English Français العربية

BinSight

Official registry AI and agents

The AI X-ray for any file: what is it, what does it hide, what changed. Built on REA.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package binsight
Claude Code 
claude mcp add binsight -- npx -y binsight@6.6.0 mcp
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "binsight": {
            "command": "npx",
            "args": [
                "-y",
                "binsight@6.6.0",
                "mcp"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. BinSight
  2. The three questions
  3. All 17 tools
  4. Quickstart
  5. Verified against the reference tools
  6. Documentation
  7. Built on REA
  8. License

BinSight

The AI X-ray for any file. Point it at a binary and ask: what is it, what does it hide, and what changed?

Offline · cross-platform · with evidence. It never runs the file.

Built on REA (morluto/rea) · MIT

Most files are black boxes: an .exe you downloaded, a firmware dump, a driver, a game, an ECU calibration, an app update. BinSight opens the box — statically, on your own machine, without ever running the file — and answers the three questions that matter, in plain language and with the evidence to back them up.

You: What is this file? Is it hiding anything? And what changed vs the old version?

BinSight: PE/Windows x64, compiled with MSVC, UPX-packed (entropy 7.9),
          imports consistent with network + process injection, Authenticode
          signature present, and vs the previous build 3 regions changed —
          here are the offsets. All static, all offline, with evidence.

The three questions

🔎 What is it?

triage_file and inspect_executable read ELF, PE/Windows and Mach-O (and raw blobs) and tell you the type, architecture, entry point, imports/exports, sections, hashes, and a compiler/packer fingerprint — without starting Ghidra or IDA, on macOS, Windows or Linux.

🕵️ What does it hide?

detect_binary_toolchain, measure_binary_entropy, classify_import_capabilities, identify_crypto_constants, extract_binary_strings, inspect_code_signature and scan_embedded_content surface packing, high-entropy regions, imported capabilities (network, process, crypto…), IOC strings, embedded files, and whether a signature is real — reported as evidence and inference, never as a verdict.

🔁 What changed?

compare_binaries diffs any two files byte-for-byte and explains the change — which regions moved, what was zeroed or maxed out, the before/after values. Works on app updates, drivers, firmware and ECU calibration dumps alike. compare_executables adds import/export/section/hardening deltas for executables.

All 17 tools

ToolWhat it answers
triage_fileOne call: type, hashes, structure, entropy, packing, capabilities, signature, strings, next steps
generate_triage_reportA shareable Markdown triage report
compare_binariesDiff any two files and explain what changed (firmware, ECU dumps, updates)
compare_executablesDiff two executables: imports, exports, sections, hardening, entropy
inspect_executableSections, imports, exports, libraries, symbols, entry point, overlay — ELF/PE/Mach-O
inspect_binary_hardeningchecksec for every OS: PIE, canary, NX, RELRO, CFG, ASLR, hardened runtime
measure_binary_entropyFile / section / block Shannon entropy + chi-square
detect_binary_toolchainCompiler, packer, installer, language (UPX, MSVC, PyInstaller, Go…)
extract_binary_stringsASCII/UTF-16 strings classified into IOCs (URL, IP, path, registry…)
identify_crypto_constantsAES S-box, SHA/MD5, CRC32, ChaCha, curve parameters…
classify_import_capabilitiesCapabilities inferred from imports ("consistent with", never a verdict)
scan_byte_patternsByte / hex-wildcard / text / regex search, no provider needed
compute_similarity_hashesimphash, Rich hash, symhash, telfhash, ssdeep, TLSH
inspect_code_signatureAuthenticode + Mach-O code signature — on any host
scan_embedded_contentbinwalk-style embedded-file identification (offsets only)
generate_sbomCycloneDX / SPDX component inventory from embedded metadata
recover_go_symbolsFunction names from a stripped Go pclntab

Every result separates observations, inferences and unknowns, carries file offsets, and states its limitations. Detection only — nothing is unpacked, decrypted, cracked or executed.

Quickstart

npx binsight triage-file /path/to/file --json
npx binsight compare-binaries /path/to/old /path/to/new --json
npx binsight generate-triage-report /path/to/file --json

Register BinSight as an MCP server for your AI agent, then just ask it in plain language ("what is this file, what does it hide, what changed?"):

npx binsight setup

BinSight supports the same agents as REA — see supported agents; other clients can use manual MCP registration.

Verified against the reference tools

BinSight's parsers and hashes are checked against the tools analysts already trust: imphash matches pefile byte-for-byte, structure matches LIEF / readelf / otool, and hardening and packing results match checksec and Detect It Easy on a real corpus of ELF, PE and Mach-O binaries.

Documentation

Built on REA

BinSight builds on REA and adds the static intelligence suite above. REA is MIT-licensed; this project keeps that license and attribution. This is not an official REA release — for REA itself, go to morluto/rea.

License

MIT. See LICENSE. Portions © the REA authors.

Frequently asked questions

What is BinSight?

The AI X-ray for any file: what is it, what does it hide, what changed. Built on REA.

How do I install BinSight?

It runs on your machine. In Claude Code: claude mcp add binsight -- npx -y binsight@6.6.0 mcp. For other clients, paste the JSON configuration from this page into their MCP settings.

Does BinSight need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is BinSight open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains BinSight?

It is published by Alessiolucini. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.