ReAgent CLI
Rebuilds C and C++ functions from compiled programs through Ghidra: one model writes the code and another checks it.
- 2,434 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Dual use: rebuilding source from binaries also fits analysing third-party closed code, and licenses often forbid disassembly.
- Build and test commands from the config run with user privileges, so only vetted ones should run.
- Code and binary data go to the chosen model provider and consume paid calls.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/reagentDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Dual use: rebuilding source from binaries also fits analysing third-party closed code, and licenses often forbid disassembly.
- Build and test commands from the config run with user privileges, so only vetted ones should run.
- Code and binary data go to the chosen model provider and consume paid calls.
This is third-party code. Review the repository files before installing.
What it does
ReAgent is the `re-agent` command-line tool that reconstructs C and C++ function source from a compiled program. Evidence comes from Ghidra through a separate `ghidra-bridge`: decompilation, cross-references, structs, vtables, strings and the control-flow graph. One model writes a candidate and a second one reviews it, with a bounded number of fix rounds. A structural verifier then compares the code with the assembly, and the configured build and tests run in a copy of the project. Each function gets a GREEN, YELLOW or RED parity label. The original tree stays untouched: output goes to an overlay and reports. Claude, Codex or any OpenAI-compatible API can fill the model roles.
Who it is for. Reverse engineers and decompilation-project maintainers rebuilding source for their own or lawfully studied programs.
Good fit when
- A decompilation project covers hundreds of class functions and dependencies set the order.
- One model drafts a function at a Ghidra address while another checks it against the assembly.
- Before a whole-class run, try one function and cap the number of model calls.
- The team wants reports and evidence packets to review disputed spots by hand.
- Recovered code should pass build and tests in an isolated project copy.
Not a fit when
- The license forbids disassembly and you have no right to study the program.
- You need a mathematical proof of equivalence: the checks here are conservative.
- Ghidra and the project export are not ready and there is no time for the bridge.
- The goal is to bypass protection, anti-cheat or license checks: the tool recovers code, it does not crack.
Example request
Set up re-agent for this project, run `re-agent doctor` and rebuild one function at 0x401000 with a small model-call limit.Limitations
Python 3.10 or newer, Ghidra with a configured `ghidra-bridge` and at least one model are required: a Claude or OpenAI-compatible API key, or authenticated `claude` and `codex` commands. Each function spends many model calls and cost depends on the chosen models and rounds, so the README advises setting a limit. Structural and parity checks catch mismatches but do not prove binary equivalence. Build and test commands from the config run on the user machine, so trust only your own.
How to disable. Remove the package with `python3 -m pip uninstall auto-re-agent` and delete `re-agent.yaml` from the project. Reports live in `reports/re-agent`; delete that folder separately if unwanted.
FAQ
Which models can I connect?
Claude by API or through the local `claude`, Codex CLI and any OpenAI-compatible API. Pick different models for author and checker in the `agents` block of `re-agent.yaml`.
What counts as a success?
All four conditions at once: the checker model returned `PASS`, the verifier found no strong mismatch, build and tests passed, and parity is not blocked at RED or YELLOW.
Does the tool change the project sources?
No. The candidate goes to an overlay and checks run in a temporary copy. The tool never commits or pushes.
Where do I start?
`re-agent doctor` shows what is missing. Then `re-agent reverse --address 0x401000` rebuilds one function, after which a whole class can run.
How much does a run cost?
Cost depends on models, evidence volume and target complexity. The README advises a small call limit and starting with one function; `re-agent estimate` helps size the spend.
Discussion
No questions or reviews yet.
Related
CLI toolsA Ghidra MCP server: the agent decompiles, renames variables, builds cross references and works through a binary via a set of small tools
A Rust CLI for Ghidra: binary import, decompilation, cross-references and type editing with JSON output for an agent
MCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
MCP server and Ghidra plugin that lets an agent decompile binaries, follow cross-references and rename functions in an open project
A defensive layer for shipped builds against AI reverse-engineering agents: decoys, analyzer overload and unchanged runtime behavior
RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| ReAgent (this card) | no | 2,434 | ||
| Ghidra MCP Server | no | not required | 6,207 | gives an agent Ghidra access over MCP; ReAgent runs the function recovery and checking loop itself |
| Ghidra CLI | no | 267 | a command-line wrapper over Ghidra; ReAgent adds models, a verifier and parity |
README in short
The README has a ready prompt for a setup agent, a quick start, model provider setup, the 11 built-in parity signals and the migration of validation commands to argument arrays.