ReVa MCP
A Ghidra MCP server: the agent decompiles, renames variables, builds cross references and works through a binary via a set of small tools
- 958 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Exposes the PyGhidra environment, meaning arbitrary code execution
- A reverse engineering tool; use it on your own or authorized binaries
- A public interface without an API key grants access to analysis and scripting
Install
- Works in
Manual install
claude mcp add --scope user --transport http ReVa -- http://localhost:8080/mcp/messageAssistant mode: Ghidra must be open with a project.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Exposes the PyGhidra environment, meaning arbitrary code execution
- A reverse engineering tool; use it on your own or authorized binaries
- A public interface without an API key grants access to analysis and scripting
This is third-party code. Review the repository files before installing.
What it does
ReVa is a Ghidra extension that runs an MCP server and exposes Ghidra to an AI agent. Its approach is built on many small tools: decompilation with context about names and references, variable renaming, type work, string search and diffing two programs. This set reduces context use and helps the model explore a binary step by step, the way a human does. It works in two modes: an assistant inside the Ghidra UI over streamable HTTP on port 8080 and headless for automation and pipelines. The repository ships a Claude Code plugin marketplace with skills for triage, deep analysis, cryptography and CTF.
Who it is for. For reverse engineers and analysts who work in Ghidra and want to connect an agent to the analysis.
Good fit when
- You run analysis in Ghidra and want an assistant in the same project
- You need headless mode for automation and pipelines
- You work through a large binary or firmware and context economy matters
Not a fit when
- You analyze someone else's proprietary code without rights
- Your Ghidra is below version 12.0
- The server is exposed on a public interface without an API key and with scripting enabled
Example request
Start from main, examine the program in detail and rename variables as you goMCP
- Transport
- http, stdio
- Authentication
- API key
Environment variables
GHIDRA_INSTALL_DIR- Path to the Ghidra install, required for headless mode.
Limitations
It needs Ghidra 12.0 or newer, and headless mode uses the GHIDRA_INSTALL_DIR variable. ReVa exposes the PyGhidra environment, so when listening on a public interface the authors advise enabling an API key or disabling the scripting tools. By default the server listens on localhost. Headless projects are ephemeral and cleaned up after the session.
How to disable. Disable the ReVa plugins in Ghidra settings and remove the MCP entry from the client. The headless package is removed with uv tool uninstall reverse-engineering-assistant.
FAQ
How does assistant mode differ from headless?
In assistant mode ReVa runs inside an open Ghidra project over HTTP. In headless it starts Ghidra itself and creates an ephemeral project, which suits automation.
Are there Claude Code skills?
Yes. The repository has a plugin marketplace with skills for triage, deep analysis, cryptography and CTF.
How is ReVa different from other MCP servers for Ghidra?
ReVa is a Ghidra extension that starts an MCP server. The approach rests on many small tools: decompilation with context about names and references, variable renaming, cross references and binary analysis.
How do I connect ReVa Ghidra MCP?
Install the extension in Ghidra per the project instructions, start the MCP server and connect the client. It works with Claude Code and VS Code. Risk is high because the agent changes the Ghidra database, analyze only permitted files.
Discussion
No questions or reviews yet.
Related
MCP serversMCP server and Ghidra plugin that lets an agent decompile binaries, follow cross-references and rename functions in an open project
RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
An MCP server for the Ghidra disassembler: hundreds of tools for reverse engineering, decompilation, renaming, structures, emulation and debugging
A Ghidra extension with an MCP server: an agent reads pseudocode and disassembly, builds call graphs and edits names, types and structures via 100 tools
MCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| ReVa (this card) | no | API key | 958 | |
| REA | no | not required | 454,751 | MCP server and CLI for reverse engineering |
| GhidrAssistMCP | no | not required | 810 | a Ghidra extension with an MCP server |
README in short
The README explains ReVa's small-tools approach that reduces context use and gives example questions about a binary. It describes installing the Ghidra extension and enabling two plugins, and two modes: assistant over streamable HTTP on port 8080 and headless for automation. It gives config for Claude Code and VS Code, PyGhidra integration and installing the Claude Code plugin marketplace with skills. It notes the Ghidra 12.0 requirement and a warning about the API key on a public interface.