ReVa MCP Server: Ghidra Reverse Engineering with Claude, Cursor and Other Apps

• Shows a function as C-like code, a few lines at a time

  Decompiles one function with Ghidra and returns a slice of its lines, 50 by default, so a large function does not flood the chat. It can add the lists of callers and callees in the same answer.

  Try: “Decompile the function at 0x401000 and explain what it does.”

  Read · get-decompilation

• Searches every function's code for a pattern

  Looks through the decompiled code of the whole program for a pattern and returns function names and line numbers. Calls and data references are better found with the cross-reference tool.

  Try: “Find functions whose decompiled code contains "strcpy".”

  Read · search-decompilation

• Shows the code of every function that calls one

  Decompiles all callers of a target function in one go, with the call sites highlighted if you ask. It shows how a function is used across the program.

  Try: “Show me how everything that calls decrypt_buffer uses it.”

  Read · get-callers-decompiled

• Shows the code of every function that touches an address

  Decompiles all functions that reference an address or symbol, code and data references included. Good for following a global variable.

  Try: “Decompile everything that references the global g_config.”

  Read · get-referencers-decompiled

• Lists functions in the program

  Returns functions a page at a time. Count them first with get-function-count to plan the paging.

  Try: “List the first 100 functions in this program.”

  Read · get-functions

• Counts the functions in the program

  Returns the total number of functions so the assistant can plan how many pages to read.

  Try: “How many functions does this program have?”

  Read · get-function-count

• Finds functions with names like a given one

  Lists functions ordered by how close their names are to the one you give, a page at a time.

  Try: “Find functions with names similar to parse_header.”

  Read · get-functions-by-similarity

• Lists symbols in the program

  Returns symbols such as functions, labels and data names a page at a time.

  Try: “List the symbols in this program.”

  Read · get-symbols

• Counts the symbols in the program

  Returns the total number of symbols, to plan paging through get-symbols.

  Try: “How many symbols are there?”

  Read · get-symbols-count

• Lists text strings, with search and regex

  Returns strings a page at a time. You can filter with a regular expression or sort by closeness to a search string.

  Try: “Show strings that look like URLs.”

  Read · get-strings

• Counts the strings in the program

  Returns the total number of strings so the assistant knows how many pages to read.

  Try: “How many strings does this binary contain?”

  Read · get-strings-count

• Shows what points to or from a location

  Finds references to or from an address, symbol or function, in one or both directions, with optional decompiled context around each.

  Try: “Show everything that references the function at 0x401000.”

  Read · find-cross-references

• Lists the outside functions the program uses

  Returns the imported functions from external libraries, which shows at a glance what APIs a binary relies on.

  Try: “List the imports and highlight any network or crypto APIs.”

  Read · list-imports

• Lists what the program offers to others

  Returns the exported functions and data a binary makes available to other modules.

  Try: “List everything this library exports.”

  Read · list-exports

• Finds where an imported function is called

  Finds every place a named import is called, including calls that go through thunk stubs.

  Try: “Where is CreateProcessA called?”

  Read · find-import-references

• Follows a wrapper to the real function

  Follows a chain of thunk functions, which just jump elsewhere, to the function that does the work.

  Try: “Resolve the thunk at 0x401020 to its real target.”

  Read · resolve-thunk

• Lists the program's memory sections

  Returns the memory blocks with their addresses, sizes and permissions.

  Try: “Show the memory blocks and which ones are executable.”

  Read · get-memory-blocks

• Reads bytes at an address

  Reads memory from the loaded program at an address and returns the bytes.

  Try: “Read 64 bytes at 0x404000.”

  Read · read-memory

• Shows the data defined at an address

  Returns the data item at an address or symbol, with its type and value.

  Try: “What data is defined at 0x404010?”

  Read · get-data

• Finds where a number is used in code

  Finds instructions that use a specific constant as an immediate value. Useful for magic numbers, error codes and buffer sizes.

  Try: “Find where the constant 0x1337 is used.”

  Read · find-constant-uses

• Finds numbers within a range used in code

  Finds constants between two values used in instructions, such as 400 to 599 for HTTP errors.

  Try: “Find constants between 400 and 599 in the code.”

  Read · find-constants-in-range

• Lists the most used numbers in code

  Returns the most frequent constants in the program, skipping tiny values from 0 to 255 by default as noise.

  Try: “Which constants are used most often?”

  Read · list-common-constants

• Shows callers and callees around a function

  Builds the call graph around a function, both who calls it and what it calls, down to a depth you pick.

