Security
Plugin
reverse-engineering-assistant
A Ghidra extension that provides a Model Context Protocol (MCP) server for AI-assisted reverse engineering ReVa (Reverse Engineering Assistant) is a Ghidra MCP server that enables AI language models to interact with Ghidra's powerful reverse engineering
Plugin Signal78/100Solid
maintained97
capable48
documented100
adopted62
Install on Claude Code
> /plugin marketplace add cyberkaida/reverse-engineering-assistant> /plugin install ReVa@reva
What's inside
Skills
6/binary-triagePerforms initial binary triage by surveying memory layout, strings, imports/exports, and functions to quickly understand what a binary does and identify suspicious behavior. Use when first examining a binary, when user asks to triage/survey/analyze a program, or wants an/ctf-cryptoSolve CTF cryptography challenges by identifying, analyzing, and exploiting weak crypto implementations in binaries to extract keys or decrypt data. Use for custom ciphers, weak crypto, key extraction, or algorithm identification./ctf-pwnSolve CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. Use for buffer overflows, format strings, heap exploits, ROP challenges, or any pwn/exploitation task./ctf-revSolve CTF reverse engineering challenges using systematic analysis to find flags, keys, or passwords. Use for crackmes, binary bombs, key validators, obfuscated code, algorithm recovery, or any challenge requiring program comprehension to extract hidden information./deep-analysisPerforms focused, depth-first investigation of specific reverse engineering questions through iterative analysis and database improvement. Answers questions like "What does this function do?", "Does this use crypto?", "What's the C2 address?", "Fix types in this function". Makes/pyghidra-scriptingWrite and run Python (PyGhidra) code inside the Ghidra session that ReVa's MCP server is already attached to, using the five ReVa scripting tools — `run-script`, `list-scripts`, `read-script`, `write-script`, `edit-script`. Use this whenever the user asks to execute Python
Agents
2ghidra-api-expertUse this agent when you need expert guidance on Ghidra API usage, plugin/extension development, or troubleshooting integration issues. This includes questions about specific Ghidra classes and methods, best practices for plugin architecture, handling obscure API behaviors,reva-setup-installerUse this agent when:\n1. The project is being set up for the first time\n2. Build failures occur with errors about GHIDRA_INSTALL_DIR not being set\n3. Gradle dependency errors appear\n4. The user mentions setup, installation, or configuration problems\n5. Missing prerequisites
MCP
1README
1ReVa - Ghidra MCP Server for AI-Powered Reverse Engineering
A Ghidra extension that provides a Model Context Protocol (MCP) server for AI-assisted reverse engineering
ReVa (Reverse Engineering Assistant) is a Ghidra MCP server that enables AI language models to interact with Ghidra's powerful reverse engineering capabilities. ReVa uses state of the art techniques to limit context rot and enable long form reverse engineering tasks.
ReVa is different from other efforts at building AI assistants for RE tasks because it uses a tool driven approach with a focus on designing tools for effective LLM use. ReVa aims to provide a variety of small tools to the LLM, just as your RE environment provides a set of small tools to you.
Each of the tools given to the LLM are constructed to be easy for the LLM to use and to tolerate a variety of inputs and to reduce hallucination by the LLM. We do this by providing the LLM with a schema but tolerating other input, including descriptions that guide the LLM,and redirecting correctable mistakes back to the LLM, and including extra output to guide the next decision by the LLM.
ReVa's tools differ to other solutions, they provide smaller, critical fragments with reinforcement and links to other relevant information to reduce context usage and hallucination. This greatly improves performance, especially on long form reverse engineering tasks. This allows ReVa to handle large binaries and even entire firmware images.
To encourage exploration as a human would, we report additional context like the namespace and cross references along with the decompilation, this is a small nudge to make the LLM explore the binary in the same way a human would.
Using this technique you can ask general questions and get relevant answers. The model prioritises information from the tools, but when there is no information it can still respond to generic questions from its training.
As an MCP server, ReVa can be used alongside other MCP servers to enrich its analysis. For example you can use the GitHub MCP Server to allow ReVa access to source code on GitHub, or the Kagi MCP Server to allow ReVa to search the web.
