Best reverse engineering MCP servers for Ghidra, IDA and Claude Code

A reverse engineering MCP server lets an agent drive analysis tools such as Ghidra, IDA Pro, radare2 or JADX through the Model Context Protocol and report what it found with evidence. Only analyze software you are allowed to analyze.

For authorized security research, malware analysis and interoperability only.

Pick by the engine you already use

Free engine · native binaries
Ghidra
- GhidraMCP
- ReVa
GhidraMCP decompiles, lists functions and renames. ReVa offers interactive or headless analysis.
Apache-2.0 servers · Python bridge or Ghidra extension
Compare GhidraMCP and ReVa
Commercial engine · native binaries
IDA Pro
- ida-pro-mcp
For existing IDA projects. Its maintainer now also points to the official Hex-Rays IDA MCP server.
MIT server · licensed IDA Pro; not IDA Free
See ida-pro-mcp
Free engine · command line
radare2
- radare2-mcp
The radare2 project’s own stdio server, with documented read-only and tool restrictions.
MIT server · radare2 + r2pm
See radare2-mcp
Free engine · Android
Android APK (JADX)
- jadx-ai-mcp
Decompiled Java code and APK resources through a JADX plugin plus a companion server.
Apache-2.0 · JADX plugin + server
See jadx-ai-mcp

Workflow fit from each project’s README, not a speed or accuracy test.

Native binaries: start with your analysis engine

For an executable or library you may analyze, GhidraMCP exposes Ghidra decompilation, function lists and renaming. ReVa uses the same engine with interactive and headless modes. If your existing project is in IDA Pro, compare ida-pro-mcp and its license requirements before changing engines; IDA Free is not supported by that server.

Android APKs and command-line analysis

Choose jadx-ai-mcp for Java-oriented decompiled Android code and APK resources; it needs both a JADX plugin and a companion server. For a workflow already based on radare2, radare2-mcp exposes that engine through MCP and documents read-only and tool restrictions. This is a workflow comparison, not an accuracy or speed benchmark.

Keep analysis and file access separate

Filesystem MCP can read an allowed folder of exported reports; Git MCP can inspect changes in an analysis repository. Neither replaces a decompiler. Keep original samples separate from writable reports, and verify function addresses or source locations in the engine before accepting an agent’s explanation.

Setup and current maintainer guidance

Install the engine before connecting its server to your MCP client. The ida-pro-mcp maintainer now recommends the official Hex-Rays IDA MCP server; review that project too if you are starting a new IDA setup. Only analyze software you own or have permission to analyze, under its license and applicable law.

Reverse engineering MCP comparison

Documented engines and workflows; sources checked 26 Oct 2026
Server	Engine / input	Workflow fit	Server license / prerequisite
GhidraMCP	Ghidra / native binaries	Decompile, list functions, rename	Apache-2.0 / Ghidra + Python bridge
ReVa	Ghidra / native binaries	Interactive or headless analysis	Apache-2.0 / Ghidra extension
ida-pro-mcp	IDA Pro / native binaries	Existing IDA projects	MIT / licensed IDA Pro; not IDA Free
radare2-mcp	radare2 / binaries	CLI analysis; configurable tools	MIT / radare2 + r2pm
jadx-ai-mcp	JADX / Android APKs	Decompiled Java and APK resources	Apache-2.0 / JADX plugin + server

Server licenses do not include a commercial engine license. These are source-based workflow notes; AgentSkillsDir has not run a comparative test or audited these servers.