  Try: “Show the call graph around main, two levels deep.”

  Read · get-call-graph

• Shows a call tree up or down from a function

  Returns a tree of callers or callees from a function and marks loops it finds.

  Try: “Show the call tree below handle_request.”

  Read · get-call-tree

• Finds functions that call all of several others

  Finds functions that call every function in a list. These are often dispatch points or main loops.

  Try: “Find functions that call both init_crypto and send_packet.”

  Read · find-common-callers

• Traces where a value came from

  Follows the data dependency chain backward from an address to find its origins, such as constants, parameters or memory loads.

  Try: “Trace where the value passed to send at 0x401200 comes from.”

  Read · trace-data-flow-backward

• Traces where a value goes

  Follows a value forward to its uses, such as stores, function calls and returns.

  Try: “Trace where the return value at 0x401100 is used.”

  Read · trace-data-flow-forward

• Finds reads and writes of a variable

  Lists every read and write of a variable inside a function.

  Try: “Show every place the variable local_20 is used in main.”

  Read · find-variable-accesses

• Reads a C++ virtual function table

  Reads the table of function pointers at an address and lists each slot with its index and offset. It helps with C++ class layouts.

  Try: “Analyze the vtable at 0x405000.”

  Read · analyze-vtable

• Finds which vtables hold a function

  Finds the tables that contain a pointer to a function, with the slot positions.

  Try: “Which vtables contain the function at 0x401500?”

  Read · find-vtables-containing-function

• Finds indirect calls through a vtable slot

  Finds indirect calls that could reach a function through its vtable slot. The offset matching is tuned for x86 and x64 instructions.

  Try: “Find callers of the virtual method at 0x401500.”

  Read · find-vtable-callers

• Shows one structure's layout

  Returns a structure or union with its members and a C version of its layout.

  Try: “Show the layout of the structure Session.”

  Read · get-structure-info

• Lists structures and unions

  Lists the structures and unions in the program, with optional filtering and paging.

  Try: “List all structures whose name contains "Header".”

  Read · list-structures

• Checks a C structure definition

  Checks a C-style structure definition for errors without creating anything.

  Try: “Check whether this struct definition parses.”

  Read · validate-c-structure

• Lists data type libraries

  Returns the data type archives available for a program.

  Try: “Which data type archives are available?”

  Read · get-data-type-archives

• Lists types from a data type library

  Returns the data types in one archive.

  Try: “List the types in the generic_clib archive.”

  Read · get-data-types

• Looks up a type by its name

  Finds a data type from its string form, such as "char *".

  Try: “Look up the type "unsigned long long".”

  Read · get-data-type-by-string

• Finds code Ghidra missed as functions

  Finds addresses in executable memory with valid instructions that are referenced but not defined as functions, through calls or data pointers.

  Try: “Find code that looks like functions but is not defined as one.”

  Read · get-undefined-function-candidates

• Reads comments at an address or range

  Returns comments set at an address or across an address range.

  Try: “Show the comments between 0x401000 and 0x401200.”

  Read · get-comments

• Searches comments for text

  Finds comments that contain the text you give.

  Try: “Search the comments for "TODO".”

  Read · search-comments

• Reads bookmarks at an address or range

  Returns bookmarks at an address or within an address range.

  Try: “Show my bookmarks in this program.”

  Read · get-bookmarks

• Searches bookmarks

  Finds bookmarks by text, type, category or address range.

  Try: “Search bookmarks in the category "crypto".”

  Read · search-bookmarks

• Lists bookmark categories

  Returns the categories used for a bookmark type.

  Try: “Which bookmark categories exist?”

  Read · list-bookmark-categories

• Shows which program is open in Ghidra

  Returns the program currently active in the Ghidra window. It only exists when Ghidra is running with its window, not in headless mode.

  Try: “Which program am I looking at in Ghidra?”

  Read · get-current-program

• Lists every program open in Ghidra

  Returns all programs open across Ghidra tools. It only exists when Ghidra is running with its window, not in headless mode.

  Try: “Which programs are open right now?”

  Read · list-open-programs

• Lists files and folders in the Ghidra project

  Returns the files and folders in the current project so the assistant can pick a program to work on.

  Try: “List the files in this Ghidra project.”

  Read · list-project-files

• Lists Ghidra's automatic analyzers

  Returns the analyzers that apply to a program with their descriptions and whether they are on. The names feed the analysis tool.