You can ask questions like:
- Examine the programs in this project and explain the relationship between the main binary and the shared libraries.
- What are the interesting strings in this program?
- Does this program use encryption? Write a markdown report on the encryption and where it is used.
- Draw a class diagram using plantuml syntax.
- Start from main, examine the program in detail. Rename variables as you go and provide a summary of the program.
- Explain the purpose of the
__mod_initsegment. - What does
mmapreturn? - What does the function at address 0x80000 do?
- This is a CTF problem. Write a pwntools script to get the flag.
- Import these two binaries and diff them, explain the changes.
Installation
NOTE: ReVa only supports Ghidra 12.0 and above!
ReVa is a Ghidra extension. To install it, you can download the release for your version of Ghidra from the releases page and install it using the Ghidra extension manager.
Alternatively, you can build it from source. To do this, clone the repository and run the following command:
export GHIDRA_INSTALL_DIR=/path/to/ghidra
gradle install
After installing the extension you need to activate it in two places:
- In the Project view, open the File menu and select "Configure". Click the "Configure all plugins" button on the top right of the menu (it looks like a plug). Check the "ReVa Application Plugin"
- In the Code Browser tool (Click the Dragon icon or open a File), open the File menu and select "Configure". Click the "Configure all plugins" button on the top right of the menu (it looks like a plug). Check the "ReVa Plugin". Then Press File and select "Save Tool". This will enable ReVa by default.
NOTE: ReVa provides access to the PyGhidra scripting environment. If you allow ReVa to listen on a public interface, either enable the API key authentication or disable the scripting tools in the settings. The default configuration is to listen on localhost and allow the scripting tools.
Usage
There are two ways to use ReVa, with the Ghidra UI in assistant mode or in headless mode. Headless mode is ideal for automation and CI/CD pipelines, while the assistant mode is great for interactive analysis.
In assistant mode, ReVa connects to your running Ghidra and can work with you on your project. It can work in real time on the same file or on other files in your project. This is useful for deep analysis, ReVa can help identify algorithms, rename variables, fix datatypes, and many other parts of analysis.
In headless mode, ReVa runs without the Ghidra UI. This is useful for automation, CI/CD pipelines, or when you want to run ReVa in a pipeline. ReVa manages starting Ghidra and projects for you. Projects in headless mode are ephemeral (session-scoped) and automatically cleaned up. This is useful when you do not need the Ghidra UI and want ReVa to work on its own.
You select which mode with the MCP configuration in your MCP client.
Assistant Mode
In assistant mode, you run Ghidra with ReVa installed and connect your MCP client to the ReVa MCP server running in Ghidra. You must first start Ghidra and open a project.
ReVa uses the streamable MCP transport
and will listen on port 8080 by default, you can change this in the Ghidra settings from the project view. This allows many clients to connect to the same UI for interactive use.
Claude Code
Claude Code is the recommended client for ReVa, performance is excellent and Claude Code handles large binaries and projects well.
claude mcp add --scope user --transport http ReVa -- http://localhost:8080/mcp/message
When you use the claude command with Ghidra open it will connect to the ReVa MCP server.
You can check with /mcp in the Claude Code chat to see if it is connected.
To enable all ReVa commands by default, and avoid prompts for tool use, you can use
the /permissions command in Claude Code and add a rule for mcp__ReVa. This will
allow ReVa to use all of its tools without prompting you for permission.
VSCode
VSCode has a built in MCP client, instructions to configure it can be found in the GitHub Copilot documentation.
{
"mcp": {
"servers": {
"ReVa Assistant": {
"type": "http",
"url": "http://localhost:8080/mcp/message"
}
}
}
}
Headless Mode
ReVa can run in headless Ghidra mode without the GUI, making it ideal for:
- Automation - CI/CD pipelines and automated analysis
- Docker - Containerized reverse engineering workflows
- PyGhidra - Python-based automation
Claude Code
# Set Ghidra installation directory, this must always be in your environment
export GHIDRA_INSTALL_DIR=/path/to/ghidra
uv tool install reverse-engineering-assistant
claude mcp add --scope user ReVa -- mcp-reva
claude -p "Import /bin/ls with ReVa and tell me how it works"
A project will be created in the current working directory in .reva/projects/.
