Awesome AI Reverse Engineering
A curated list of AI-assisted reverse engineering tools, MCP servers, skills, and agents
简体中文 | English
About
Awesome AI Reverse Engineering collects AI-assisted reverse engineering tools for JavaScript and the Web, native binaries, Android and iOS, browser automation, and traffic analysis.
The list includes MCP servers, skills, plugins for IDA Pro, Ghidra, Binary Ninja, and JADX, as well as agents and desktop workstations.
Scope of use: For owned systems, explicitly authorized security testing, digital forensics, education and training, and defensive security research only.
The GitHub Description column is synchronized verbatim from each upstream repository and may not be in English.
Tool Types
| Type | Purpose |
|---|---|
| MCP Server | Exposes browser, decompiler, debugger, or device capabilities to AI systems |
| Skill | Gives AI systems analysis methods, task procedures, decision criteria, and output conventions |
| IDE / RE Plugin | Integrates AI capabilities into tools such as IDA, Ghidra, JADX, and Binary Ninja |
| Agent | Plans tasks, invokes tools, verifies results, and produces reports based on a goal |
| Desktop Workstation | Combines traffic capture, browser control, hooking, AI analysis, and result management in one application |
| Knowledge Base | Provides vulnerability patterns, cases, and testing ideas without performing analysis directly |
MCP connects AI systems to analysis tools, skills define analysis methods, and agents handle planning, execution, and verification.
Contents
- Quick Selection
- Vendor Interfaces
- JavaScript and Web Reverse Engineering
- IDA Pro Ecosystem
- Ghidra Ecosystem
- Binary and Native Reverse Engineering
- General Agents, Platforms, and Knowledge Bases
- Android and iOS Security Analysis
- Browser Automation and Traffic Analysis
- Foundational Reverse Engineering Tools (Non-AI)
- Watchlist
- Resources and Verification Examples
- Evaluation Criteria
- Acceptable Use
- Contributing
Quick Selection
| Need | Recommended Project |
|---|---|
| Locate common web signatures, parameters, and cookies | JS Reverse MCP |
| Comprehensive JS, WASM, AST, and network analysis | jshookmcp |
| Wrap browser encryption functions as APIs | js-reverse-automation--skill |
| Turn website traffic into reusable API clients | reverse-api-engineer |
| Collect evidence and prepare for local reproduction | JS Reverse MCP (source/network exports) |
| Use an anti-detection browser environment | Camoufox MCP Server |
| Use AI with IDA 9.4+ in GUI or headless mode | Hex-Rays IDA MCP |
| Use a third-party MCP compatibility path for IDA 8.3–9.3 | IDA Pro MCP |
| Export IDA data for analysis by an AI coding tool | IDA-NO-MCP |
| Run IDA as a headless service | ida-mcp-rs |
| Analyze several IDA instances in parallel | ida-multi-mcp |
| Use multiple AI models directly inside IDA | Gepetto (requires IDA/Hex-Rays; supports local models) |
| Use AI with Ghidra in GUI or headless mode | Ghidra MCP Server |
| Connect radare2 to AI agents | Radare2 MCP Server |
| Integrate AI with Binary Ninja 6.0 | Binary Ninja built-in MCP |
| Investigate WinDbg dumps, user-mode targets, and kernel debugging | Official WinDbg MCP |
| Perform dynamic debugging in x64dbg or x32dbg | x64dbg-mcp |
| Analyze process memory through Cheat Engine | Cheat Engine MCP Bridge |
| Compare multiple .NET assemblies and versions | DecompilerServer (requires .NET 10) |
| Decompile .NET programs | ILSpy-Mcp |
| Deobfuscate Python code with AI assistance | de4py |
| Automate binary analysis across multiple tools | revula |
| Run local agentic reversing with evidence management | REA |
| Combine malware, forensics, and binary analysis | Reversecore MCP |
| Extract Android APIs and analyze call chains | Android Reverse Engineering Skill |
| Analyze APK/DEX files without a GUI | jadx-headless-mcp |
| Perform interactive AI analysis in JADX | JADX-AI-MCP |
| Decode, inspect Smali, and rebuild APKs with Apktool | Official Apktool CLI + coding agent (not MCP) |
| Reverse Android native SO (.so) libraries | SOMCP |
| Run full-stack multi-device Android analysis | FIRERPA |
| Perform dynamic Android instrumentation with Frida | frida-analykit (v2.1.4; frida>=16.5.9,<18; validate the target device) |
| Inspect, modify, and replay mitmproxy traffic | mitmproxy-mcp |
| Use an all-in-one protocol analysis workstation | Anything Analyzer |
| Trace JS, JSVMP, and WASM at the engine level | Firefox-Reverse |
Vendor Interfaces
| Interface | Capabilities and version requirements | Selection constraints |
|---|---|---|
| Binary Ninja built-in MCP | GUI MCP since 6.0, including Free; headless MCP uses stdio | The headless binary ships with Commercial and Ultimate on macOS/Linux. Native Windows packages do not yet include it; use the GUI interface or Linux/WSL |
| Official WinDbg MCP | WinDbg 1.2610.1001.0+; connects to an active debugger session for dumps, live targets, and TTD | Officially supports VS Code Copilot and Copilot CLI. Check other clients' compatibility and MCP sampling protections separately. Diagnostician provides an investigation workflow; this is a separate implementation from the third-party WinDbg MCP on the watchlist |
| JEB built-in MCP server | GUI; headless -c --mcp since 5.41; APK analysis added in 5.47, DEX bytecode insertion and asynchronous scripts in 5.48 |
Requires the respective JEB license. Compare third-party plugins for distinct capabilities. Version history |
JavaScript and Web Reverse Engineering
Runtime debugging, request-chain tracing, hooking, deobfuscation, WASM, protocol analysis, and local algorithm reproduction for JavaScript.
