RE Toolkit (1/5): MCP servers for reverse engineering — GhidraMCP, IDA MCP, Binary Ninja, radare2

Reading thousands of stripped functions, renaming variables and guessing data structures is the slowest part of reverse engineering. In 2025–2026 a new class of repos appeared to hand that work to AI agents: MCP servers that connect Ghidra, IDA Pro, Binary Ninja and radare2 to Claude Code, Cursor, Codex and others. The agent can list functions, read decompiled code, rename and comment directly inside your project. This first post of the RE Toolkit series picks the five repos worth using, shows how to install them, and covers the risks few people mention.

GitHub: https://github.com/LaurieWired/GhidraMCP · about 11.8k stars · Java/Python · Apache-2.0

Five MCP servers for reverse engineering

Note: the mrexodia/ida-pro-mcp README itself now recommends the official Hex-Rays server. On IDA 9.4 or later, pick HexRaysSA/ida-mcp and disable other IDA MCP servers so the agent does not confuse tools.

Installing GhidraMCP for Claude Code

1. Install Ghidra and uv. Download the plugin zip from the repo's Releases (matching your Ghidra version).
2. In Ghidra: File → Install Extensions → +, pick the zip, restart, then enable GhidraMCPPlugin under File → Configure → Developer. The plugin serves HTTP on 127.0.0.1:8080.
3. Register the MCP server with Claude Code:

claude mcp add ghidra -- uvx --from git+https://github.com/LaurieWired/GhidraMCP \
  ghidra-mcp --ghidra-server http://127.0.0.1:8080/

Clients configured by JSON (Claude Desktop, Cursor, VS Code) use the same uvx command inside an mcpServers block.

The alternatives

# IDA Pro (official Hex-Rays)
uvx ida-hcli mcp install

# Binary Ninja: install the plugin via Plugins > Manage Plugins, then configure the client
npx -y binary-ninja-mcp --host localhost --port 9009

# radare2
r2pm -Uci r2mcp
# client config: "command": "r2pm", "args": ["-r", "r2mcp"]

A sample session

Open the binary in Ghidra and let auto-analysis finish before handing it to the agent. Good prompts are narrow and verifiable:

List the functions that call recv/send. For each, decompile it, summarise
it in 1–2 sentences and propose a new name. ONLY rename when confident;
mark uncertain parts as "guess". Do not execute the binary.

This plays to the LLM's strengths (reading C pseudocode, inferring intent, naming) while you still review the results in a familiar UI.

Risks to know

• Prompt injection from the binary itself: strings inside a malware sample can contain instructions aimed at the AI ("ignore previous instructions…"). Do not give the agent shell or network access when analysing untrusted samples.
• Hallucination: agents produce very convincing but wrong names. Treat AI-assigned names as hypotheses; verify with xrefs, constants or real debugging (see the dynamic analysis post).
• Open ports: these plugins run HTTP servers. Keep them on 127.0.0.1; bind radare2-mcp to 0.0.0.0 only with bearer authentication enabled.
• Data leaves your machine: decompiled code is sent to the LLM provider. For customer or NDA binaries, check the contract first, or use a local model (LM Studio is among the supported clients).
• Legal: only analyse software you own or are authorised to; see the REA reality check for realistic limits.

How to apply it

• Dev: Start with GhidraMCP (fully free). Try it on a crackme or a binary you compiled yourself and compare AI-assigned names with the real ones.
• Tech Lead: Standardise an analysis VM with Ghidra + MCP and no outbound network except the LLM API; the agent may read and rename, never execute.
• PM: MCP shrinks the "understanding" phase from days to hours for jobs like legacy systems with lost source, but an expert still has to review results before decisions are made.