{
  "bootstrapDependencies": {
    "pipx": {
      "package": "pipx==1.16.5",
      "version": "1.16.5"
    },
    "pnpm": {
      "package": "pnpm@10.24.0",
      "version": "10.24.0"
    }
  },
  "capabilities": [
    {
      "name": "jadx",
      "bootstrapKind": "github-release-zip",
      "repo": "skylot/jadx",
      "assetRegex": "^jadx-1\\.5\\.6\\.zip$",
      "installDir": "%USERPROFILE%\\Tools\\jadx",
      "docsUrl": "https://github.com/skylot/jadx",
      "canAutoInstall": true,
      "verifyCommand": "jadx",
      "releaseTag": "v1.5.6",
      "assetSha256": "545ea2be9c242511bc145755cf4bda2485ade42966e096f8b4d3da2a230e8974"
    },
    {
      "name": "apktool",
      "bootstrapKind": "github-release-jar-wrapper",
      "repo": "iBotPeaches/Apktool",
      "assetRegex": "^apktool_3\\.0\\.2\\.jar$",
      "installDir": "%USERPROFILE%\\Tools\\apktool",
      "wrapperName": "apktool.bat",
      "docsUrl": "https://apktool.org/",
      "canAutoInstall": true,
      "verifyCommand": "apktool",
      "releaseTag": "v3.0.2",
      "assetSha256": "eee4669a704a14e0623407e6701b0b91887e61e1e4049cb7a82833e14ae8b5fd"
    },
    {
      "name": "jeb-pro",
      "bootstrapKind": "manual",
      "docsUrl": "https://www.pnfsoftware.com/jeb/",
      "canAutoInstall": false,
      "verifyCommand": "jeb_wincon",
      "manualInstallHint": "JEB Pro is commercial. Obtain a valid license from PNF Software, install it manually, then run refresh-tool-index.ps1. Optional community MCP bridges must pass the skill-supply-chain review before registration."
    },
    {
      "name": "frida",
      "bootstrapKind": "pip-package",
      "pipPackage": "frida-tools==14.10.4",
      "pinnedVersion": "14.10.4",
      "docsUrl": "https://frida.re/",
      "canAutoInstall": true,
      "verifyCommand": "frida"
    },
    {
      "name": "frida-ps",
      "bootstrapKind": "pip-package",
      "pipPackage": "frida-tools==14.10.4",
      "pinnedVersion": "14.10.4",
      "docsUrl": "https://frida.re/",
      "canAutoInstall": true,
      "verifyCommand": "frida-ps"
    },
    {
      "name": "idalib-mcp",
      "bootstrapKind": "pip-package",
      "pipPackage": "ida-pro-mcp",
      "pipSource": "git+https://github.com/mrexodia/ida-pro-mcp.git@f82e6e2517a161b77e738951c3071cd446480ba0",
      "pinnedCommit": "f82e6e2517a161b77e738951c3071cd446480ba0",
      "docsUrl": "https://github.com/mrexodia/ida-pro-mcp",
      "canAutoInstall": true,
      "verifyCommand": "ida-pro-mcp",
      "postInstallSteps": [
        "ida-pro-mcp --install (选择 Streamable HTTP + Global)",
        "重启 IDA Pro 使插件生效",
        "IDA 打开文件后 MCP 自动监听 127.0.0.1:13337"
      ]
    },
    {
      "name": "reqable-mcp",
      "bootstrapKind": "npm-mcp",
      "npmPackage": "reqable-mcp-server@1.0.1",
      "mcpNames": [
        "reqable-mcp"
      ],
      "mcpCommand": "npx",
      "mcpArgs": [
        "-y",
        "reqable-mcp-server@1.0.1",
        "--scope",
        "minimal"
      ],
      "mcpEnv": {},
      "docsUrl": "https://github.com/reqable/reqable-mcp-server",
      "canAutoInstall": true,
      "verifyCommand": "npx",
      "pinnedVersion": "1.0.1",
      "note": "Requires the separately installed Reqable desktop application. The MCP server uses Reqable's local API; scope and authorization rules still apply to captured or replayed traffic."
    },
    {
      "name": "jshookmcp",
      "bootstrapKind": "npm-mcp",
      "npmPackage": "@jshookmcp/jshook@0.3.4",
      "mcpNames": [
        "jshook"
      ],
      "mcpCommand": "npx",
      "mcpArgs": [
        "-y",
        "@jshookmcp/jshook@0.3.4"
      ],
      "mcpEnv": {
        "JSHOOK_BASE_PROFILE": "search"
      },
      "docsUrl": "https://github.com/vmoranv/jshookmcp",
      "canAutoInstall": true,
      "verifyCommand": "npx",
      "pinnedVersion": "0.3.4"
    },
    {
      "name": "xquik-mcp",
      "bootstrapKind": "remote-http-mcp",
      "mcpNames": [
        "xquik"
      ],
      "mcpUrl": "https://xquik.com/mcp",
      "docsUrl": "https://docs.xquik.com/mcp/overview",
      "canAutoInstall": true,
      "pinPolicy": "remote-service-no-local-install",
      "verificationMode": "registration-only",
      "note": "Registers the first-party remote MCP URL only. OAuth is completed in the selected MCP client. No local package, bridge, or credential is installed."