General-Purpose MCP Servers
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| jshookmcp | MCP | Comprehensive AI-assisted JavaScript security analysis | Browser automation, CDP, network monitoring, JS hooking, WASM, source maps, and AST transformations | A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server. | Yes · 2026-11-02 | v0.4.3 · 2026-10-30 | 2094 |
| JS Reverse MCP | MCP | JavaScript debugging in real browser runtimes | Request parameters, dynamic cookies, WebSockets, call chains, and key function tracing | AI Agent-first JS 逆向 MCP Server：有头 Chrome 调试、断点、网络/WebSocket 分析、Patchright 反检测，可选 CloakBrowser。 | Yes · 2026-09-03 | v4.0.5 · 2026-09-03 | 3034 |
| JSReverser-MCP | MCP / Workflow | Standardized Web reverse engineering workflow | Page inspection, runtime sampling, local reproduction, environment emulation, and evidence preservation | JSReverser-MCP 是一个面向 JavaScript 逆向分析的 MCP 工具，专门用于帮助开发者在真实浏览器环境中高效定位前端核心逻辑。它 将脚本检索、断点调试、函数 Hook、网络请求追踪、调用链分析、混淆还原和风险评估整合为统一能力，可直接接入 Claude、 Codex、Cursor 等支持 MCP 的客户端。你可以连接已开启的 Chrome，在登录态页面下持续采样请求参数与返回数据，快速定位签名、 加密、鉴权和关键业务流程。工具同时支持自动化页面操作与结构化报告导出，适合用于接口分析、安全研究、前端调试与工程排障等 场景 | No · 2026-05-31 | v2.0.4 · 2026-05-31 | 1046 |
JavaScript Reverse Engineering Skills
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| hello_js_reverse_skill | Skill | End-to-end JavaScript reversing with anti-detection browsers | Network capture, source tracing, hooking, algorithm recovery, and local reproduction | 🔧 AI-powered JS逆向工程 Skill —— 覆盖加密还原、混淆分析、动态Cookie、WASM逆向、协议对抗等全链路场景，通过 Node.js 实现算法还原与模拟请求。适配 Claude Code / Claude.ai / 其他AI编码工具 | Yes · 2026-09-08 | v3.9.0 · 2026-09-08 | 1389 |
| js-reverse-automation--skill | Skill | Exposing JavaScript reversing results as services | JSRPC, Flask, autoDecoder, request encryption, and response decryption | 结合chrome-devtools-mcp的能力并加上Skill的规范，实现JSRPC+Flask+autoDecoder方案的前端JS逆向自动化分析，提升JS逆向的效率 | Yes · 2026-10-10 | v2.2 · 2026-09-18 | 607 |
| xbsReverseSkill | Skill Suite | Modular Web reverse engineering capabilities | AST analysis, standalone algorithms, protocol analysis, and browser environment emulation | Ai逆向的skill目录 | No · 2026-07-21 | v1.0.0 · 2026-03-28 | 381 |
Custom Browsers and Engine-Level Analysis
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Firefox-Reverse | Custom Browser / Agent | Engine-level tracing for JS, JSVMP, and WASM | Advanced obfuscation, dynamic code, and low-level execution tracing | 🦊 内置 AI 逆向 Agent 的 Firefox — 通用 JS/JSVMP/WASM/签名逆向工作站，SpiderMonkey 引擎层非侵入 trace，把加密参数从黑盒还原成不依赖浏览器的纯算法 | Yes · 2026-11-02 | v0.26.2 · 2026-10-25 | 965 |
IDA Pro Ecosystem
MCP servers, data-export tools, in-app AI plugins, and multi-instance analysis interfaces for IDA Pro.
