Repolode
Submit
cyberkaida

cyberkaida/reverse-engineering-assistant

An MCP server extension for Ghidra that lets AI language models drive reverse engineering analysis through small, focused tools.

View on GitHub
Stars
947
Forks
93
Open issues
17
Last commit
4 days ago

What is it?

ReVa (Reverse Engineering Assistant) is a Ghidra extension that runs a Model Context Protocol server, so AI models can query and act on Ghidra's analysis data. Rather than one large tool, it exposes many small tools, similar to the set of functions a reverse engineer uses in Ghidra. Tool outputs include extra context such as namespaces and cross references alongside decompiled code, which is meant to encourage the model to explore a binary step by step.

ReVa works in two modes. In assistant mode it connects to a running Ghidra UI over streamable HTTP, on port 8080 by default, so the model can work on the open project in real time. In headless mode it starts Ghidra without a GUI, manages ephemeral projects, and suits automation, CI/CD and Docker workflows. It supports Ghidra 12.0 and above, and it also provides access to the PyGhidra scripting environment.

The project includes a Claude Code plugin marketplace with skills for binary triage, deep analysis, cryptography analysis and CTF work.

Key features

  • 01Exposes many small MCP tools for querying and editing Ghidra analysis data.
  • 02Adds namespace and cross-reference context to decompilation output.
  • 03Runs in assistant mode against an open Ghidra UI or in headless mode.
  • 04Provides access to the PyGhidra scripting environment, with API key authentication available.
  • 05Ships Claude Code skills and a plugin marketplace.

Use cases

  • Letting an AI assistant rename variables, fix datatypes and explain functions in an open Ghidra project.
  • Running automated binary triage in CI/CD pipelines or Docker containers.
  • Solving CTF challenges with AI help, such as writing exploit scripts.
  • Comparing two binaries and explaining the differences with an LLM.

Quick start

  1. 1

    Set the Ghidra installation directory (Ghidra 12.0+ required)

    export GHIDRA_INSTALL_DIR=/path/to/ghidra
  2. 2

    Install ReVa with uv

    uv tool install reverse-engineering-assistant
  3. 3

    Register ReVa as an MCP server in Claude Code

    claude mcp add --scope user ReVa -- mcp-reva

Things to know

  • Requires Ghidra 12.0 or later, with Java 21 (Ghidra below 12.2) or Java 25 (Ghidra 12.2+).
  • Assistant mode requires installing the extension and manually activating its plugins inside the Ghidra UI.
  • Scripting tools give access to PyGhidra, so exposing the server on a public interface requires API key authentication or disabling those tools.

In collections

Reverse engineering toolsOpen-source AI agent frameworks & appsMCP servers

Topics

#reverse-engineering#ghidra#mcp#llm#binary-analysis#security-research#ai-agent#assistant#binaryninja#mcp-server

FAQ

What is reverse-engineering-assistant?
An MCP server extension for Ghidra that lets AI language models drive reverse engineering analysis through small, focused tools. ReVa (Reverse Engineering Assistant) is a Ghidra extension that runs a Model Context Protocol server, so AI models can query and act on Ghidra's analysis data. Rather than one large tool, it exposes many small tools, similar to the set of functions a reverse engineer uses in Ghidra. Tool outputs include extra context such as namespaces and cross references alongside decompiled code, which is meant to encourage the model to explore a binary step by step.
Is reverse-engineering-assistant free to use? What license does it have?
reverse-engineering-assistant is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is reverse-engineering-assistant still maintained?
Actively maintained. The last commit to reverse-engineering-assistant was on Nov 3, 2026.
What can I use reverse-engineering-assistant for?
Letting an AI assistant rename variables, fix datatypes and explain functions in an open Ghidra project. Running automated binary triage in CI/CD pipelines or Docker containers. Solving CTF challenges with AI help, such as writing exploit scripts. Comparing two binaries and explaining the differences with an LLM.
How do I install reverse-engineering-assistant?
Set the Ghidra installation directory (Ghidra 12.0+ required): export GHIDRA_INSTALL_DIR=/path/to/ghidra Install ReVa with uv: uv tool install reverse-engineering-assistant Register ReVa as an MCP server in Claude Code: claude mcp add --scope user ReVa -- mcp-reva
Where can I get reverse-engineering-assistant?
The source code and installation instructions are on GitHub: https://github.com/cyberkaida/reverse-engineering-assistant

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects