REA MCP Connects Claude, Cursor to Ghidra, IDA for Auto Binary Analysis

The open-source Reverse Engineer Anything (REA) project now connects five major AI coding agents to established reverse-engineering tools, automating the inspection of software without source code. According to Cyber Security News, the initiative integrates Claude Code, Cursor, Codex, Gemini CLI, and Grok Build with disassemblers like Ghidra and IDA Pro.

The risk

REA does not replace traditional disassemblers but acts as a bridge between AI agents and analysis tools, according to GBHackers. The system uses the Model Context Protocol (MCP) to allow agents to request analysis through a local server. Agents can trace program behavior, receive findings with supporting evidence, and explain observed behaviors or develop a reconstructed implementation, per GBHackers.

For native binaries, REA returns pseudocode, assembly instructions, strings, symbols, function calls, and references. This data helps researchers connect visible features to underlying code. Deep native analysis requires an existing installation of Ghidra, IDA Pro, or Hopper, though setup can install Hopper with user approval, per Cyber Security News.

The tool also handles JavaScript and Electron applications by mapping modules, imports, source maps, and process communication. Static .NET inspection exposes metadata, intermediate language instructions, and declared native dependencies. Neither the JavaScript nor .NET workflows require a native analysis engine, according to GBHackers.

Who is exposed

The project supports a wide range of targets beyond native binaries, including Android packages, firmware, WebAssembly artifacts, and websites. Users can analyze saved network captures and recorded Linux crashes. Browser inspection requires a Chrome-family browser, while firmware extraction depends on Binwalk or Unblob in a Linux environment, according to GBHackers.

Android decompilation requires JADX and a full JDK. Selected binary diagnostics necessitate caller-supplied pwntools. Windows Ghidra support is currently experimental, and Ghidra supports investigations involving 16-bit DOS programs. Platform support varies depending on the chosen analysis provider, as noted in the official REA repository.

Cost and compliance

REA is an open-source project that requires specific runtime environments to function. Users need npm and Node.js versions 22.19 or later, 24.11 or later, or version 26 and later. The setup process asks users to choose agents, review changes, and approve registration before installing workflow instructions and backing up existing configurations, according to Cyber Security News.

Other clients that support local MCP servers can use manual registration. The official repository provides installation details and notes that capabilities depend on the underlying analysis provider. No licensing fees are mentioned in the source material for the REA tool itself.

What should you do?

Developers using AI coding agents should review the REA documentation to understand how MCP servers interact with their local environments. Security teams should monitor agent permissions to ensure they cannot autonomously execute analysis on sensitive binaries without oversight.

Background: AI agents

AI agents are software systems that perceive their environment, make decisions, and execute actions to achieve specific goals. Unlike standard models, they maintain internal state and interact with external tools, creating unique security risks around tool execution, memory retention, and autonomous decision loops that require specialized controls.

Read the full guide: AI Agents Explained: Answers to Security and Architecture Questions

What to do and how to stay safe: REA

• Verify that AI coding agents have only necessary permissions to access local files and reverse-engineering tools.
• Review the Model Context Protocol server logs to audit what analysis requests the agents are making.
• Ensure Node.js and npm versions meet the minimum requirements before attempting installation.
• Monitor agent behavior when analyzing proprietary or sensitive binaries to prevent unintended data exposure.

Step-by-step guide: AI Governance Explained: Building Rules for Autonomous Systems

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which AI coding agents are supported by REA?

REA supports Claude Code, Cursor, Codex, Gemini CLI, and Grok Build, with manual registration available for other MCP-compatible clients.

Does REA replace Ghidra or IDA Pro?

No, REA acts as a bridge between AI agents and these tools, requiring an existing installation for deep native analysis.

What Node.js versions are required for REA?

REA requires Node.js versions 22.19+, 24.11+, or 26 and later, along with npm.