_LOG
🔐 secretHEADLESS_RE_PROVIDER_API_KEY
configHEADLESS_RE_PROVIDER_BASE_URL
configHEADLESS_RE_PROVIDER_MODEL
configHEADLESS_RE_BUILD_COMMIT
configHEADLESS_RE_TESSERACT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

204/204 tools missing one or more hints — apk.open (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); apk.manifest (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); apk.permissions (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +201 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/kumburovicbranko682-boop/headless-re-mcp)](https://m8ven.ai/mcp/kumburovicbranko682-boop/headless-re-mcp)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: e513e482f3a6d3176bd94f13da51f4e881dc1b8b
code hash: 9715f27b72acf15591506decfc8ab683dd370006fa88784fa4ee1c742bc828bd
verified: 9/1/2026, 11:26:37 PM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client