INDEPENDENT DEVELOPER / REVERSE ENGINEER

BEYOND
THE BINARY.

Reverse engineering, OS internals and tools that connect AI agents to real systems.

Explore IDA Bridge Explore GitHub

C / C++PythonIDA ProMCP

bridge.controlARCHITECTURE

AI AGENTA natural-language request

MCP / JSON-RPC

ph4ntom bridgesLOCAL TOOL INTERFACE

IDA Pro

Chrome

Windows

One protocol. Different environments.

AGENT → BRIDGE → SYSTEM01 / 04

BINARY ANALYSISOS INTERNALSAI INTEGRATIONOPEN SOURCE

01 / SELECTED WORK

Start with a task.
Find your bridge.

All repositories

FEATURED PROJECT / IDA BRIDGE

From an unknown function to a clear explanation.

Open a binary in IDA. An agent can read its pseudocode, find calling functions and suggest names that explain the code’s purpose.

IDA Pro 9.x, Python 3.10+. Pseudocode requires Hex-Rays.

Checking releases…

See it in action Install GitHub

The interactive example uses sample data.

ILLUSTRATIVE ANALYSIS / SAMPLE RESULT

sub_140001000(buf, len)
  │
  ├─ len >= 8
  ├─ magic == "PHNT"
  └─ payload_size <= len - 8

Suggested name:
  parse_packet_header

Callers:
  sub_140002180 → incoming frame handler
  sub_1400023A0 → message reader

The README reports validation with IDA Professional 9.3. SDK checks run inside IDA.

Validation checklist

BROWSER AUTOMATION

Chrome Bridge

Let an agent work with a web page.

Scenario: Find a tab, read its content and fill out a form in a dedicated Chrome profile.
Requirements: Chrome and an MCP client. Build: CMake 3.20+, C++17; Windows 10+, Linux or macOS.
Validation & limits: Builds run in CI. Extension pairing requires a manual check. Details

Checking releases…

Demo Quick start GitHub

C++17CDPMCP

SYSTEM INTERNALS

Windows Bridge

Inspect Windows through an agent.

Scenario: Read system information, find a process and inspect its windows.
Requirements: Windows and Python 3.10+. Start with an ordinary user account.
Validation & limits: CI checks Python 3.10 and 3.12 on Windows; extended operations are opt-in. Details

Checking releases…

Demo Quick start GitHub

PythonWin32REST

AGENT COMMUNICATION

Telegram MCP Bridge

Deliver messages to an agent through a durable queue.

Scenario: Receive an event, process it and acknowledge it while preserving pending work across restarts.
Requirements: Python 3.10+, a Telegram bot token, and numeric allowlists for users and chats.
Validation & limits: CI covers Linux, Windows and macOS. Continuous replies require an active agent loop. Details

Checking releases…

Demo Quick start GitHub

PythonSQLiteMCP

02 / QUICK START

Connect. Verify. Explore.

Three steps to a first response. Run commands on your own computer; each project’s README covers the full MCP configuration.

IDA Pro 9.x, Python 3.10+. Pseudocode requires Hex-Rays.

Install the tools

Clone the repository and install the package with MCP support.

git clone https://github.com/ph4ntom-rev/ph4ntom-ida-bridge.git
cd ph4ntom-ida-bridge
python -m pip install -e ".[mcp]"

02
Connect IDA
Use your IDA installation path. Open a sample binary and press Ctrl+Shift+A. For a first run, you can enable read-only mode before starting IDA.
```
python cli.py install-plugin --ida-dir "C:\Program Files\IDA Professional 9.3"
```
03
Verify the connection
ping checks connectivity; info returns the open database details. Then configure the absolute path to mcp_server.py in your MCP client.
```
python cli.py ping
python cli.py info
ph4ntom-ida doctor
```

03 / INTERACTIVE DEMOS

Under the hood.

Request → agent actions → result. Try a short simulation before installing a bridge.

SCENARIO / 01

What does this unknown function do?

«Analyze sub_140001000, find its callers and propose meaningful names. Keep the database unchanged.»

1Read pseudocode and buffer checks
2Find cross-references and two callers
3Suggest names with supporting evidence

Project documentation

bridge-sessionREADY

REQUEST

python cli.py decompile 0x140001000
python cli.py xrefs 0x140001000
python cli.py callers 0x140001000

SAMPLE RESPONSE · ANALYSIS

Run a scenario to see its sample response.

Sample data. Scenarios run in your browser without connecting to local applications.

04 / ACCESS BOUNDARIES

Know what you are granting.

ph4ntom IDA Bridge

Runs inside your IDA on 127.0.0.1:13370 with a session token. Authenticated clients can read and modify the database. Dynamic IDAPython and header imports are disabled by default. IDA_BRIDGE_READ_ONLY=1 blocks mutations.

Security documentation

Chrome Bridge

A local stdio process controls a dedicated Chrome profile through CDP. It can run JavaScript, read cookies and modify pages. The extension HTTP service stays off until a token is configured. The CDP port has no pairing authentication and must remain local.

Security documentation

Windows Bridge

HTTP binds to 127.0.0.1:13371 and requires a token; MCP runs as a separate local process. System, process and window information is enabled by default. Registry, memory, screen, input and code execution require explicit capabilities, with target allowlists where applicable.

Security documentation

Telegram MCP Bridge

Local mode uses stdio and long polling without an inbound port. A bot token and numeric allowlists are required. Outbound messages are limited to explicitly listed chats. Incoming text is untrusted; this website is not connected to a bot.

Security documentation

05 / THE PERSON BEHIND THE TOOLS

ph4ntom-rev

I build bridges between AI agents and analysis tools. My focus is binary code, Windows internals and reliable automation interfaces.

I am interested in making complex system behavior observable, from function calls to event delivery. My projects emphasize local execution, explicit permissions and reproducible checks.

Have an engineering problem?

Get in touch about bridge integration, environment compatibility or a reproducible issue.

Get in touch owner@ph4ntom-rev.uz

TECHNICAL WALKTHROUGH / SAMPLE CASE

Why parse_packet_header, rather than decrypt_data?

A function name is a hypothesis that needs evidence. The IDA Bridge sample follows this reasoning:

01
Start with observations
A length check, a four-byte magic comparison and a size read. A bitwise operation alone is not evidence of encryption.
02
Then inspect the context
Inspect cross-references and callers: where does the buffer come from, and how is the return code used? These observations test the hypothesis.
03
Finally, propose a name
parse_packet_header describes the observed behavior. The agent suggests it; an analyst checks the reasoning before modifying the database.

Open this scenario

BEYONDTHE BINARY.

Start with a task.Find your bridge.

From an unknown function to a clear explanation.

Chrome Bridge

Windows Bridge

Telegram MCP Bridge

Connect. Verify. Explore.

Install the tools

Connect IDA

Verify the connection

Under the hood.

What does this unknown function do?

Know what you are granting.

ph4ntom IDA Bridge

Chrome Bridge

Windows Bridge

Telegram MCP Bridge

ph4ntom-rev

Have an engineering problem?

Why parse_packet_header, rather than decrypt_data?

Start with observations

Then inspect the context

Finally, propose a name

BEYOND
THE BINARY.

Start with a task.
Find your bridge.