    },
    {
      "name": "anything-analyzer",
      "bootstrapKind": "local-http-mcp",
      "repoUrl": "https://github.com/Mouseww/anything-analyzer",
      "installDir": "%USERPROFILE%\\Tools\\anything-analyzer",
      "startupDirCandidates": [
        "%USERPROFILE%\\Tools\\anything-analyzer"
      ],
      "startCommand": "pnpm",
      "startArgs": [
        "dev"
      ],
      "mcpNames": [
        "anything-analyzer",
        "local-mcp"
      ],
      "mcpUrl": "http://localhost:23816/mcp",
      "servicePort": 23816,
      "docsUrl": "https://github.com/Mouseww/anything-analyzer",
      "canAutoInstall": true,
      "pinnedCommit": "0ed4791688e5186da051c85eb7ddfe4639e14fd2",
      "verificationMode": "service-or-registration"
    },
    {
      "name": "idapro",
      "bootstrapKind": "local-http-mcp",
      "dependsOn": [
        "idalib-mcp"
      ],
      "mcpNames": [
        "idapro"
      ],
      "mcpUrl": "http://127.0.0.1:13337/mcp",
      "servicePort": 13337,
      "servicePortRange": [
        13337,
        13350
      ],
      "portNote": "IDA 多实例时端口递增 (13337→13338→...)，检查 IDA Output 窗口的 [MCP] port=xxxxx 日志",
      "startScript": "%SKILL_ROOT%\\ida-reverse\\scripts\\start.ps1",
      "docsUrl": "https://hex-rays.com/ida-pro/",
      "canAutoInstall": true,
      "verificationMode": "service-and-registration"
    },
    {
      "name": "r2",
      "bootstrapKind": "github-release-zip",
      "repo": "radareorg/radare2",
      "assetRegex": "^radare2-.*-w64\\.zip$",
      "installDir": "%USERPROFILE%\\Tools\\radare2",
      "docsUrl": "https://github.com/radareorg/radare2",
      "canAutoInstall": true,
      "verifyCommand": "r2",
      "preferApiDigest": true,
      "note": "radare2 发版频繁，不 pin assetSha256；改用 GitHub API digest（sha256:...）动态校验，格式已实测兼容 Assert-DownloadedFileIntegrity。"
    },
    {
      "name": "rabin2",
      "bootstrapKind": "github-release-zip",
      "repo": "radareorg/radare2",
      "assetRegex": "^radare2-.*-w64\\.zip$",
      "installDir": "%USERPROFILE%\\Tools\\radare2",
      "docsUrl": "https://github.com/radareorg/radare2",
      "canAutoInstall": true,
      "verifyCommand": "rabin2",
      "preferApiDigest": true,
      "note": "与 r2 同一发布资产，API digest 动态校验（见 r2.note）。"
    },
    {
      "name": "adb",
      "bootstrapKind": "winget-package",
      "wingetId": "Google.PlatformTools",
      "pinPolicy": "winget-latest",
      "installDir": "%LOCALAPPDATA%\\Android\\Sdk\\platform-tools",
      "docsUrl": "https://developer.android.com/tools/releases/platform-tools",
      "canAutoInstall": true,
      "verifyCommand": "adb"
    },
    {
      "name": "agent-browser",
      "bootstrapKind": "npm-global",
      "npmPackage": "agent-browser@0.31.1",
      "pinnedVersion": "0.31.1",
      "postInstall": "npx playwright install chromium",
      "installDir": "%LOCALAPPDATA%\\ms-playwright",
      "docsUrl": "https://github.com/nicepkg/agent-browser",
      "canAutoInstall": true,
      "verifyCommand": "agent-browser",
      "setupScript": "%SKILL_ROOT%\\browser-automation\\scripts\\setup.ps1"
    },
    {
      "name": "ghidra-mcp",
      "bootstrapKind": "github-release-zip",
      "repo": "NationalSecurityAgency/ghidra",
      "assetRegex": "^ghidra_.*_PUBLIC_.*\\.zip$",
      "installDir": "%USERPROFILE%\\Tools\\ghidra",
      "docsUrl": "https://ghidra-sre.org/",
      "canAutoInstall": true,
      "verifyCommand": "analyzeHeadless",
      "postInstallSteps": [
        "下载 GhidraMCP 插件: https://github.com/LaurieWired/GhidraMCP/releases",
        "将插件 zip 安装到 Ghidra: File → Install Extensions → 选择下载的 zip",
        "MCP server 在 Ghidra 项目打开后自动监听 localhost:8765"
      ],
      "mcpNames": [
        "ghidra"
      ],
      "mcpUrl": "http://localhost:8765/mcp",