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Hex-Rays IDA MCP | IDA Plugin / MCP | Vendor Code Mode and database coordination | IDAPython analysis, shared GUI/headless databases, multiple databases, and agent collaboration | Official Hex-Rays IDA MCP Server. | Yes · 2026-10-28 | v20261028.0.3 · 2026-10-28 | 1514 |
| IDA Pro MCP | IDA Plugin / MCP | Direct AI access to and control of IDA Pro | Decompilation, cross-references, renaming, comments, and type recovery | AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP. | Yes · 2026-09-26 | 1.4.0 · 2025-10-06 | 13289 |
| IDA-NO-MCP | IDA Plugin / Export Tool | Exporting IDA data for analysis by AI coding tools | Large-scale code indexing and analysis with low interaction overhead | Say goodbye to the complex, verbose, and laggy interaction mode of IDA Pro MCP | No · 2026-07-26 | None | 2071 |
| Gepetto | IDA AI Plugin | Multi-model function analysis inside IDA | Function explanations, renaming, and local or cloud model assistance | IDA plugin which queries language models to speed up reverse-engineering | Yes · 2026-08-15 | v1.5.1 · 2025-11-19 | 3488 |
| WPeGPT | IDA AI Plugin | Direct integration of multiple AI models into IDA | Interactive binary analysis with models such as OpenAI and DeepSeek | An IDA plugin for binary file analysis, powered by AI models such as OpenAI and DeepSeek. | No · 2026-05-27 | v3.0 · 2026-05-27 | 1423 |
| ida-mcp-rs | MCP | Headless IDA service implemented in Rust | Server deployments and automated pipelines | Headless IDA Pro MCP Server | Yes · 2026-11-01 | v9.5.0 · 2026-11-01 | 891 |
| ida-multi-mcp | IDA Plugin / MCP | Managing multiple IDA instances through one endpoint | Parallel multi-binary analysis, cross-sample function similarity, and malware component correlation | Multi-instance IDA Pro MCP server — analyze multiple binaries simultaneously through a single MCP endpoint. | Yes · 2026-09-19 | None | 468 |
Ghidra Ecosystem
MCP servers, native extensions, in-app AI plugins, headless automation interfaces, and agents that use Ghidra as their analysis backend.
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Ghidra MCP Server | Ghidra Plugin / MCP | Comprehensive Ghidra MCP service | GUI and headless analysis, batch operations, P-code, debugging, and team workflows | Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment. | Yes · 2026-10-31 | v7.0.0 · 2026-10-21 | 6058 |
| auto-re-agent | Agent / Ghidra Backend | Reconstructing and validating C/C++ functions from binaries | Decompilation evidence, candidate source generation, build tests, and parity checks | Reconstruct and validate C/C++ code from compiled programs with AI. | Yes · 2026-09-09 | v0.4.0 · 2026-09-09 | 2407 |
| reverse-engineering-assistant | Ghidra Plugin / MCP | MCP interface for Ghidra reverse engineering tasks | Decompilation, function and data-type analysis, renaming, and comments | MCP server for reverse engineering tasks in Ghidra 👩💻 | Yes · 2026-10-27 | v7.3.1 · 2026-09-03 | 896 |
| GhidrAssistMCP | Native Ghidra Extension / MCP | An in-process MCP server for Ghidra | Live binary analysis and agent tool calls inside Ghidra | An native MCP server extension for Ghidra | Yes · 2026-10-09 | 3.0.0 · 2026-10-09 | 803 |
| GhidraGPT | Ghidra AI Plugin | Direct integration of multiple LLMs into Ghidra | Conversational function explanation, symbol naming, and AI-assisted analysis | Integrate LLM models directly into Ghidra for AI-enhanced reverse engineering. | No · 2026-07-22 | v1.4.0 · 2026-07-22 | 838 |
| PyGhidra-MCP | CLI / MCP | Command-line MCP built on PyGhidra | Headless analysis, shared GUI state, scripted tasks, and automated pipelines | Python Command-Line Ghidra MCP | Yes · 2026-11-02 | v0.2.7 · 2026-09-25 | 458 |
| OGhidra | Ghidra Plugin / Agent | Local or cloud LLM analysis inside Ghidra | Natural-language queries, automatic renaming, knowledge graphs, malware patterns, and multi-instance analysis | OGhidra bridges Large Language Models (LLMs) via Ollama with the Ghidra reverse engineering platform, enabling AI-driven binary analysis through natural language. Interact with Ghidra using conversational queries and automate complex reverse engineering workflows. | Yes · 2026-10-28 | None | 465 |
Binary and Native Reverse Engineering
radare2, Binary Ninja, dynamic debuggers, memory-analysis tools, and cross-tool reverse engineering agents.