If you run claude from the same directory, you can import many files into the same project. Just ask ReVa to work on the new file.
PyGhidra Integration
You can also use ReVa directly from PyGhidra scripts:
import pyghidra
pyghidra.start()
from reva.headless import RevaHeadlessLauncher
# Start server
launcher = RevaHeadlessLauncher()
launcher.start()
if launcher.waitForServer(30000):
print(f"Server ready on port {launcher.getPort()}")
# ... your analysis code with your agent ...
launcher.stop()
Claude Code Marketplace
The ReVa repo includes a Claude Code marketplace and plugins to make using ReVa easier. These include skills and scripts to help ReVa work better with Claude Code.
You can install with:
claude plugin marketplace add cyberkaida/reverse-engineering-assistant
This will add the ReVa skills to your Claude Code installation.
- Binary Triage
- Deep Analysis
- Cryptography Analysis
- CTF guides
I will be adding more skills over time to help with reverse engineering tasks.
Support
Do you like my work? Want to support this project and others? Interested in how this project was designed and built? This project and many others are built live on my stream at https://twitch.tv/cyberkaida !
File tree
328cyberkaida/reverse-engineering-assistantView on GitHub
.claude/
.claude-plugin/
marketplace.json
agents/
ghidra-api-expert.md
reva-setup-installer.md
hooks/
gradle-proxy.py
setup-remote-env.sh
launch.json
README.md
settings.json
.continue/
docs/
new-doc-1.yaml
new-doc.yaml
.gitattributes
.github/
CI_WORKFLOWS.md
copilot-instructions.md
dependabot.yml
WORKFLOW_SETUP.md
workflows/
claude.yml
copilot-setup-steps.yml
publish-ghidra.yml
publish-pypi.yml
test-ghidra.yml
test-headless.yml
.gitignore
.vscode/
extensions.json
launch.json
settings.json
AGENTS.md
build.gradle
CLAUDE.md
config/
reva-headless-example.properties
data/
buildLanguage.xml
languages/
skel.cspec
skel.ldefs
skel.opinion
skel.pspec
skel.sinc
skel.slaspec
README.txt
sleighArgs.txt
DEVELOPER.md
extension.properties
ghidra_scripts/
README.txt
sample_script.py
SampleScript.java
lib/
.gitignore
README.txt
LICENSE
Module.manifest
os/
linux_x86_64/
README.txt
mac_x86_64/
README.txt
win_x86_64/
README.txt
pyproject.toml
README.md
ReVa/
.claude-plugin/
plugin.json
.mcp.json
LICENSE
skills/
binary-triage/
SKILL.md
ctf-crypto/
patterns.md
SKILL.md
ctf-pwn/
patterns.md
SKILL.md
ctf-rev/
patterns.md
SKILL.md
deep-analysis/
examples.md
patterns.md
SKILL.md
pyghidra-scripting/
references/
decompiler-pcode.md
flat-api.md
jpype-interop.md
persistent-scripts.md
recipes.md
SKILL.md
src/
CLAUDE.md
main/
help/
CLAUDE.md
help/
TOC_Source.xml
topics/
ReVa/
map.xml
ReVa_installation.html
ReVa_overview.html
ReVa_skills.html
skeleton/
help.html
java/
reva/
debug/
CLAUDE.md
DebugCaptureService.java
DebugInfoCollector.java
headless/
CLAUDE.md
RevaHeadlessLauncher.java
plugin/
CLAUDE.md
config/
ConfigurationBackend.java
ConfigurationBackendListener.java
FileBackend.java
InMemoryBackend.java
ToolOptionsBackend.java
ConfigChangeListener.java
ConfigManager.java
FollowMeService.java
RevaApplicationPlugin.java
RevaPlugin.java
RevaProgramManager.java
ToolGroup.java
resources/
AbstractResourceProvider.java
CLAUDE.md
impl/
ProgramListResource.java
