Plugin Claude Code
AlgoKiller suite — ARM64 trace evidence analysis & cipher algorithm recovery. Claude plugin (loadable from both Claude Code and Claude Desktop) packaging the AlgoKiller methodology as skills + a local MCP server driving the native aksearch engine (15 subcommands) over GB-scale trace files.
Plugin Claude Code
AlgoKiller — ARM64 trace evidence analysis & cipher algorithm recovery. Bundles the AlgoKiller methodology as skills + a local MCP server (28 tools) that drives the native aksearch engine over GB-scale trace files. v1.2.0 adds two trace tools targeted at OLLVM-flattened binaries — tracefunction (PC-level invocation.
MCP server Claude CodeCodexCursor +2
MCP server "ak" as configured in icloudza/algokiller-plugin. Runs ${CLAUDE_PLUGIN_ROOT}/server/algokiller_mcp.py with python3. Needs 2 environment variables to run.
Agent
Read-only helper that queries Binary Ninja MCP / BinAssistMCP and static-analysis CLIs (radare2, objdump, strings, otool, class-dump) on behalf of the main agent. Spawn this when a static probe will return >1 KB of disassembly, a function decompile, a symbol cross-reference list, or a full S-box / round-constant table…
Agent
Independent blue-team reviewer for algokiller Hypothesis Ledger. The main trace-analysis agent MUST spawn this reviewer before any hypothesisconclude(finalconfidence="high") call on a load-bearing hypothesis (one that will be cited by the final writeartifact). The reviewer examines the cited hypothesis in isolation …
Agent
Read-only ledger consistency reviewer. Spawn this near the end of a long ciphertext-recovery / trace-analysis session, BEFORE the main agent calls writeartifact on the final recovered.py / report.md. The curator scans the hypothesis ledger and produces a one-page audit of (a) which concluded hypotheses are cited by…
Agent
Read-only helper for the main trace-analysis / ciphertext-recovery agent. Spawn this when a tracehexblock will return >2 KB of byteshex (typical for NSJSONSerialization dataWithJSONObject: blocks, large memcpy / sprintf outputs, AES key-buffer dumps). The subagent extracts the hexdump in its own context, parses byte…
Command
Run tracefold on the currently-bound trace to produce a block-collapsed derivative trace (typically 99 % compression on hash-loop-heavy traces) and bind to that instead.
Command
Rebind the currently-bound trace into a fresh / session directory while keeping the trace path + mode + outputdir unchanged. Useful when starting a new analysis pass without re-typing the trace path.
Command
Show the current algokiller session state — bound trace, mode, outputdir, ledger summary, artifacts written.
Hook
Runs before the context is compacted for auto and manual tool calls, executing pre-compact-auto.sh and pre-compact-manual.sh via bash (2 commands). From icloudza/algokiller-plugin.
Hook
Runs when a session starts on compact, startup and resume, executing session-start-compact.sh and session-start-bootstrap.sh via bash (2 commands). From icloudza/algokiller-plugin.
Hook
Runs before the agent uses a tool for mcp__plugin_ak_ak__write_artifact tool calls, executing pre-write-artifact.sh via bash. From icloudza/algokiller-plugin.
Hook
Runs when the agent finishes a response, executing stop.sh via bash. From icloudza/algokiller-plugin.
Hook
Runs when a subagent finishes, executing subagent-stop.sh via bash. From icloudza/algokiller-plugin.
Skill Claude CodeCodex
A method for recovering an unknown encryption, signing, or encoding algorithm from an ARM64 execution trace, which is a recorded sequence of processor operations. It uses evidence from the trace and checks possible algorithms against the observed results.
Skill Claude CodeCodex
Strong activation entry for AlgoKiller ciphertext-recovery mode. Bind an ARM64 trace, force-load the ciphertext-recovery methodology, and start cipher / algorithm recovery from a target ciphertext.
Skill Claude CodeCodex
Strong activation entry for AlgoKiller general trace-analysis mode. Bind an ARM64 trace, force-load the trace-analysis methodology, and answer field semantics / execution flow / detection-point / data-flow questions.
Skill Claude CodeCodex
A method for analyzing ARM64 execution traces, which are detailed records of processor instructions and program activity. It uses a bound trace file and evidence from trace-analysis tools to study execution flow, fields, calls, and data buffers.