cellebrite-labs/ghidra-rpc

A Ghidra agentic reverse engineering skill.

What it solves

It enables Large Language Models (LLMs) to perform autonomous reverse engineering by providing a structured interface to Ghidra, a professional software reverse engineering suite. This removes the need for a human to manually translate LLM suggestions into Ghidra actions.

How it works

The project runs Ghidra as a persistent background daemon using PyGhidra. It exposes Ghidra's capabilities through a Command Line Interface (CLI) that returns structured JSON. AI coding assistants (like Claude Code or Cursor) can issue shell commands to the daemon, reason over the JSON results, and execute further actions. Because the daemon stays "warm," the binary is loaded once and analysis is preserved across commands.

Who it’s for

Security researchers, vulnerability analysts, and developers who use AI agents to automate the analysis of compiled binaries.

Highlights

  • Comprehensive RE Capabilities: Supports decompiling functions, tracing call graphs, renaming symbols, and defining data structures.
  • Binary Diffing: Ability to version-track builds and match functions using BSim.
  • Persistent State: All changes made by the AI (comments, renames, patches) are saved to the Ghidra project and are visible in the Ghidra GUI.
  • Agentic Integration: Designed specifically for AI assistants that can execute shell commands.

Related

  • Project
    llnl/OGhidra

    OGhidra is a genuine open‑source project that adds large‑language‑model assistance to the Ghidra reverse‑engineering platform. It lets users ask natural‑language questions, runs AI‑driven analysis (function renaming, malware pattern detection, report generation), and supports both local Ollama models and cloud APIs while keeping binaries private.

  • Project
    weirdmachine64/GhidraGPT

    A Ghidra extension that integrates LLMs into the decompiler workflow to explain, rename, and audit decompiled C functions.

  • Project
    cyberkaida/reverse-engineering-assistant

    ReVa is a Ghidra MCP server that enables AI models to interact with reverse engineering tools, allowing LLMs to perform deep binary analysis and automation while minimizing hallucinations.

  • Project
    morluto/rea

    REA is an MCP-based tool that enables AI agents to perform deep reverse engineering on binaries, applications, and runtime environments to explain how features work and assist in code reconstruction.