radare2 Ecosystem
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Radare2 MCP Server | radare2 Plugin / MCP | Official radare2 interface for AI agents | CLI and remote sessions, headless analysis, read-only mode, sandboxing, and automated pipelines | MCP stdio server for radare2 | Yes · 2026-10-15 | 1.9.0 · 2026-10-15 | 340 |
| r2ai | radare2 AI Plugin | Local and remote LLMs inside radare2 | Function explanation, automatic naming, vulnerability analysis, decompilation assistance, and ReAct workflows | LLM-based reversing for radare2 | Yes · 2026-10-26 | 1.5.3 · 2026-10-18 | 496 |
Python Reverse Engineering and Deobfuscation
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| de4py | Python Deobfuscator / AI | Python code deobfuscation and dynamic analysis | Common obfuscators, packers, behavior monitoring, and Ollama-assisted deobfuscation | The ultimate AI-powered toolkit for python reverse engineering | Yes · 2026-08-17 | v3.3.2-stable · 2026-08-12 | 1011 |
.NET and Binary Diffing
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| DecompilerServer | MCP / Skill | .NET multi-assembly decompilation and version comparison | Assembly search, structural and method diffs, and Unity managed code (requires .NET 10) | A powerful MCP (Model Context Protocol) server for decompiling and analyzing .NET assemblies, with specialized support for Unity's Assembly-CSharp.dll files. DecompilerServer provides comprehensive decompilation, search, and code analysis capabilities through a rich set of tools and APIs. | Yes · 2026-10-01 | v1.4.0 · 2026-10-01 | 126 |
| ILSpy-Mcp | .NET Decompiler / MCP | Managed-assembly analysis built on ILSpy | Type discovery, structural analysis, and method-level decompilation for .dll and .exe files |
🔓 UNLEASH ILSpy'S POWER. Reverse-engineer DOTNET code at GOD SPEED. AI-assisted debugging that THINKS with you. Decompile ANYTHING. 🚀 | Yes · 2026-08-10 | v1.0.3 · 2026-08-06 | 76 |
Dynamic Debugging and Memory Analysis
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Cheat Engine MCP Bridge | Cheat Engine Bridge / MCP | AI-driven process-memory analysis | Memory scans, pointer chains, structure recovery, disassembly, and signature generation | Connect your favorite AI agents directly to Cheat Engine via MCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language. | Yes · 2026-08-14 | None | 1735 |
| x64dbg-mcp | x64dbg Plugin / MCP | Remote control of x64dbg and x32dbg through MCP | Execution control, breakpoints, memory, registers, disassembly, and automated dynamic debugging | MCP server plugin for x64dbg debugger - enables AI agents and external tools to control debugging via JSON-RPC 2.0 over HTTP/SSE | Yes · 2026-10-28 | v1.0.12 · 2026-10-28 | 546 |
Other Reverse Engineering Integrations
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Rikugan | Agent / Plugin | AI agent embedded in IDA and Binary Ninja | Continuous conversational analysis within a reverse engineering interface | A reverse-engineering agent for IDA Pro and Binary Ninja | Yes · 2026-10-12 | v1.4.0 · 2026-09-25 | 703 |
| Binary Ninja MCP | Binary Ninja Plugin / MCP | AI bridge for Binary Ninja | Real-time analysis across multiple binary targets | A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client. | No · 2026-04-05 | v1.2.1 · 2026-03-22 | 456 |
General Agents, Platforms, and Knowledge Bases
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| reverse-skill | Skill / Router | Routing security tasks and toolchains | Multi-tool orchestration, CTFs, security research, and report generation | Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, Kiro, Cursor, Cline, and other AI coding clients 逆向/渗透/安全技能路由包 - AI 自动路由 + 按需自举工具链 + 自动进化经验库 | 支持 Claude Code / Kiro / Cursor / Cline 等代码 AI 客户端 | Yes · 2026-09-22 | v1.0.1 · 2026-08-08 | 43960 |
| HexGraph | Local Workstation / Agent / MCP | Binary and firmware vulnerability research workbench | Decompilation, fuzzing, verification, evidence graphs, and research notes | Self-hosted, agentic vulnerability research for binaries & firmware: an AI agent decompiles, fuzzes, and verifies exploits inside a sandbox, recording every finding to a typed graph. BYOK, fully local. | Yes · 2026-08-15 | hexgraph-v0.9.0 · 2026-07-07 | 21 |
| revula | MCP Platform | General-purpose reverse engineering automation backend | Static analysis, dynamic debugging, malware analysis, and batch processing | A fully functional and production-grade reverse engineering MCP Server | Yes · 2026-08-16 | None | 84 |
| REA | Agent / CLI / MCP / Skill | Local investigation platform across applications and binaries | Native, JS/Electron, .NET, application behavior, structured evidence, and version comparison | Reverse engineer anything with agents, from app behavior down to native binaries. | Yes · 2026-11-02 | rea-agents-6.8.0 · 2026-10-25 | 420424 |
| Reversecore MCP | MCP Platform | Multi-tool security and reverse engineering interface | Orchestrating and reporting across radare2, YARA, LIEF, CAPA, angr, Volatility, and related tools | A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more. | Yes · 2026-10-17 | v3.0.5 · 2026-09-28 | 216 |
Android and iOS Security Analysis
APK decompilation, API extraction, dynamic instrumentation, device management, traffic analysis, and mobile security knowledge bases.
