A year ago, "AI reverse engineering" meant pasting a decompiled function into a chat window and asking what it did. In 2026 it means something different: an agent such as Claude, Codex or a local model drives the disassembler itself - it lists functions, follows cross-references, renames variables and reads pseudocode, one tool call at a time, through the Model Context Protocol (MCP).
This guide explains how that works, which tools exist for Ghidra, IDA Pro, Binary Ninja and Android, what a real session looks like, what the first serious benchmark found, and the limits you will hit. It also covers the part most tutorials skip: what you are allowed to reverse engineer in the UK, the EU and the US.
Reverse engineering is recovering how a program works without its source code. The slow part has always been the reading: thousands of unnamed functions like FUN_00401a30, registers instead of variables, and no comments. Language models are good at exactly that kind of pattern reading - they recognise a CRC loop, a string decoder or a licence check far faster than a person scrolling through assembly.
What changed is tool access. An MCP server exposes the disassembler's functions - "decompile this address", "list cross-references", "rename this symbol", "search strings" - as tools the model can call. The model is no longer guessing from a snippet you chose; it navigates the binary itself and comes back with findings and the evidence behind them.
The usual stack has four parts:
A community index of AI reverse engineering projects, awesome-ai-reverse-engineering, lists 122 repositories; 74 of them are MCP servers or plugins for disassemblers. The ones you will meet first:
| Tool | Engine | What it gives the agent |
|---|---|---|
| GhidraMCP (LaurieWired) | Ghidra (free) | Decompile, list functions and strings, rename symbols in a running Ghidra |
| IDA Pro MCP (mrexodia) | IDA Pro 8.3+ | A broad tool set over IDA's analysis; IDA Free is not supported |
| Hex-Rays IDA MCP (official) | Recent IDA versions | Vendor-maintained server; newer and smaller community |
| Binary Ninja MCP | Binary Ninja | Plugin with an embedded server; a headless variant exists |
| jadx MCP | jadx (Android) | Decompiled Java/Kotlin classes, manifest, references |
| Frida MCP | Frida | Runtime hooks on a live process - observe what the code really does |
| radare2 MCP | radare2 | Command-line engine, scriptable and free |
| REA (morluto/rea) | Hopper, Ghidra or IDA, plus built-in parsers | One MCP for native binaries, JavaScript/Electron, .NET, APKs, websites and captures |
If you only want to try the idea, Ghidra plus GhidraMCP is the zero-cost route. If you already pay for IDA, the IDA servers are more capable. If your targets vary - an Electron app this week, a .NET DLL next week - a multi-engine MCP like REA saves you wiring up five separate servers.
The clearest public write-up so far is Quesma's River Raid case study. The author loaded the 8 KB Atari 8-bit ROM into Ghidra as raw 6502 code, connected Claude through GhidraMCP, and asked for infinite lives. What happened is a good summary of the whole field:
DEY ($88) with NOP ($EA) at offset 0x355. The MCP server had no write access, so the human applied it with dd. In the emulator, the lives stayed at 3.$0000 instead of $A000, so every cross-reference pointed nowhere. Claude diagnosed the problem correctly but could not rebase the program itself.
That pattern - excellent at reading and locating, weak at broad context and anything that needs write access - matches what most people report.
CrackMeBench (2026) tests agents on symbol-poor CrackMe binaries built from C, Rust and Go templates. Each agent gets a shell in a network-less Docker sandbox with standard reverse engineering tools, a five-minute budget per task and three scored submissions. The program itself is the judge: the agent must produce a serial or key generator the binary accepts.
| Model | Generated tasks (12) | Harder half (6) | Public CrackMes (8) |
|---|---|---|---|
| GPT-5.5 | 11/12 | 5/6 | 3/8 |
| Claude Opus 4.7 | 7/12 | 2/6 | 2/8 |
| Kimi K2 | 5/12 | 1/6 | 1/8 |
Two things stand out. Results drop sharply on the harder and the real-world public tasks, and the gap between models is large. Treat any single leaderboard as a snapshot, though - the tasks are small, the budget is five minutes, and models change every few months.
Every tool follows the same shape: install the engine, install its plugin or extension, start the MCP server, then register that server with your agent. In Claude Code that last step is claude mcp add; in Claude Desktop it is the MCP section of the config file. Follow each project's README for the exact commands - they change between releases, and the Quesma author counted four separate points of failure in the chain (client, MCP server, Ghidra extension, Ghidra).
REA tries to collapse that into one command:
npx rea-agents setup --dry-run # print the plan, change nothing
npx rea-agents setup # register the MCP server with your agents
I tried exactly that on Windows with Node.js 22.18.0 to inspect my own website's build output. The dry run planned nothing and returned status: needs_human with the remediation "Install Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+". Two lessons: check the runtime requirement before anything else, and always run the dry run first - a setup tool that edits your agent's configuration should show you its plan before it writes a byte.
Once a server is registered, start small. Good first prompts are "list the exported functions and summarise what each module does" and "find where this string is used and explain the check around it". Ask for addresses and evidence with every claim, so you can verify instead of trusting.
This is general information, not legal advice - get proper advice before reverse engineering anything commercial.
Licence terms matter too: many end-user licences forbid reverse engineering, and the AI provider's own usage policy applies to what you ask the model to do. Analysing your own code, open-source software, CTF challenges or malware samples for defence is the safe ground.
The agent-harness side of this story is moving just as fast. If you want to see how an open agent framework is put together from the inside, read my teardown of DeepSeek Harness. And if you are curious what this kind of bundle inspection finds on a real website, here is how I fixed unused JavaScript and LCP render delay in Next.js.
What is AI reverse engineering?
It is using a language model to analyse compiled software. In 2026 that usually means an agent such as Claude driving a disassembler like Ghidra or IDA through an MCP server - listing functions, following cross-references and reading decompiled code - and reporting findings with the addresses behind them.
What is Ghidra MCP?
GhidraMCP is an open-source Model Context Protocol server that connects an AI agent to a running Ghidra instance, so the agent can decompile functions, search strings and rename symbols itself instead of working from snippets you paste in.
Can Claude reverse engineer software?
Yes, when it is connected to a disassembler through MCP. It is strong at recognising patterns and locating the code that matters, weaker at broad context, and many MCP servers are read-only, so patching often stays manual. Always ask for evidence and verify its claims.
Is Ghidra MCP or IDA Pro MCP better?
Ghidra with GhidraMCP is free and simple, which makes it the best way to start. IDA Pro MCP offers a broader tool set but needs a paid IDA Pro licence (IDA Free is not supported). There is no published head-to-head benchmark of the two.
What is REA (Reverse Engineer Anything)?
REA is an open-source MCP and CLI that gives an agent one set of reverse engineering tools across native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs, websites and network captures. It uses Hopper, Ghidra or IDA for deep native analysis. Setup is npx rea-agents setup, which needs Node.js 22.19 or newer.
How accurate are AI agents at reverse engineering?
In the CrackMeBench benchmark, GPT-5.5 solved 11 of 12 generated tasks, Claude Opus 4.7 solved 7 and Kimi K2 solved 5, but every model scored far lower on harder and real-world tasks. Treat results as a snapshot and verify the agent's work.
Is it legal to reverse engineer software with AI?
It depends on what and why. The UK, EU and US all allow some reverse engineering for interoperability and research, but licence terms and anti-circumvention laws can restrict it. Analysing your own code, open-source software, CTF challenges or malware for defence is safe ground; get legal advice for anything commercial.
Originally published on knowledgemarkg.com.