cyberkaida/reverse-engineering-assistant

What it does

ReVa is a Ghidra extension that runs a Model Context Protocol (MCP) server, letting AI clients query and act on Ghidra's reverse-engineering facilities. Rather than one large prompt, it exposes many small tools with schemas and tolerant input handling; decompilation results come with namespace and cross-reference context so the model can explore a binary the way an analyst would. The project targets large binaries and firmware images by keeping tool output focused and reducing context growth.

It is aimed at reverse engineers who already use Ghidra and want an LLM assistant inside the same workflow. Because it is an MCP server, it can be combined with other MCP servers, such as source lookup or web search, to enrich analysis MCP overview.

Install

ReVa requires Ghidra 12.0 or newer. Ghidra 12.2+ needs Java 25; earlier supported versions need Java 21. Download the release matching your exact Ghidra version from the releases page and install it through Ghidra's extension manager. Building from source requires setting GHIDRA_INSTALL_DIR and running Gradle:

export GHIDRA_INSTALL_DIR=/path/to/ghidra
gradle install

After installation, enable ReVa Application Plugin in the Project view via File → Configure → Configure all plugins, then enable ReVa Plugin in the Code Browser and save the tool so it stays enabled installation notes.

Quick start in assistant mode

Start Ghidra with ReVa installed and open a project. The MCP server listens on port 8080 by default over the streamable HTTP transport and can be changed in Ghidra's project settings. With Claude Code:

claude mcp add --scope user --transport http ReVa -- http://localhost:8080/mcp/message

Run claude while Ghidra is open; use /mcp in the chat to confirm the connection. To avoid per-tool permission prompts, add a rule for mcp__ReVa with /permissions assistant setup. VSCode's built-in MCP client can be pointed at the same HTTP endpoint through user settings VSCode setup.

Headless mode

For automation, CI/CD, Docker, or PyGhidra scripting, ReVa can run without the Ghidra GUI and manage Ghidra startup and ephemeral projects itself:

export GHIDRA_INSTALL_DIR=/path/to/ghidra
uv tool install reverse-engineering-assistant
claude mcp add --scope user ReVa -- mcp-reva
claude -p "Import /bin/ls with ReVa and tell me how it works"

Projects are created under .reva/projects/ in the current working directory, so running the client from the same directory lets you import multiple files into one project headless usage. PyGhidra users can start RevaHeadlessLauncher, wait for the server, and stop it from their own scripts PyGhidra example.

Claude Code skills

The repository includes a Claude Code marketplace with ReVa skills for binary triage, deep analysis, cryptography analysis, and CTF guides. Add it with:

claude plugin marketplace add cyberkaida/reverse-engineering-assistant

The skills are added to the Claude Code installation and can be extended over time marketplace setup.

Usage constraints

ReVa exposes the PyGhidra scripting environment. If you let it listen on a public interface, either enable API key authentication or disable the scripting tools; the default binds to localhost with scripting enabled. Ghidra and Java versions must match the release you install, and headless projects are session-scoped and cleaned up automatically, so long-lived analysis should use assistant mode or your own project management. Licensing is Apache-2.0.

HotRepo's take

The only recorded HotRepo snapshot is 2026-11-04, when ReVa appeared on the Java daily list at position 14 with 16 stars gained and 934 total stars. That is a single-day record and does not establish a trend. What stands out from the project itself is the deliberate tool design for LLM use — focused outputs, tolerant schemas, and cross-reference context — and the availability of both an interactive Ghidra UI mode and a headless pipeline mode. Those are the features worth evaluating against a specific reverse-engineering workflow, rather than the star count.