  Try: “Which analyzers are available for this program?”

  Read · list-analyzers

• Checks on a running analysis job

  Reports progress of a background analysis job, with new log lines and the live function count.

  Try: “How is the analysis going?”

  Read · analysis-status

• Summarizes what changed between two programs

  Returns counts and a ranked list of the most changed matching functions between two programs. It is the starting point for comparing two versions.

  Try: “Summarize what changed between version 1 and version 2.”

  Read · diff-summary

• Lists changed, added or removed functions

  Lists function differences for one category (changed, added, removed or identical), a page at a time, with size changes and callee changes.

  Try: “List the functions removed in the new version.”

  Read · diff-list-functions

• Compares one function side by side

  Shows decompiled differences for a matched pair of functions with changed lines, similarity and both signatures.

  Try: “Show how parse_header changed between the two versions.”

  Read · diff-function

• Shows strings added or removed

  Lists strings that were added or removed between the two programs, a useful hint for updates or protocol changes.

  Try: “Which strings differ between the two builds?”

  Read · diff-strings

• Shows data added or removed

  Lists defined data added or removed between source and destination.

  Try: “What data differs between the two programs?”

  Read · diff-data

• Checks on a running comparison job

  Polls a background comparison or markup job and returns new log lines and, when done, the result.

  Try: “Is the comparison finished?”

  Read · diff-status

• Lists saved comparison sessions

  Lists stored comparison sessions, each with its two programs and the matching methods run so far.

  Try: “Which comparisons have I already run?”

  Read · diff-list-sessions

• Adds or updates a comment at an address

  Writes a comment of a chosen type (pre, end-of-line, post, plate or repeatable) at an address, as notes for you and the assistant.

  Try: “Add a comment at 0x401000 saying this is the entry of the license check.”

  Write · set-comment

• Renames variables in decompiled code

  Renames variables inside a decompiled function so the code reads better.

  Try: “Rename the variables in parse_header to something meaningful.”

  Write · rename-variables

• Changes the types of variables in decompiled code

  Sets new data types for variables in a decompiled function.

  Try: “Change the type of local_20 in parse_header to unsigned int.”

  Write · change-variable-datatypes

• Adds a comment to a line of decompiled code

  Puts a comment on a given line of decompiled code, stored at the matching address.

  Try: “Comment line 14 of parse_header: validates the magic number.”

  Write · set-decompilation-comment

• Sets a function's signature

  Sets or updates a function's signature from a C-style declaration. It can also create a function that does not exist yet.

  Try: “Set the prototype of 0x401000 to int parse_header(char *buf, int len).”

  Write · set-function-prototype

• Defines a function at an address

  Creates a function at an address and lets Ghidra work out its body, parameters and return type.

  Try: “Create a function at 0x401800.”

  Write · create-function

• Manages function tags

  Gets, sets, adds, removes or lists tags that group functions. Setting or removing replaces tags that were there.

  Try: “Tag the functions that handle networking as "network".”

  Delete · function-tags

• Gives data a type at an address

  Applies a data type to an address or symbol.

  Try: “Apply the type Session to the data at 0x404010.”

  Write · apply-data-type

• Names an address

  Creates a label at an address.

  Try: “Create a label called config_table at 0x404010.”

  Write · create-label

• Creates or replaces a structure from C

  Parses a C-style definition and creates the structure. If one with that name exists it is replaced and its fields rebuilt.

  Try: “Create this struct from its C definition.”

  Write · parse-c-structure

• Lays a structure over data

  Applies a structure to the data at an address.

  Try: “Apply the structure Session at 0x404010.”

  Write · apply-structure

• Imports all structures from a C header file

  Reads an entire C header file from your computer and creates every structure in it.

  Try: “Parse the header ~/work/protocol.h and import its structures.”

  Write · parse-c-header

• Deletes a structure

  Removes a structure from the program after checking for uses in signatures, variables and memory. Forcing it deletes despite those uses.

  Try: “Delete the unused structure TestStruct.”

  Delete · delete-structure

• Adds or updates a bookmark

  Sets a bookmark at an address to mark an important place.

  Try: “Bookmark 0x401000 as "license check".”

  Write · set-bookmark

• Removes a bookmark

  Deletes a specific bookmark.

  Try: “Remove the bookmark at 0x401000.”

  Delete · remove-bookmark

• Removes a comment

  Deletes a specific comment at an address.

  Try: “Remove the comment at 0x401000.”

