debugger-workstation: A reverse-engineering / debugging workstation I put together for AI

// created 2026-06-29

debugger-workstation is a portable skeleton for a reverse-engineering / security-analysis / debugging workstation, built specifically for AI-driven work. The core idea is that the repo holds only manifests and scripts and ships no third-party binaries at all. No IDA, no Frida, no packet capture tools bundled in. Everything is pulled fresh from official sources through the manifests. The licensing stays clean, and anyone who clones it can rebuild the whole setup on their own machine instead of copying my private stash.

manifests/tools.json records each tool’s name, version, official download URL, and install path, and scripts/bootstrap.ps1 assembles the workstation according to the manifest. .gitignore excludes binaries, .env, credentials, .venv/node_modules, and the pcap/dump scratch areas, so only the skeleton itself ends up in the repo.

The whole thing is built for AI. claude, codex, gemini, cursor, copilot, any of them works. The entry point is unified through AGENTS.md, and every other entry file points back to it. The rule is ask first, act later: the AI is not allowed to jump straight into changes. It has to do a read-only pass first, then follow templates/INIT_QUESTIONNAIRE.md to nail down which drive to install on, which directions to cover, and which MCPs to bring up, lay out a plan, and only run once approved. dry-run is the default:

# See the plan only, touch nothing
pwsh scripts\bootstrap.ps1 -InstallRoot "D:\Tool\debugger"

# Once the plan looks good, apply it
pwsh scripts\bootstrap.ps1 -Apply -CloneMcp -InstallRoot "D:\Tool\debugger"

There are 19 MCP backends wired up behind it, covering mobile, reverse engineering, network, CE, and intel, but by default only one runs: a home-grown lightweight router, mcp/debugger-router. Whichever backend you need gets spun up on demand and shut down when you’re done, instead of stuffing all 19 into the AI’s context up front. If you want a direct connection, switch profiles: mcp-mobile/mcp-re/mcp-net/mcp-ce/mcp-intel, or mcp-all. Both the router and mcp/bin/*.cmd use relative paths, so they work wherever you copy them.

One more word on safety. The tools here really bite. Debuggers, injection, hooks, Frida, packet capture, memory analysis, any one of them can set off AV/EDR. For high-risk actions like installing drivers/services/Npcap, editing the registry/Defender/startup items, or running untrusted samples on the host, the AI has to spell out the consequences and the rollback before it does anything. -CloneMcp is opt-in, so read the code yourself before running it. This thing is meant for authorized security testing, CTF, and research and learning. The home-grown parts are under MIT, third-party pieces stay with their upstreams, and nothing is redistributed.