ResourceProvider.java
revaAnalyzer.java
revaExporter.java
revaFileSystem.java
server/
ApiKeyAuthFilter.java
CachingRequestWrapper.java
CachingResponseWrapper.java
CLAUDE.md
McpServerManager.java
PublicBindingConsentDialog.java
RequestLoggingFilter.java
ResilientStreamableServerTransportProvider.java
services/
AnalysisJob.java
AnalysisJobManager.java
AnalysisJobRunner.java
AnalyzeRequest.java
CLAUDE.md
DiffJob.java
DiffJobKind.java
DiffJobManager.java
DiffJobRunner.java
DiffWork.java
JobLog.java
JobStatus.java
RevaMcpService.java
tools/
AbstractToolProvider.java
bookmarks/
BookmarkToolProvider.java
CLAUDE.md
callgraph/
CallGraphToolProvider.java
CLAUDE.md
CLAUDE.md
comments/
CLAUDE.md
CommentToolProvider.java
constants/
CLAUDE.md
ConstantSearchToolProvider.java
data/
CLAUDE.md
DataToolProvider.java
dataflow/
CLAUDE.md
DataFlowToolProvider.java
datatypes/
CLAUDE.md
DataTypeToolProvider.java
decompiler/
CLAUDE.md
DecompilerToolProvider.java
diff/
CLAUDE.md
DiffSession.java
DiffSessionManager.java
DiffToolProvider.java
functions/
CLAUDE.md
FunctionToolProvider.java
imports/
CLAUDE.md
ImportExportToolProvider.java
memory/
CLAUDE.md
MemoryToolProvider.java
ProgramValidationException.java
project/
CLAUDE.md
ProjectToolProvider.java
scripts/
CappedWriter.java
CLAUDE.md
GhidraDirectoryFactory.java
GhidraScriptRunner.java
PyGhidraNotAvailableException.java
PythonScriptExecutor.java
ScriptDirectoryManager.java
ScriptFileEditor.java
ScriptToolProvider.java
strings/
CLAUDE.md
StringToolProvider.java
structures/
CLAUDE.md
StructureToolProvider.java
symbols/
CLAUDE.md
SymbolToolProvider.java
ToolProvider.java
vtable/
CLAUDE.md
VtableToolProvider.java
xrefs/
CLAUDE.md
CrossReferencesToolProvider.java
ui/
CaptureDebugAction.java
CLAUDE.md
FollowMeAction.java
RevaProvider.java
util/
AddressUtil.java
CLAUDE.md
DataTypeParserUtil.java
DebugLogger.java
DecompilationContextUtil.java
DecompilationDiffUtil.java
MemoryUtil.java
NetworkUtil.java
ProgramLookupUtil.java
ProgramPersistenceUtil.java
RevaInternalServiceRegistry.java
RevaToolLogger.java
SchemaUtil.java
SimilarityComparator.java
SymbolUtil.java
ToolResultBuilder.java
VersionTrackingUtil.java
resources/
help/
shared/
note.png
tip.png
warning.png
images/
README.txt
reva_cli/
__init__.py
__main__.py
.gitignore
launcher.py
project_manager.py
stdio_bridge.py
test/
test.slow/
CLAUDE.md
java/
reva/
AnalyzedFixtureSupport.java
AnalyzedFixtureSupportIntegrationTest.java
CLAUDE.md
headless/
HeadlessLauncherApiKeyIntegrationTest.java
HeadlessLauncherToolGroupIntegrationTest.java
plugin/
ConfigManagerSecurityTest.java
RevaPluginIntegrationTest.java
RevaPluginMcpIntegrationTest.java
RandomPortRegressionIntegrationTest.java
RevaIntegrationTestBase.java
server/
PublicBindingGuardIntegrationTest.java
PublicBindingRevertIntegrationTest.java
ToolGroupRegistrationIntegrationTest.java
services/
AnalysisJobCancelOnCloseIntegrationTest.java
AnalysisJobRunnerIntegrationTest.java
tools/
bookmarks/
BookmarkToolProviderIntegrationTest.java
callgraph/
CallGraphToolProviderIntegrationTest.java
comments/
CommentToolProviderIntegrationTest.java
constants/
ConstantSearchToolProviderIntegrationTest.java
data/
DataToolProviderIntegrationTest.java
dataflow/
