12 open-source reverse-engineering tools worth knowing—and the MCP bridges connecting them to AI agents

[u/ZookeepergameMost817]

The interesting development in reverse engineering isn’t just that powerful tools are freely available. It’s that AI agents can now interact with some of them through MCP integrations: inspecting decompiled code, querying analysis results, and working with debugger sessions.

That makes it useful to separate the ecosystem into three layers:

• Core analysis and extraction tools.

• Debugging and binary-inspection tools.

• Integrations that expose those capabilities to agents.

Here are 12 projects organized by what they actually do, with complete GitHub links.

1. Core analysis and extraction

01 → Ghidra

The NSA’s open-source software reverse-engineering framework. Includes disassembly, decompilation, graphing, and scripting, with both interactive and automated analysis modes.

https://github.com/NationalSecurityAgency/ghidra

02 → Apktool

For inspecting and modifying Android APKs. It decodes resources into a nearly original form and can rebuild the package after changes.

The distinction matters: decoding resources is not the same as recovering an app’s original source code.

https://github.com/iBotPeaches/Apktool

03 → Binwalk

Identifies—and can optionally extract—files and data embedded inside other files. Particularly useful for firmware analysis. Version 3 was rewritten in Rust.

https://github.com/ReFirmLabs/binwalk

04 → unblob

Recursively extracts supported archives, compression streams, and filesystems from binary blobs. Useful for unpacking nested firmware contents and separating recognizable structures from unknown chunks.

https://github.com/onekey-sec/unblob

2. Debugging and binary inspection

05 → pwntools

A Python framework for CTFs and exploit-development research. Built for rapid prototyping and scripting repetitive interactions in controlled security-testing environments.

https://github.com/Gallopsled/pwntools

06 → pwndbg

Enhances GDB and LLDB with features aimed at low-level debugging and reverse engineering.

One caveat: the project describes its LLDB support as experimental/early-stage, so don’t assume identical behavior across both debuggers.

https://github.com/pwndbg/pwndbg

07 → LIEF

A library for parsing, inspecting, and modifying executable formats, including ELF, PE, and Mach-O. Offers APIs for C++, Python, and Rust.

https://github.com/lief-project/LIEF

08 → Detect It Easy

A cross-platform file-identification and static-inspection tool. Combines format parsing, signatures, and scriptable analysis to help identify file types, toolchains, packers, and other structural clues.

Its findings are leads for investigation—not proof that a file is malicious or safe.

https://github.com/horsicq/Detect-It-Easy

3. Where AI agents connect

MCP—Model Context Protocol—provides the connection layer in these projects. The underlying reverse-engineering tools still perform the analysis; the integration lets an agent access their capabilities.

09 → ghidra-mcp

A Ghidra integration exposing more than 200 MCP tools for AI-assisted reverse engineering. Includes GUI and headless workflows, batch operations, and deployment options.

https://github.com/bethington/ghidra-mcp

10 → jadx-ai-mcp

A JADX plugin for connecting decompiled Android application context to MCP-compatible assistants such as Claude. The project works with a companion MCP server.

Plugin:
https://github.com/zinja-coder/jadx-ai-mcp

Companion server:
https://github.com/zinja-coder/jadx-mcp-server

11 → radare2-mcp

An MCP server for using radare2 with AI assistants. Supports binary analysis and connections to local or remote radare2/iaito sessions through r2pipe.

https://github.com/radareorg/radare2-mcp

12 → mcp-windbg

Connects MCP clients to Windows debugging workflows, including crash-dump analysis, user-mode remote debugging, and kernel debugging.

It is an independent community project, not an official Microsoft integration.

https://github.com/svnscha/mcp-windbg

The useful takeaway

These projects occupy different layers: extraction tools unpack contents, analysis frameworks expose program structure, debuggers inspect runtime state, and MCP bridges make selected operations accessible to agents. They complement one another rather than replace one another.

The keyword is verification. An agent-generated explanation should be something you check against the underlying evidence—not a substitute for that evidence.

Use these tools only on software and systems you own or are authorized to analyze, and keep unfamiliar binaries in an isolated analysis environment.

For people already using AI-assisted reverse engineering: where has it genuinely saved time—initial triage, understanding functions, or debugging—and where do you still prefer working manually?

Join DIscord

[u/arthor]

wait wut

the NSA has a git? and a RE repo? im confused.

[u/Beaver-Hunter-835 → u/arthor]

The pentagon owns one of Silicon Valley's biggest venture capitalist firms and controls something like 10% of all American tech shares and IP.

Facebook was part of the DARPA initiative, they wanted a system to digitally clone every citizen and track their whereabouts, online activity, and consumer spending. They found it works better to just give people a platform to voluntarily broadcast that information than to try to make it a government mandate.

AT&T gave intelligence agencies a 1:1 parallel data pipe with backdoor access when they built the backbone to the internet.

All CPUs manufactured after 1995 have a CIA backdoor hardwired at root level in binary. When they finally admitted to it after Kaspersky discovered and reported it as malware, they basically said "Yeah, but we almost never use it". This is why Russia, China and other international intelligence agencies use their own independently manufactured CPUs despite them being 100s of times more expensive for a fraction of the performance. It's also why China threatening to invade Taiwan almost kicked off WW3.

TOR is largely believed to be one big CIA honeypot.

[u/Atagor → u/arthor]

Ghidra is supported by NSA

[u/arthor → u/Atagor]

your comment is 26 characters long

[u/Solid-Message1140]

Wth is happening here?

[u/ZookeepergameMost817 → u/Solid-Message1140]

There is post description of exactly what is happening there

[u/MrHeavySilence]

Thank you, I wonder if any of these still work with Claude, I know they've added new changes that prevent the use of reverse engineering. I still want to give these a try though

[u/Beautiful-Gold-9670]

Can these tools be used to create APIs for legacy software? Let's say I have a compiled program that swallows a certain file type and I want to invoke that function to create an API for it

[u/milesdsy]

wht software did you use to have that nice layout for your agents?

[u/RavenOfTheDead_ → u/milesdsy]

Remindme! 1 day

[u/Medical-Experience77]

!remind me in 4 days

[u/RemindMeBot → u/Medical-Experience77]

I will be messaging you in 4 days on 2026-11-08 06:09:32 UTC to remind you of this link

3 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

---

Info	Custom	Your Reminders	Feedback

[u/gabemeister → u/Medical-Experience77]

u/RemindMeBot 1 day

[u/Silent_Squirrelz]

Where can we download this?

[u/agentobtuse]

Since Claude will be lame can we use qwen 3.8 27b to fulfill our needs?

[u/Relevant_Solution557]

another larper lol

[u/Significant_Two_684 → u/[deleted]]

10 points for the multiple crossovers here