Android Static Analysis and Decompilation
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Android Reverse Engineering Skill | Skill | Android static analysis and API extraction | APK, XAPK, JAR, AAR, Retrofit, OkHttp, and call-chain analysis | Claude Code skill to support Android app's reverse engineering | Yes · 2026-10-11 | v1.1.0 · 2026-04-27 | 8615 |
| jadx-headless-mcp | JVM / MCP | Headless JADX static-analysis interface | APK/DEX analysis, paginated source, cross-references, and resource search | Headless MCP server for Android APK static analysis, built directly on jadx-core. No JADX GUI required. | Yes · 2026-10-30 | v0.8.0 · 2026-10-19 | 148 |
| JADX-AI-MCP | JADX Plugin / MCP | Real-time AI analysis in JADX | APK code review, vulnerability analysis, and contextual inspection | Plugin for JADX to integrate MCP server | Yes · 2026-10-19 | v6.5.0 · 2026-10-19 | 2964 |
| apktool-mcp-server | Apktool / MCP | AI access to Apktool decoding and rebuilding | Manifest, resource, and Smali analysis; APK decoding, modification, and rebuilding | A MCP Server for APK Tool (Part of Android Reverse Engineering MCP Suites) | No · 2026-07-02 | V3.0.2 · 2026-07-02 | 706 |
| SOMCP | Native SO / MCP | On-device Android SO reverse engineering MCP | ELF structure analysis, Rizin disassembly, LIEF ELF patching/rewriting, patch sessions, Cloudflare Tunnel, and APK MCP bridging | SOMCP 是一个运行在 Android 手机上的本地 SO 逆向 MCP 服务器。它通过 Streamable HTTP 暴露 MCP 工具，让客户端可以在手机上完成 ELF 结构分析、Rizin 反汇编/分析、LIEF ELF 修复/重写、补丁会话、构建导出、Cloudflare Tunnel 暴露和可选 APK MCP 桥接 | Yes · 2026-11-01 | v1.0.23 · 2026-11-01 | 220 |
Dynamic Instrumentation and Device Control
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| FIRERPA | Android Platform / MCP / Agent | Full-stack Android device control and dynamic analysis | Multi-device remote control, UI/OCR automation, MITM, Frida, proxy networking, and long-running tasks | Android Full-Stack Device Control Platform: WebRTC/H.264 remote desktop, UI/OCR/image-matching automation, one-click MITM, built-in Frida, proxy/VPN/frp/P2P networking, MCP/Agent, 160+ APIs, designed for multi-device clusters and engineered deployments. | Yes · 2026-09-27 | v10.9 · 2026-09-27 | 8707 |
| frida-analykit | Frida Toolkit / MCP | Dynamic instrumentation for Android agents | Frida version management, low-level tool wrappers, hooks, and runtime analysis | Frida 工具包 - 主要面向安卓端逆向，解决frida环境版本管理和对Agent端常用底层工具方法封装，支持MCP。（目前主要由AI开发维护代码） | No · 2026-05-16 | v2.1.4 · 2026-05-14 | 156 |
| iOS MCP | MCP | Control of jailbroken iOS devices | Applications, files, logs, HID, and accessibility operations | 让 Claude、Codex、Cursor 等 AI 助手看懂 iPhone 屏幕并直接操作手机的 iOS 自动化工具与 MCP Server，支持 UI 树获取、元素定位、截图与 OCR 识别、点击滑动、文字输入、应用管理和日志读取，适用于自动化测试与 iOS 逆向调试 | Yes · 2026-09-27 | v1.2.8 · 2026-09-27 | 698 |
Browser Automation and Traffic Analysis
Browser control, anti-detection environments, proxy capture, protocol analysis, and all-in-one reverse engineering workstations.
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| reverse-api-engineer | Agent / CLI | Generating typed API clients from endpoints used by websites | Browser traffic capture, endpoint discovery, HAR analysis, and Python/JS/TS client generation | Reverse engineer any website into a typed API client. Works with Claude Code, Codex, Cursor and OpenCode. | Yes · 2026-10-29 | v0.14.0 · 2026-09-23 | 2422 |
| Camoufox MCP Server | MCP | Anti-detection and privacy-focused browser automation | Fingerprint controls, proxies, session isolation, and realistic browser environments | No description | Yes · 2026-10-04 | v2.6.0 · 2026-10-03 | 53 |
| mitmproxy-mcp | mitmproxy / MCP | AI-driven HTTP/HTTPS traffic operations | Traffic search, interception, modification, replay, authentication discovery, and API-structure extraction | MCP Server that wraps mitmproxy and exposes it as a tool to any MCP client, allows your AI agents to inspect traffic, filter traffic, intercept & modify traffic, request reply, set global headers, and start/stop mitmproxy as needed. | Yes · 2026-09-28 | v0.7.2 · 2026-09-28 | 134 |
| CipherBridge | Desktop Workstation / AI Agent | AI-assisted APP/Web encryption reversing and traffic bridging | Browser hooks, Mini Program source analysis, encryption/decryption parameter recovery, bidirectional Burp encryption/decryption bridging, and mitmdump plugin generation | 面向APP/Web 加解密逆向分析、渗透测试人员的可视化解密框架 | Yes · 2026-10-09 | 6.0 · 2026-10-08 | 462 |
| Anything Analyzer | Desktop Workstation | All-in-one protocol and reverse engineering analysis | Integrated browser, proxy, hooking, AI, and MCP workflows | 全能协议分析工具：浏览器抓包 + MITM 代理 + 指纹伪装 + AI 分析 + MCP Server 无缝对接 AI Agent/IDE | All-in-one protocol analysis toolkit — built-in browser capture, MITM proxy, JS hooks, fingerprint spoofing, AI analysis & MCP server for agent integration | Yes · 2026-10-06 | v3.7.0 · 2026-10-06 | 3822 |
Foundational Reverse Engineering Tools (Non-AI)
These foundational tools cover decompilation, debugging, instrumentation, symbolic execution, and traffic analysis. They are not counted as formal AI projects; related AI interfaces appear in the corresponding ecosystem sections.
