cellebrite-labs/ghidra-rpc

A Ghidra agentic reverse engineering skill.

What it solves

It provides a way for Large Language Models (LLMs) to autonomously perform reverse engineering tasks. By giving an AI agent access to Ghidra, the AI can analyze binaries, decompile code, and annotate symbols without requiring a human to manually operate the software.

How it works

The project implements a persistent background daemon that runs Ghidra in-process using PyGhidra. It exposes Ghidra's capabilities through a CLI that communicates via Unix sockets using structured JSON. This allows any AI coding assistant capable of running shell commands to issue instructions and reason over the results in real-time. All changes made by the AI, such as renames or comments, are saved to the Ghidra project and remain visible in the Ghidra GUI.

Who it’s for

Security researchers and developers using AI agents (like Claude Code or Cursor) to automate binary audits, vulnerability research, and patch analysis.

Highlights

  • Full RE Suite: Supports decompiling functions to pseudo-C, tracing call graphs, and searching for byte patterns.
  • Agentic Workflow: Enables AI to rename functions, add comments, and define data structures autonomously.
  • Binary Diffing: Ability to version-track builds and match functions via BSim.
  • Persistent State: Keeps Ghidra "warm" between commands to avoid repeated re-analysis of the same binary.

Related

  • Project
    Dryxio/auto-re-agent

    An AI-powered reverse-engineering agent that uses Ghidra and LLMs to reconstruct and validate C/C++ functions from compiled binaries through an autonomous reverser-checker pipeline.

  • Project
    llnl/OGhidra

    OGhidra is a genuine open‑source project that adds large‑language‑model assistance to the Ghidra reverse‑engineering platform. It lets users ask natural‑language questions, runs AI‑driven analysis (function renaming, malware pattern detection, report generation), and supports both local Ollama models and cloud APIs while keeping binaries private.

  • Project
    weirdmachine64/GhidraGPT

    A Ghidra extension that integrates LLMs into the decompiler workflow to explain, rename, and audit decompiled C functions.

  • Project
    cyberkaida/reverse-engineering-assistant

    ReVa is a Ghidra MCP server that enables AI models to interact with reverse engineering tools, allowing LLMs to perform deep binary analysis and automation while minimizing hallucinations.

  • Project
    morluto/rea

    An agent-driven reverse engineering framework that allows AI agents to investigate app behavior and native binaries using tools like Hopper and Ghidra to explain and recreate software features.