schlarpc/re-shell

Nix-powered agentic reverse engineering environment

What it solves

It provides a pre-configured, reproducible reverse engineering environment specifically optimized for use with Claude Code. It eliminates the manual setup of complex toolchains (like Ghidra or Frida) and ensures the AI agent has the necessary tools and context to analyze binaries, archives, and network captures automatically.

How it works

The project uses a Nix flake-based development shell to bundle a comprehensive suite of reverse engineering tools (including Ghidra, radare2, Frida, mitmproxy, and YARA). It uses a CLAUDE.md file to define specific "skills" that trigger based on the file types detected in the workspace. For example, if a .exe file is present, the Windows RE skill activates, providing Claude with the specialized documentation and workflows needed for that task.

Who it’s for

Security researchers, malware analysts, and reverse engineers who want to leverage AI agents to automate the analysis of software binaries and network traffic.

Highlights

  • Automated Toolchain: Bundles multiple industry-standard tools into a single reproducible environment.
  • Context-Aware Skills: Automatically activates specialized workflows based on file extensions (Windows, Android, and Web RE).
  • Self-Modifying: Allows Claude to install additional Python, Node.js, or system tools as needed during an analysis session.
  • Nix-Based: Ensures the environment is consistent across different machines using Nix flakes.

Related

  • Project
    safedep/pmg

    Package Manager Guard (PMG) is an open-source install-time firewall that blocks malicious npm and pip packages using threat intelligence, dependency cooldowns, and runtime sandboxing.

  • Project
    FSMargoo/dsh-at-file

    A plugin for the DeepSeek Harness web interface that enables workspace path references via an @-mention system, allowing users to easily point AI agents to specific files and directories.

  • Project
    seratch/ChatGPT-in-Slack

    A Slack app that connects to OpenAI’s ChatGPT (and DALL‑E 3), letting users chat, proofread, and generate images from channel threads, DMs, or the Home tab. It’s configurable via environment variables, deployable with Docker in Socket Mode, and includes optional Azure OpenAI support.

  • Project
    silasxbt/anti-api

    Anti‑API is a self‑hosted proxy that makes OpenAI‑/Anthropic‑compatible clients work with six different LLM providers, offering smart routing, quota‑aware failover, a local dashboard, and a token‑protected public inference gateway.