cyberkaida/reverse-engineering-assistant

MCP server for reverse engineering tasks in Ghidra 👩‍💻

What it solves

ReVa solves the difficulty of performing long-form reverse engineering tasks with AI by reducing "context rot" and hallucinations. It bridges the gap between AI language models and Ghidra, allowing LLMs to interact directly with a binary's structure, decompilation, and metadata rather than relying on static snapshots of code.

How it works

ReVa acts as a Model Context Protocol (MCP) server that integrates with Ghidra. Instead of feeding an entire binary into a prompt, it provides the LLM with a suite of small, specialized tools. These tools provide critical fragments of information—such as decompilation, namespaces, and cross-references—with links to other relevant data. This tool-driven approach encourages the LLM to explore the binary iteratively, mimicking how a human reverse engineer works. It supports two modes:

  • Assistant Mode: Connects to a running Ghidra UI for interactive, real-time collaboration.
  • Headless Mode: Runs without a GUI for automation, CI/CD pipelines, or Python-based workflows via PyGhidra.

Who it’s for

It is designed for reverse engineers, security researchers, and CTF participants who use Ghidra and want to leverage LLMs to automate binary triage, identify algorithms, rename variables, or analyze encryption.

Highlights

  • MCP Integration: Works with MCP clients like Claude Code and VSCode to enrich analysis with other servers (e.g., GitHub or Kagi).
  • Context Management: Uses small, reinforced fragments of data to handle large binaries and entire firmware images without overwhelming the context window.
  • Flexible Deployment: Supports both interactive GUI-based assistance and fully headless automation.
  • PyGhidra Support: Can be launched directly from Python scripts for custom agentic workflows.
  • Pre-built Skills: Includes specialized skills for binary triage, deep analysis, cryptography, and CTF guides.