DataFlowToolProviderIntegrationTest.java
datatypes/
DataTypeToolProviderIntegrationTest.java
decompiler/
DecompilerIncomingReferencesLimitTest.java
DecompilerToolProviderIntegrationTest.java
diff/
DiffAddCorrelatorIntegrationTest.java
DiffCalleeNamesIntegrationTest.java
DiffCreateSessionAsyncIntegrationTest.java
DiffSessionPersistenceIntegrationTest.java
DiffStagedCorrelationIntegrationTest.java
DiffStatusCancelIntegrationTest.java
DiffTestPrograms.java
DiffToolProviderIntegrationTest.java
DiffTransferMarkupAsyncIntegrationTest.java
functions/
CreateFunctionDisassembleIntegrationTest.java
FunctionPrototypeToolProviderIntegrationTest.java
imports/
ImportExportToolProviderIntegrationTest.java
memory/
MemoryToolProviderIntegrationTest.java
project/
AnalysisCancelIntegrationTest.java
AnalysisStatusIntegrationTest.java
AnalyzeProgramAsyncIntegrationTest.java
AnalyzeProgramToolProviderIntegrationTest.java
ProjectToolProviderNestedArchiveIntegrationTest.java
ProjectToolProviderVersionControlIntegrationTest.java
scripts/
ScriptToolProviderIntegrationTest.java
strings/
StringToolProviderIntegrationTest.java
structures/
StructureToolProviderIntegrationTest.java
symbols/
SymbolToolProviderIntegrationTest.java
vtable/
VtableToolProviderIntegrationTest.java
xrefs/
CrossReferencesToolProviderIntegrationTest.java
resources/
logback.xml
java/
reva/
DecompilerNativeHint.java
DecompilerNativeHintTest.java
plugin/
ConfigChangeTest.java
ConfigManagerPortTest.java
ConfigManagerScriptOptionsTest.java
ConfigManagerToolGroupTest.java
FollowMeServiceTest.java
RevaPluginHeadlessIntegrationTest.java
RevaPluginUnitTest.java
ToolGroupTest.java
RevaHeadlessIntegrationTestBase.java
server/
PublicBindingConsentDialogTest.java
ResilientStreamableServerTransportProviderTest.java
services/
AnalysisJobManagerTest.java
DiffJobManagerTest.java
DiffJobRunnerTest.java
JobLogTest.java
tools/
AbstractToolProviderUnregisterTest.java
decompiler/
DecompilerToolProviderTest.java
PaginationResultHelperTest.java
scripts/
CappedWriterTest.java
PyGhidraNotAvailableExceptionTest.java
PythonScriptExecutorTest.java
ScriptDirectoryManagerTest.java
ScriptFileEditorTest.java
ScriptToolProviderTest.java
strings/
StringToolProviderTest.java
util/
AddressUtilTest.java
DecompilationDiffUtilTest.java
NetworkUtilTest.java
ProgramPersistenceUtilTest.java
... 43 moreFAQ
reverse-engineering-assistant is a Claude Code plugin with 6 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes binary-triage, ctf-crypto, ctf-pwn. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is reverse-engineering-assistant?
- A Ghidra extension that provides a Model Context Protocol (MCP) server for AI-assisted reverse engineering ReVa (Reverse Engineering Assistant) is a Ghidra MCP server that enables AI language models to interact with Ghidra's powerful reverse engineering
- How do I install reverse-engineering-assistant?
- Run these in Claude Code: /plugin marketplace add cyberkaida/reverse-engineering-assistant then /plugin install ReVa@reva. Then prompt normally.
- Does reverse-engineering-assistant auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is reverse-engineering-assistant free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.