Reverse Engineering Assistant (ReVa) by Cyberkaida is a Ghidra extension designed to connect AI language models with Ghidra's powerful reverse engineering capabilities. Its core MCP server component is built with Java, distributed as a Ghidra extension. ReVa also includes a Python component for headless operations and AI client interaction, available as a Python package. This tool aims to enhance reverse engineering workflows by allowing AI agents to interact with and analyze binaries within the Ghidra environment.

What does Reverse Engineering Assistant connect to?

Reverse Engineering Assistant primarily connects to a running Ghidra instance, acting as an MCP server. This connection allows AI language models to interact directly with Ghidra's functionalities, enabling advanced analysis tasks. The core server component is built using Java. ReVa's design positions it as an MCP server specifically crafted to integrate AI capabilities into the Ghidra reverse engineering platform.

Core features and tools

ReVa exposes specific callable tools, known as "skills," for AI agents. These include ctf-pwn, ctf-rev, and deep-analysis. The tool also provides various small tools for tasks such as identifying algorithms, renaming variables, and fixing datatypes. Additionally, Reverse Engineering Assistant supports running Python scripts, expanding its utility for custom analysis. It supports the streamable MCP transport using SSE and listens on port 8080 by default, which is configurable.

Who is it for?

Reverse Engineering Assistant targets reverse engineers, malware analysts, security researchers, and CTF participants. It is built to assist professionals who need to automate or enhance their binary analysis within Ghidra using AI. Confirmed compatible AI clients include Claude Code, GPT-4, Cursor, Copilot, and Gemini, alongside local models like Llama 3. This is not the right fit if you do not use Ghidra or require AI integration for reverse engineering tasks.

How to get started

The server authenticates using an API key generated randomly when the mcp-reva server starts Ghidra. MCP clients connect to the ReVa MCP server, typically on port 8080, using the streamable MCP transport with SSE.

Use cases

• Deep analysis: identifying algorithms, renaming variables, and fixing datatypes in real-time within the Ghidra UI.
• Automated analysis: integrating into CI/CD pipelines by running ReVa in headless mode for initial triage and deep analysis of malicious parts.
• Binary diffing and version tracking: supporting the import and comparison of large and small files over long sessions.

Reverse Engineering Assistant offers a powerful bridge between Ghidra and various AI language models, enhancing binary analysis workflows. It provides specialized skills and supports popular AI clients, enabling automation and deeper insights for security professionals. The tool's ability to run in headless mode also supports integration into automated pipelines.