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| Ghidra | Decompiler / Analysis Framework | Cross-platform static analysis of native binaries | Disassembly, decompilation, type recovery, scripting, and headless analysis | Ghidra is a software reverse engineering (SRE) framework | Yes · 2026-10-30 | Ghidra_12.2_build · 2026-10-22 | 96958 |
| jadx | Android Decompiler | DEX-to-Java decompilation | APK/DEX code reading, cross-references, resources, and GUI/CLI analysis | Dex to Java decompiler | Yes · 2026-10-30 | v1.5.6 · 2026-07-10 | 51465 |
| Apktool | APK Decoding / Rebuild Tool | Android resource and Smali decoding and rebuilding | Manifest, resource, and Smali inspection and rebuilding modified APKs | A tool for reverse engineering Android apk files | Yes · 2026-10-28 | v3.0.3 · 2026-07-20 | 26914 |
| Frida | Dynamic Instrumentation Toolkit | Cross-platform runtime observation and hooking | Application behavior analysis, function tracing, and custom instrumentation scripts | Main repo for hosting release binaries | Yes · 2026-11-01 | 17.25.1 · 2026-11-01 | 22602 |
| ILSpy | .NET Decompiler | Managed assembly browsing and C# decompilation | Type and method search, metadata inspection, source export, and CLI analysis | .NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform! | Yes · 2026-11-01 | v11.2 · 2026-10-27 | 26910 |
| radare2 | CLI / Analysis Framework | Cross-platform binary analysis in the terminal | Disassembly, decompilation, debugging, scripting, and automated analysis | UNIX-like reverse engineering framework and command-line toolset | Yes · 2026-11-02 | 6.2.4 · 2026-10-05 | 25242 |
| x64dbg | Windows Debugger | Windows user-mode dynamic debugging | Breakpoints, registers, memory, and execution tracing for x64/x86 programs | An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis. | Yes · 2026-10-28 | 2026.05.27 · 2026-05-27 | 50150 |
| angr | Binary Analysis / Symbolic Execution Framework | Program-state and path-constraint analysis | Control-flow recovery, symbolic execution, path exploration, and constraint solving | A powerful and user-friendly binary analysis platform! | Yes · 2026-10-30 | None | 9278 |
| mitmproxy | HTTP/HTTPS Proxy | Interactive and scriptable traffic analysis | Request and response inspection, modification, replay, and Python addons | An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. | Yes · 2026-10-30 | v12.3.1 · 2026-10-25 | 46557 |
| Rizin | CLI / Analysis Framework | Binary analysis framework forked from radare2 | Disassembly, analysis, debugging, and scripted tool integration | UNIX-like reverse engineering framework and command-line toolset. | Yes · 2026-10-30 | v0.9.1 · 2026-06-29 | 4094 |
| wxapkg | Desktop Tool | WeChat Mini Program package decryption and unpacking | .wxapkg scanning, decryption, unpacking, and source-tree recovery |
跨平台微信小程序反编译 GUI 工具，.wxapkg 文件扫描 + 解密 + 解包工具 | No · 2026-04-28 | v2.0.0 · 2026-04-16 | 4341 |
| zhong-wechat-wmpf-debugger | Debugging Tool | F12 debugging for Windows WeChat Mini Programs | WMPF version detection, CDP/DevTools bridging, and legacy or modern runtime debugging | WeChatOpenDevTool 微信小程序强制开启开发者工具 | No · 2026-07-18 | v1.3.0 · 2026-07-18 | 122 |
Watchlist
These projects closely match the scope of this list, but their maintenance continuity, maturity, use boundaries, or overlap with existing entries still merits observation. Watchlist placement does not mean they should not be tested.
