Seep Reverse Lab's real edge is routing logic and a knowledge base, not tool wrappers

Seep Reverse Lab is an agent-native workbench that wraps Radare2, JADX, Apktool, and Frida behind 23 MCP tools, then layers a prompt-engineering orchestrator on top so a user can type plain-language goals and receive a structured security audit report without manually invoking any tool directly. The central design bet is that fragmentation — switching between tools, remembering flags, managing context windows — is the real friction in reverse engineering work, and that an LLM agent with a well-designed routing layer can absorb that friction.

The softseep orchestrator classifies every incoming request along two axes: platform (Windows PE, Android APK, Linux ELF, or web) and task type (nine paradigms, seven decision gates). That classification determines which sub-skill handles the job. The Android path, apkseep, covers the full DEX/SO pipeline including packer detection, Smali patching with Adler-32/SHA-1 recalculation, SSL pinning bypass, and repack signing. The binary path reaches IDA Pro via an optional MCP bridge when Radare2's own decompiler isn't enough.

The knowledge base — 289 field journals stored locally — is treated as a first-class tool rather than documentation. The agent contract explicitly requires checking the KB before writing any new script; the seep_kb_search tool is wired into the workflow before seep_apk_gen_hook or any patch generation step. Nine desensitized industrial paradigms cover cases ranging from EXECryptor VM arbitration to Ed25519 public-key replacement to weak-modulus RSA bypass, giving the agent concrete prior art to match against rather than reasoning from scratch each time.

Context budget management is a real engineering concern here, not an afterthought. The decompile tool offers three output modes: full, fold (roughly 60% token reduction), and summary (roughly 90% reduction). Cross-reference output is paginated with a default limit of ten entries. These aren't just nice-to-have options — without them, a single large binary would exhaust a model's context before the agent could act on the analysis.

The anti-refusal architecture is the part that warrants the most scrutiny. The README describes a three-tier approach: BLOCK_NONE injection, terminology mapping from colloquial language to compliance language, and cognitive redirection. A disk-backed lab-mode flag persists these overrides across model switches and context compression. The stated purpose is authorized security auditing and CTF training, and the agent contract does require explicit authorization confirmation on every new target. Whether those guardrails hold in practice depends entirely on the operator.

The deliverable specification is unusually concrete: exact RVA and file offsets, a reproducible PoC, offline airplane-mode confirmation, and a three-part report covering vulnerability detail, reproduction steps, and defense-in-depth remediation. That last section recommends SetDefaultDllDirectories against DLL hijacking and ProcessDynamicCodePolicy against executable memory injection — specific mitigations, not generic advice.

The whole stack ships as a 251 MB offline bundle. Setup is a single PowerShell script. A 35-check health verifier confirms readiness. The agent targets eight to twenty minutes for a typical client application audit, fully unattended.