  Delete · remove-comment

• Imports files or folders into the project

  Imports a file, directory or archive from your computer into the Ghidra project. It does not analyze by default, and it can do so if told.

  Try: “Import /bin/ls into the project and analyze it.”

  Write · import-file

• Runs Ghidra's automatic analysis

  Starts analysis as a background job and saves the result. Small programs finish inside the wait time, and larger ones return a job id to poll.

  Try: “Analyze the imported program.”

  Write · analyze-program

• Stops a running analysis

  Asks a running analysis job to stop. The work done so far is still saved.

  Try: “Cancel the analysis.”

  Write · analysis-cancel

• Changes the program's processor type

  Changes the processor architecture of an existing program.

  Try: “Change the processor of this program to ARM:LE:32:v8.”

  Write · change-processor

• Commits a program to version control

  Checks a program in to version control with a commit message.

  Try: “Check in the program with the message "renamed crypto functions".”

  Write · checkin-program

• Writes a debug bundle to disk

  Creates a zip file with system information, Ghidra and ReVa settings, server status, open programs and logs, and returns its path. Check what it contains before sharing it.

  Try: “Capture debug info so I can report an issue.”

  Write · capture-reva-debug-info

• Starts a comparison of two programs

  Matches two analyzed programs using Ghidra's Version Tracking and keeps the result as a saved session. Big programs run as a background job.

  Try: “Compare program A with program B.”

  Write · diff-create-session

• Refines a comparison with another matching method

  Runs one more matching method over what is still unmatched in an existing session, to find more matches.

  Try: “Run another matching pass over the unmatched functions.”

  Write · diff-add-correlator

• Copies names and comments from one program to another

  Applies names, prototypes, types and comments from the source to the destination for matches above a confidence floor. Weaker matches come back as proposals to review.

  Try: “Copy names and comments from the old build to the new one.”

  Write · diff-transfer-markup

• Copies markup for one matched function

  Applies names, types and comments for exactly one matched function pair to the destination program.

  Try: “Apply the markup for this one matched function.”

  Write · diff-apply-match

• Stops a running comparison job

  Asks a running comparison or markup job to stop. A cancelled markup transfer is rolled back.

  Try: “Cancel the comparison.”

  Write · diff-cancel

• Deletes a saved comparison

  Permanently deletes a saved comparison session. Nothing else removes sessions.

  Try: “Delete the comparison between A and B.”

  Delete · diff-delete-session

• Lists Ghidra scripts

  Lists Python scripts in Ghidra's script folders, with filtering and paging.

  Try: “List my Ghidra scripts.”

  Files · list-scripts

• Reads a script's source

  Returns a script's source with line numbers, in chunks.

  Try: “Show me the script FindCrypto.py.”

  Files · read-script

• Creates or replaces a script file

  Creates a script or fully replaces one in a writable script folder. System script folders are read-only.

  Try: “Write a script that lists all functions larger than 1 KB.”

  Write · write-script

• Edits part of a script file

  Replaces exact text in an existing script. It errors if the text is missing or matches more than one place unless told to replace all.

  Try: “Fix the typo in FindCrypto.py.”

  Write · edit-script

• Runs Python inside Ghidra

  Runs a Python script against a program in Ghidra's PyGhidra runtime and returns its output, duration and whether it timed out. A script can do anything Python can do on your computer, not just read the program. It needs Ghidra started through PyGhidra, as the mcp-reva command does.

  Try: “Run a script that prints every function with more than 20 callers.”

  Runs code · run-script

Watch out for

• The script tool runs any Python on your machine

  run-script is on by default and the README says scripting tools are allowed in the default setup. Turn the Scripting group off if you do not need it, because write-script and edit-script also change script files that Ghidra can run. github.com

• It can change and delete things in your project

  Tools rename variables, retype data, create or replace structures, import files, change a program's processor and check programs in. Others delete comments, bookmarks, structures, function tags and saved comparisons. Back up the project first. github.com

• The Ghidra port has no sign-in by default

  In assistant mode the server listens on 127.0.0.1 port 8080 with the API key off, so any program on your computer can call its tools. If you let it listen on a public address, turn on the API key or disable scripting, as the README says. github.com

• Opening hostile files has risks of its own

  Our advice: analyze malware only in a virtual machine or another isolated system, and keep your Ghidra project there. github.com

• It reads and writes files you point it at

  import-file and parse-c-header read paths on your computer, and the debug tool writes a zip of logs and settings. Check that zip before you share it. github.com

Security advisories