| Project | Type | Core Focus | Best For | GitHub Description | Recently Updated | Latest Release | Stars |
|---|---|---|---|---|---|---|---|
| ReArk | Desktop Workstation / Agent | HarmonyOS and mobile application analysis workbench | HAP/APP/ABC, APK/AAB, IPA, native files, and HDC/ADB device analysis | An intelligent reverse engineering and AI-assisted analysis tool for HarmonyOS NEXT (HAP/APP/ABC), Android (APK/AAB), iOS (IPA), and native PE/ELF/Mach-O binaries. | Yes · 2026-10-28 | v1.2.0 · 2026-10-26 | 879 |
| DexDec | Decompiler / MCP / Desktop Workstation | Rust Android decompilation and AI interface | APK/DEX, Java/Kotlin output, on-demand source, and shared GUI context | Fast, accurate Android decompilation for humans and AI agents. | Yes · 2026-08-25 | v1.0.2 · 2026-08-21 | 122 |
| IDAssist | IDA AI Plugin / MCP Client | Agent and semantic search inside IDA | Multiple models, ReAct, semantic graphs, RAG, and external MCP tools | AI-Powered Reverse Engineering Plugin for IDA Pro | Yes · 2026-09-20 | 2.4.0 · 2026-09-14 | 901 |
| Cerberus RE | Skill / CLI / MCP | Correlating static and dynamic evidence for Apple binaries | Mach-O/ObjC/Swift/XPC, Ghidra, LLDB, and Frida (runtime workflows require macOS) | cerberus-re is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida. | Yes · 2026-08-30 | None | 221 |
| mobile-reverse-skill | Skill / Scripts | Mobile static and dynamic analysis workflow | Android Java/JNI, iOS PlayCover, runtime observation, and evidence records | A Claude Code skill for reverse-engineering mobile apps | Yes · 2026-11-02 | None | 63 |
| leanrea | Skill | Lightweight reversing methods using local CLIs directly | Initial analysis of Electron/JS, native binaries, managed assemblies, and file formats | One 8 KB skill that replaces REA (Reverse Engineer Anything): plain CLI tools, no MCP. Benchmarked: 38% faster, 35% cheaper. | Yes · 2026-10-17 | None | 3877 |
| apk-reverse | Skill / Scripts | Android APK modification and runtime validation methods | DEX patches, repacking, signing, dynamic analysis, and graded evidence records | 🔒 Not publicly accessible | Not publicly accessible | None | — |
| Seep-Reverse-Lab | Workstation / MCP / Skill | Multi-tool reversing workbench and authorization-boundary auditing | Android, native programs, CTFs, tool orchestration, and investigation records | Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench. | Yes · 2026-10-26 | None | 2036 |
| WinDbg MCP (third-party) | WinDbg / MCP | Windows kernel and user-mode debugging interface | DbgEng, KDNET, TTD, Frida, remote debugging, and virtual-machine control | C# MCP server for kernel & user-mode Windows debugging — DbgEng COM, KDNET, Frida, dbgsrv, TTD, and integrated VM control. 29 tools for LLM agents. | Yes · 2026-10-07 | None | 45 |
| jebmcp | JEB Pro Plugin / MCP | AI-client access to JEB Pro analysis | APK decompilation, call relationships, manifests, symbol renaming, and vulnerability analysis | No description | No · 2026-04-26 | None | 263 |
| GhidraMCP | Ghidra Plugin / MCP | Connecting Ghidra to AI clients | Decompilation, function analysis, and symbol organization | MCP Server for Ghidra | Yes · 2026-10-10 | 2.0 · 2026-10-10 | 11701 |
| reverse-skill | Skill | Advanced Web reverse engineering methods | JSVMP, workers, WASM, Webpack, AST, and protocol analysis | 面向 Web JS 逆向分析的技能仓库，覆盖请求链定位、运行时诊断、AST 混淆恢复、JSVMP、worker、WASM、webpack/runtime 与协议语义分析。 | No · 2026-04-01 | jsr-skills-15-a3e116e · 2026-05-02 | 383 |
| VortexDBG | Android Emulator / MCP | Off-device combined native and DEX/Java emulation | ARM .so, Dalvik/Java, JNI, breakpoints, memory, registers, and call tracing |
Emulate Android native libraries and DEX/Java classes together, off-device, and drive them with AI through MCP. A production-grade Kotlin engine for Android reverse engineering: native .so emulation (Unicorn2, Dynarmic), Dalvik/DEX and JNI, off-device automation. 安卓逆向工程引擎：在同一处同时模拟原生库与 DEX/Java 类，脱机运行，并通过 MCP 用 AI 驱动。Kotlin 打造，面向生产。 | No · 2026-07-16 | None | 13 |
| droidsaw | Android Decompiler / MCP | DEX, Hermes, and React Native cross-layer analysis | DEX-to-Java, Hermes-to-JavaScript, cross-bridge taint analysis, SBOM generation, and auditing | Pure-Rust Android decompiler and security-audit suite. DEX → Java, Hermes → JavaScript. Cross-layer taint across the React Native bridge. CycloneDX SBOM + OpenVEX. CLI and MCP. Bytecode is not a security layer. | No · 2026-06-11 | None | 35 |
| Charles MCP Server | MCP | AI integration for Charles Proxy | Live traffic, historical sessions, and request analysis | Charles Proxy MCP server for AI agents with live capture, structured traffic analysis, and agent-friendly tool contracts | No · 2026-06-23 | v3.0.3 · 2026-04-21 | 329 |
| algokiller-plugin | Plugin / Skill / MCP | ARM64 execution-trace evidence analysis | Searching GB-scale traces, locating critical data flows, and recovering cryptographic algorithms | ARM64 trace evidence analysis & cipher algorithm recovery — Claude Desktop plugin with skills + local MCP server driving the native ak_search engine over GB-scale trace files | No · 2026-05-14 | None | 80 |
| Diaphora MCP | IDA / Diaphora / MCP | Automated binary diffing | IDA database export, function matching, call-graph changes, security triage, and patch reports | MCP server for automated binary diffing. | Yes · 2026-10-12 | v1.1.0 · 2026-10-12 | 20 |
| Reverify | MCP / CLI / Verification Layer | Deterministic validation of AI binary-reversing claims | Bytes, instructions, binary structures, behavioral equivalence, expression proofs, and a cross-session evidence ledger | Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI. | Yes · 2026-09-07 | v0.11.0 · 2026-09-04 | 1322 |
