# reverse-engineering-assistant [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/cyberkaida/reverse-engineering-assistant  
**GitHub Stars:** 882  
**Views:** 8  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/reverse-engineering-assistant

## Description
MCP server for reverse engineering tasks in Ghidra 👩‍💻

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "reverse-engineering-assistant": {
    "command": "uvx",
    "args": ["--from","reverse-engineering-assistant","mcp-reva"],
    "env": {
      "GHIDRA_INSTALL_DIR": ""
    }
  }
}
```

**Requires environment variables:** `GHIDRA_INSTALL_DIR` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What reverse-engineering-assistant does

ReVa connects an MCP-compatible AI client to Ghidra's reverse-engineering environment. It is intended for examining binaries, shared libraries, firmware images, and related project files. The server lets an agent inspect program structure, ask about functions and instructions, follow cross-references, and use Ghidra's analysis state while producing explanations or reports.

Its design favors many focused tools over one broad operation. Results include nearby information such as namespaces, links to related references, and decompilation context. This gives the model smaller pieces of evidence to evaluate and encourages an investigation path similar to human reverse engineering. The approach is intended to support large binaries and longer analysis sessions.

## How it works

ReVa runs as a Ghidra extension and provides an MCP endpoint from within Ghidra or through a headless Ghidra process. Assistant mode requires Ghidra to be running with a project open. The server listens over streamable HTTP on port 8080 by default, and the port can be changed in Ghidra's project settings. Multiple clients can connect to the same interactive instance.

Headless mode starts Ghidra without its user interface and manages the analysis projects for the session. Projects created in this mode are temporary and are cleaned up automatically. This mode suits automated analysis, CI/CD pipelines, containerized workflows, and PyGhidra scripts. The MCP client configuration determines which mode is used.

ReVa can also operate alongside other MCP servers. For example, a GitHub MCP server can provide source-code access, while a web-search MCP server can supply external research during an investigation.

## Setup and configuration

Install the release matching the exact Ghidra version through Ghidra's extension manager, or build from source with `GHIDRA_INSTALL_DIR` pointing to the Ghidra installation directory and `gradle install`. ReVa supports Ghidra 12.0 and later. Ghidra 12.2 and later requires Java 25; earlier supported versions require Java 21.

After installation, enable the ReVa Application Plugin in the Project view and the ReVa Plugin in the Code Browser tool. Save the Code Browser tool configuration so the plugin remains enabled by default.

For headless Claude Code use, set `GHIDRA_INSTALL_DIR`, install the package with `uv tool install reverse-engineering-assistant`, and register the `mcp-reva` command. Headless projects are stored beneath `.reva/projects/` in the working directory. In assistant mode, configure the client to use the server URL ending in `/mcp/message`.

ReVa exposes the PyGhidra scripting environment. The default setup listens only on localhost and permits scripting tools. If the server is exposed on a public interface, enable API-key authentication or disable scripting tools in the settings.

## Tools and capabilities

- Inspect program structure, functions, strings, namespaces, and cross-references.
- Read decompilation and investigate code at specific addresses.
- Rename variables and adjust data types during analysis.
- Examine encryption-related code and document where it is used.
- Import multiple binaries and compare their changes.
- Work with large binaries and complete firmware images.
- Run PyGhidra-based automation in headless workflows.
- Support reverse-engineering reports, class diagrams, and CTF-oriented analysis when directed by the connected model.

_Full upstream README: https://allmcps.com/mcp/reverse-engineering-assistant/readme_