Unfragile

No product in the list is built specifically for bootkit and rootkit analysis. The closest fits are Trail of Bits' binary tooling, which reverse-engineers binaries with Ghidra and inspects DWARF debug info 515, and REMnux, a Linux toolkit for reverse-engineering and analyzing malicious software 3, plus Joern for interactive code analysis 2. Malwagon's hypervisor-layer sandbox, which reads memory and kernel state for Windows kernel drivers, is also relevant 6.

1
Trail of Bitstrailofbits.comverified and signed
Its open-source tools include trailmark for building multi-language binary code graphs, ghidra-headless for decompiling executables and extracting functions and symbols, and dwarf-expert for inspecting DWARF debug information in compiled binaries 15.
Website
for agents: trailmark · ghidra-headless · dwarf-expert
2
REMnux Documentationremnux.orgwebsite read, tools not yet checked
A curated Linux toolkit of free community tools for reverse-engineering and analyzing malicious software, usable by hand or by AI agents through the REMnux MCP server 3.
Website Docs
+1 community tools built for it
3
Malwagonmalwagon.comwebsite read, tools not yet checked
An automated malware analysis sandbox that analyzes Windows kernel drivers with static and dynamic analysis, reading memory and kernel state from outside the VM at the hypervisor layer 6.
Website Docs Pricing Get started
official:MCP server · Malwagon
4
Joernjoern.iowebsite read, tools not yet checked
An interactive code analysis shell for uncovering attack surface and variants of known vulnerabilities across C, C++, LLVM bitcode, and x86 binaries via Ghidra 2.
Website Docs
+6 community tools built for it

Sources

2Joern - The Bug Hunter's Workbenchjoern.io · read 2026-10-29
3REMnux: A Linux Toolkit for Malware Analysis | REMnux Documentationdocs.remnux.org · read 2026-10-29
5Trail of Bits: Security Research, Audits, and Toolstrailofbits.com · read 2026-10-29
6Malware Analysis Sandbox at the Hypervisor Layer | Malwagonmalwagon.com · read 2026-10-29
15trailmark: declares "trailmark" (the record we read and signed)unfragile.ai · read 2026-10-24

For agents: the 10 actions behind this answer

chrome-devtools · chrome-devtools verified and signed
Expert-level browser automation, debugging, and performance analysis using Chrome DevTools MCP. Use for interacting with web pages, capturing screenshots, analyzing network traffic, and profiling performance.
· Joern website read, tools not yet checked
· REMnux Documentation website read, tools not yet checked
REMnux Documentation
analysis · ty verified and signed
trailmark · trailmark verified and signed
Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit aug
· Malwagon website read, tools not yet checked
Automated malware analysis sandbox. A file, hash or command detonates in a VM we run, with memory and kernel state read from outside. 3 free scans a day.
· Sleuthkit website read, tools not yet checked
Open source digital forensics tools for analyzing hard drives, smartphones, and disk images.
browser_webmcp_list · playwright found in code, not yet checked
List the WebMCP tools registered by the page, across all frames
· Apktool website read, tools not yet checked
A tool for reverse engineering Android apk files.
· ClamAVNet website read, tools not yet checked

Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.