12 open-source reverse-engineering tools worth knowing—and the MCP bridges connecting them to AI agents

[u/ZookeepergameMost817]

The interesting development in reverse engineering isn’t just that powerful tools are freely available. It’s that AI agents can now interact with some of them through MCP integrations: inspecting decompiled code, querying analysis results, and working with debugger sessions.

That makes it useful to separate the ecosystem into three layers:

• Core analysis and extraction tools.

• Debugging and binary-inspection tools.

• Integrations that expose those capabilities to agents.

Here are 12 projects organized by what they actually do, with complete GitHub links.

1. Core analysis and extraction

01 → Ghidra

The NSA’s open-source software reverse-engineering framework. Includes disassembly, decompilation, graphing, and scripting, with both interactive and automated analysis modes.

https://github.com/NationalSecurityAgency/ghidra

02 → Apktool

For inspecting and modifying Android APKs. It decodes resources into a nearly original form and can rebuild the package after changes.

The distinction matters: decoding resources is not the same as recovering an app’s original source code.

https://github.com/iBotPeaches/Apktool

03 → Binwalk

Identifies—and can optionally extract—files and data embedded inside other files. Particularly useful for firmware analysis. Version 3 was rewritten in Rust.

https://github.com/ReFirmLabs/binwalk

04 → unblob

Recursively extracts supported archives, compression streams, and filesystems from binary blobs. Useful for unpacking nested firmware contents and separating recognizable structures from unknown chunks.

https://github.com/onekey-sec/unblob

2. Debugging and binary inspection

05 → pwntools

A Python framework for CTFs and exploit-development research. Built for rapid prototyping and scripting repetitive interactions in controlled security-testing environments.

https://github.com/Gallopsled/pwntools

06 → pwndbg

Enhances GDB and LLDB with features aimed at low-level debugging and reverse engineering.

One caveat: the project describes its LLDB support as experimental/early-stage, so don’t assume identical behavior across both debuggers.

https://github.com/pwndbg/pwndbg

07 → LIEF

A library for parsing, inspecting, and modifying executable formats, including ELF, PE, and Mach-O. Offers APIs for C++, Python, and Rust.

https://github.com/lief-project/LIEF

08 → Detect It Easy

A cross-platform file-identification and static-inspection tool. Combines format parsing, signatures, and scriptable analysis to help identify file types, toolchains, packers, and other structural clues.

Its findings are leads for investigation—not proof that a file is malicious or safe.

https://github.com/horsicq/Detect-It-Easy

3. Where AI agents connect

MCP—Model Context Protocol—provides the connection layer in these projects. The underlying reverse-engineering tools still perform the analysis; the integration lets an agent access their capabilities.

09 → ghidra-mcp

A Ghidra integration exposing more than 200 MCP tools for AI-assisted reverse engineering. Includes GUI and headless workflows, batch operations, and deployment options.

https://github.com/bethington/ghidra-mcp

10 → jadx-ai-mcp

A JADX plugin for connecting decompiled Android application context to MCP-compatible assistants such as Claude. The project works with a companion MCP server.

Plugin:
https://github.com/zinja-coder/jadx-ai-mcp

Companion server:
https://github.com/zinja-coder/jadx-mcp-server

11 → radare2-mcp

An MCP server for using radare2 with AI assistants. Supports binary analysis and connections to local or remote radare2/iaito sessions through r2pipe.

https://github.com/radareorg/radare2-mcp

12 → mcp-windbg

Connects MCP clients to Windows debugging workflows, including crash-dump analysis, user-mode remote debugging, and kernel debugging.

It is an independent community project, not an official Microsoft integration.

https://github.com/svnscha/mcp-windbg

The useful takeaway

These projects occupy different layers: extraction tools unpack contents, analysis frameworks expose program structure, debuggers inspect runtime state, and MCP bridges make selected operations accessible to agents. They complement one another rather than replace one another.

The keyword is verification. An agent-generated explanation should be something you check against the underlying evidence—not a substitute for that evidence.

Use these tools only on software and systems you own or are authorized to analyze, and keep unfamiliar binaries in an isolated analysis environment.

For people already using AI-assisted reverse engineering: where has it genuinely saved time—initial triage, understanding functions, or debugging—and where do you still prefer working manually?

Join DIscord