      "servicePort": 8765,
      "verificationMode": "service-or-registration",
      "preferApiDigest": true,
      "note": "Ghidra 发版频繁，不 pin assetSha256；改用 GitHub API digest（sha256:...）动态校验，格式已实测兼容 Assert-DownloadedFileIntegrity。"
    },
    {
      "name": "seclists",
      "bootstrapKind": "git-clone",
      "repo": "https://github.com/danielmiessler/SecLists.git",
      "pinnedCommit": "e5e49caa6fb648476f3bca391b26a45a4f5d3f13",
      "installDir": "%USERPROFILE%\\Tools\\SecLists",
      "docsUrl": "https://github.com/danielmiessler/SecLists",
      "canAutoInstall": true
    },
    {
      "name": "proxycat",
      "bootstrapKind": "git-clone",
      "repo": "https://github.com/honmashironeko/ProxyCat.git",
      "pinnedCommit": "2309b713e2e4f574df14c2ace7e8fa6c00eb6941",
      "installDir": "%USERPROFILE%\\Tools\\ProxyCat",
      "docsUrl": "https://github.com/honmashironeko/ProxyCat",
      "canAutoInstall": true,
      "verifyCommand": "proxycat",
      "postInstallSteps": [
        "git clone https://github.com/honmashironeko/ProxyCat.git %USERPROFILE%\\Tools\\ProxyCat",
        "pip install -r %USERPROFILE%\\Tools\\ProxyCat\\requirements.txt",
        "使用 %USERPROFILE%\\Tools\\bin\\proxycat.bat 启动"
      ]
    },
    {
      "name": "burpsuite-mcp",
      "bootstrapKind": "local-http-mcp",
      "mcpNames": [
        "burpsuite"
      ],
      "mcpUrl": "http://localhost:9876/mcp",
      "servicePort": 9876,
      "docsUrl": "https://portswigger.net/burp",
      "canAutoInstall": false,
      "verificationMode": "service-or-registration",
      "manualInstallHint": "在 BurpSuite 扩展市场搜索 MCP 插件安装，启动后监听 localhost:9876"
    },
    {
      "name": "nmap",
      "bootstrapKind": "winget-package",
      "wingetId": "Insecure.Nmap",
      "pinPolicy": "winget-latest",
      "docsUrl": "https://nmap.org/",
      "canAutoInstall": true,
      "verifyCommand": "nmap"
    },
    {
      "name": "pentestswarm",
      "bootstrapKind": "go-install",
      "goPackage": "github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0",
      "fallbackKind": "docker-image",
      "dockerImage": "ghcr.io/armur-ai/pentestswarm:v0.1.0",
      "mcpNames": [
        "pentestswarm"
      ],
      "mcpCommand": "pentestswarm",
      "mcpArgs": [
        "mcp",
        "serve"
      ],
      "docsUrl": "https://github.com/Armur-Ai/Pentest-Swarm-AI",
      "canAutoInstall": true,
      "verifyCommand": "pentestswarm",
      "note": "群体智能渗透框架。需要 Go 1.24+ 或 Docker。支持 MCP server 模式。需要 Claude/Ollama API key。",
      "pinnedVersion": "v0.1.0"
    },
    {
      "name": "binwalk",
      "bootstrapKind": "winget-package",
      "wingetId": "ReFirmLabs.binwalk",
      "pinPolicy": "winget-latest",
      "docsUrl": "https://github.com/ReFirmLabs/binwalk",
      "canAutoInstall": true,
      "verifyCommand": "binwalk"
    },
    {
      "name": "yara",
      "bootstrapKind": "winget-package",
      "wingetId": "VirusTotal.YARA",
      "pinPolicy": "winget-latest",
      "docsUrl": "https://github.com/VirusTotal/yara",
      "canAutoInstall": true,
      "verifyCommand": "yara"
    },
    {
      "name": "pwntools",
      "bootstrapKind": "pip-package",
      "pipPackage": "pwntools==4.15.0",
      "pinnedVersion": "4.15.0",
      "docsUrl": "https://github.com/Gallopsled/pwntools",
      "canAutoInstall": true,
      "verifyCommand": "pwntools"
    },
    {
      "name": "bkcrack",
      "bootstrapKind": "github-release-zip",
      "repo": "kimci86/bkcrack",
      "assetRegex": "^bkcrack-1\\.8\\.1-win64\\.zip$",
      "installDir": "%USERPROFILE%\\Tools\\bkcrack",
      "docsUrl": "https://github.com/kimci86/bkcrack",
      "canAutoInstall": true,
      "verifyCommand": "bkcrack",
      "releaseTag": "v1.8.1",
      "preferApiDigest": true
    }
  ]
}