Zfinix/eleven

Eleven is worth a look if you already use an ACP agent and want it working inside a real disassembly context rather than pasting snippets into a chat. It is a young, single-developer app, so treat it as an experiment on real targets first.

The problem

You have an app, ELF/PE/Mach-O binary, APK or GPU kernel and want to understand what it does. Normally that means launching Ghidra or Rizin for disassembly, a separate tool for Android, and a chat window for the model, then manually copying function names and pseudocode between them. Eleven collapses the reading and the asking into one window: the agent opens a function, follows references, proposes renames and leaves notes while you approve each change. The result is a project file that keeps the decompiled context, chat history and patches together.

What's different

The mechanism is the interesting part. Eleven exposes its own MCP tools so an agent can drive the window — open a function, switch views, rename, change types, propose byte patches — instead of only talking about code you paste. Native code is read by Ghidra through REA, or by Rizin when you want faster file opening; APKs go through jadx, with optional apktool smali when installed. Every change, human or agent, is logged with its author and can be undone, and the original file is not modified when you write a patched copy.

The trade-off is coupling. The quality of answers depends on the agent and on the decompiler engine you pick: Rizin opens fast, Ghidra is slower but the README says it gives the clearest pseudocode. The app also spreads across several external pieces (Ghidra, Java, jadx, LLDB), so first-run setup is doing real work before you can judge it. Multi-agent support (Aster, Claude, Codex, Gemini, Cursor, Copilot, OpenCode) is documented, but the practical experience will vary by adapter. This is not a replacement for learning reversing; it is a faster way to navigate code you already know how to reason about.

Who should try it

Good fit: a security researcher or malware analyst who already uses an ACP agent daily and wants it to see live pseudocode, cross-references and a debugger in the same place, especially when comparing two builds or reconstructing source from Swift binaries. Poor fit: someone who wants a pure headless decompiler, a CI-friendly binary analysis pipeline, or an unauthenticated offline tool — Eleven is a desktop app, and its value comes from an agent in the loop. Android work needs jadx installed separately, which matters if your targets are mostly APKs.

Requirements and limitations

macOS needs 14+ on Apple Silicon; Windows is x64 only; Linux is x64 AppImage or tarball. First run installs or expects Ghidra 12.x with Java 21, an agent, and for Android jadx, with apktool optional for smali. Building from source additionally needs Bun, Node 20+ and a checkout of REA 6.x next to the repo or an ELEVEN_REA pointer; see the project instructions. The debugger needs lldb-dap, and patching writes a separate copy, so ongoing care means keeping the original and your project file straight rather than trusting a single undo.

HotRepo's take

HotRepo first tracked the repo on 2026-10-24 and recorded 863 total stars at #10 on the TypeScript NEW-REPOSITORY board on 2026-10-25 — a new-project rank, not overall Trending, and not a daily growth figure. That is a snapshot of early attention, not proof of staying power; with only two recorded dates, persistence cannot be judged. Before investing time, check the MCP tools documentation to confirm what agents are allowed to touch in your workflows.