| MiniApp CDP MCP | MCP | CDP debugging for WeChat Mini Programs | WeChat DevTools, desktop WeChat Mini Programs, runtime code, and request analysis | 微信小程序逆向工程 MCP 服务器，让你的 AI 编码助手（如 Claude、Cursor、Antigravity）能够直接通过 Chrome DevTools Protocol (CDP) 调试和分析微信小程序（包括微信开发者工具或 PC 端微信小程序）中的 JavaScript 代码。 | No · 2026-04-22 | None | 240 |
Resources and Verification Examples
| Resource | Purpose |
|---|---|
| awesome-ai-reverse-engineering | AI reversing project discovery; ratings use README and installation checks, not source-security or task validation |
| awesome-reverse-engineering | General reversing tools and learning resources curated by the REA authors |
| Awesome REA (AIshihzong) | AI reverse-engineering and rebuild cases, each tagged by whether its sources show REA was actually used, with an index by the replaced application and a summary of controlled REA comparisons; tags follow cited sources, not reproductions |
| REA workflows | REA companion references for evidence organization, version comparison, and reconstruction |
| DX-Ball reconstruction case | Pinned compiler and differential checks against the original; still relies on original assets and some CRT objects, with behavior left to validate |
Evaluation Criteria
| Criterion | What to Check |
|---|---|
| Tool type | Whether it is an MCP server, skill, plugin, agent, desktop application, or knowledge base; skills provide methods, while the other types connect to or operate tools |
| Analysis capabilities | Static analysis, dynamic analysis, traffic analysis, device control, browser automation, code reconstruction, and report generation |
| Write operations | Whether it supports renaming, comments, breakpoints, hooking, device actions, or browser state changes; back up analysis databases and test environments before use |
| Context usage | Support for on-demand loading, search, summaries, chunked reading, and minimal responses |
| Deliverables | Whether it preserves request and response samples, hook scripts, call chains, key code, environment dependencies, reproduction code, failure records, evidence, and reports |
| Deployment | Local desktop, headless service, Docker, virtual machine, jailbroken or rooted device, browser extension, or IDE plugin |
| Maintenance | Recent commits, issue responses, releases, installation documentation, supported client and software versions, and experimental features |
| Version boundaries | Capability differences among stable releases, prereleases, and default branches; compatibility and distinct capabilities of vendor and third-party interfaces |
| Validation evidence | CI coverage, real samples and devices, skipped or failed checks, independent reproduction, attempt counts, and model budgets; distinguish tool execution from task completion |
| Dependencies and costs | Upstream licenses, commercial software versions, hardware and device requirements, deployment and update costs, and data exposed through model calls or telemetry |
Inclusion in this list does not guarantee a project's security, stability, or continued maintenance.
Acceptable Use
Projects in this list are intended only for:
- Analysis of software and systems you own;
- Explicitly authorized security testing;
- Malware research;
- Digital forensics;
- Interoperability research;
- Education and training;
- CTF competitions;
- Defensive security research.
Do not use these tools to:
- Access other people's systems without authorization;
- Bypass access controls or paywalls;
- Steal accounts, credentials, cookies, or personal data;
- Abuse third-party services at scale;
- Disrupt websites, applications, or network services;
- Violate software licenses, laws, regulations, or platform rules.
Users are responsible for confirming the authorization scope for the target system and the legal requirements in their jurisdiction.
Contributing
New AI-assisted reverse engineering projects are welcome.
A project should meet at least one of the following criteria:
- Provide an MCP server for reverse engineering;
- Provide a reusable reverse engineering skill;
- Integrate AI into reverse engineering software;
- Provide AI-assisted static or dynamic analysis;
- Provide an AI interface for browser, device, or traffic-capture tools;
- Provide a complete reverse engineering agent or workstation.
Please include the following when submitting a project:
| [Project Name](Project URL) | Project Type | One-Sentence Core Focus | Primary Use Case |
You may also include:
- Supported platforms;
- Installation instructions;
- Supported AI clients;
- Whether commercial software is required;
- Whether root access or jailbreaking is required;
- License;
- Most recent maintenance date.
The following projects are generally not included:
- Projects without source code or documentation;
- Concept-only projects without a runnable implementation;
- Long-abandoned projects with no remaining value;
- Tools primarily intended for unauthorized attacks, account theft, or malicious bypasses;
- General automation projects with little connection to AI or reverse engineering.
Star
If you find this list useful, please star or fork the repository, submit a pull request, or recommend new AI reverse engineering tools, MCP servers, skills, plugins, and agents.
License
This list is available under the MIT License.
Each project in the list has its own license. Review the relevant repository's license and usage documentation before use.