Tools to compare

Ghidra
GhidraMCP
LaurieWired/GhidraMCPApache-2.0
A Ghidra plugin plus a Python MCP bridge. Install the release zip in Ghidra, then add the bridge with claude mcp add.
Needs: Ghidra 12.1.4 and uv^*
For authorized security research, malware analysis and interoperability only.
Unofficial; not affiliated with or endorsed by the NSA, which develops Ghidra. Ghidra is named only to identify the tool.
View on GitHub
Ghidra
reverse-engineering-assistant (ReVa)
cyberkaida/reverse-engineering-assistantApache-2.0
A Ghidra extension with its own MCP server. Add it over HTTP after installing the extension, or install the Python package with uv.
Needs: Ghidra^*
For authorized security research, malware analysis and interoperability only.
Unofficial; not affiliated with or endorsed by the NSA, which develops Ghidra. Ghidra is named only to identify the tool.
View on GitHub
IDA Pro
ida-pro-mcp
mrexodia/ida-pro-mcpMIT
Connects IDA Pro to an MCP client. Install it from the author’s Claude plugin marketplace; a Codex marketplace is also available.
Needs: A licensed copy of IDA Pro (the author does not provide one)^*
For authorized security research, malware analysis and interoperability only.
Unofficial; not affiliated with or endorsed by Hex-Rays. IDA Pro is a trademark of Hex-Rays SA, named only to identify the tool.
View on GitHub
radare2
radare2-mcp
radareorg/radare2-mcpMIT
The official radare2 MCP server over stdio. Install it with r2pm -Uci r2mcp and point your client at r2pm -r r2mcp.
Needs: radare2 and r2pm^*
For authorized security research, malware analysis and interoperability only.
Published by the radare2 project (radareorg). AgentSkillsDir is not affiliated with or endorsed by the radare2 project.
View on GitHub
Android APK (JADX)
jadx-ai-mcp
zinja-coder/jadx-ai-mcpApache-2.0
A JADX plugin plus a companion MCP server for Android APK analysis. Install the plugin with jadx plugins --install, then run the server as its README describes.
Needs: JADX^*
For authorized security research, malware analysis and interoperability only.
Unofficial; not affiliated with or endorsed by the JADX project (skylot/jadx). JADX is named only to identify the tool.
View on GitHub

* Each tool needs a legal license for the underlying analysis tool and permission to analyze the target software. Listed ≠ audited. Review scripts before running.

Ghidra, IDA Pro, radare2, JADX, Claude Code and Codex are named only to identify those tools; the names belong to their owners (the NSA, Hex-Rays SA, the radare2 and JADX projects, Anthropic and OpenAI). This guide is unofficial and not affiliated with or endorsed by any of them.

Related MCP setup and report tools

Use these alongside an analysis engine when their specific capability is needed.

Filesystem MCP: Read exported reports in an allowed directory; does not decompile samples.
Git MCP: Review analysis notes and repository diffs; does not replace binary analysis.
Claude Code MCP guide: Review host configuration and file-access boundaries before adding tools.
Hex-Rays IDA MCP: Official project recommended by the ida-pro-mcp maintainer; review its own prerequisites.

FAQ

What is the best MCP server for reverse engineering?

It depends on the engine you use. GhidraMCP and ReVa work with Ghidra, ida-pro-mcp with IDA Pro, radare2-mcp with radare2, and jadx-ai-mcp with JADX for Android APKs. Compare engine support and tool style before choosing.

Is there a free reverse engineering MCP server?

Yes. GhidraMCP, ReVa, radare2-mcp and jadx-ai-mcp are open source and work with free engines. ida-pro-mcp is MIT-licensed, but it needs a licensed copy of IDA Pro.

Can Claude Code reverse engineer binaries?

With a reverse engineering MCP server connected, Claude Code can ask a disassembler or decompiler to analyze a binary and explain the results. The engine does the analysis; check the evidence it reports, and only analyze software you are allowed to.

Ghidra MCP vs IDA MCP: which should I use?

Pick the engine you already use. Ghidra is free and open source; GhidraMCP and ReVa connect it to an agent. IDA Pro is commercial and widely used for native code; ida-pro-mcp connects it.

Is there an MCP server for Android APK reverse engineering?

Yes. jadx-ai-mcp adds an MCP server to JADX, the open-source Android decompiler. Install the JADX plugin, then run the companion MCP server as its README describes.

Reference: https://github.com/NationalSecurityAgency/ghidra

These selections are organized by task, without invented ratings, search volumes or compatibility-test results.