10 Open-Source Reverse Engineering Tools and MCP Setups for AI Agents to Deconstruct Apps

AI researcher and creator Deni (@0xDeniAi) has shared a curated collection of 10 essential open-source reverse engineering repositories and Model Context Protocol (MCP) servers, highlighting how frontier models like Claude Opus 5.5 can systematically dismantle and analyze web, desktop, and mobile applications like a mechanic taking apart an engine.

Image source: @0xDeniAi via X

Software reverse engineering has traditionally been a high-friction domain requiring specialized security analysts to manually decipher disassembly outputs, bytecodes, and network packets across fragmented desktop tools. With the rapid maturation of autonomous AI agents like Claude and the standardized Model Context Protocol (MCP), agents can now directly invoke decompilers, debuggers, and browser instrumentation behind the scenes, automatically extracting file topologies, function signatures, and API data flows into cohesive architectural overviews.

10 Core Open-Source Repositories and MCP Servers for AI Reverse Engineering

The 10 open-source repositories and MCP servers highlighted in the workflow cover diverse targets ranging from native binaries to managed mobile apps:

1. REA (171K Stars)

A unified reverse engineering MCP server built to inspect native binaries, Electron applications, .NET assemblies, Android packages, and live web apps. The author noted that pairing REA with Ghidra feels "like cheating" when analyzing compiled targets.

2. Chrome DevTools MCP (53K Stars)

An MCP server that enables AI agents to drive a live, running instance of Google Chrome. Agents can monitor network requests, inspect developer console logs, and evaluate JavaScript in real time to map how client-side single-page applications and proprietary APIs operate under the hood.

3. JADX (50K Stars)

A high-performance Android DEX-to-Java decompiler that reconstructs clean Java source code from APK and DEX files. Supporting both a desktop GUI and a rich command-line interface (CLI), JADX integrates seamlessly into agent-driven automated batch decompilation and code search pipelines.

4. x64dbg (49K Stars)

An open-source x64/x32 binary debugger engineered specifically for Windows software analysis and malware research. It grants agents fine-grained inspection over CPU registers, memory allocations, and execution breakpoints to verify low-level runtime behavior.

5. Apktool (26K Stars)

A staple utility in Android security analysis designed to unpack Android APK packages into their constituent AndroidManifest.xml files, decoded application resources, and intermediate Smali bytecode, with full support for rebuilding modified packages.

6. radare2 (25K Stars)

A comprehensive, UNIX-philosophy reverse engineering framework composed of modular command-line utilities. With its native r2mcp server, agents can interactively disassemble functions, inspect binary headers, and script binary patches directly from within context windows.

7. Cutter (20K Stars)

A modern, free open-source GUI reverse engineering platform powered by the Rizin analysis engine. It provides intuitive disassembly graph representations and decompiler views that assist in navigating complex binary control flow.

8. IDA Pro MCP (12K Stars)

A dedicated bridge connecting the industry-standard IDA Pro disassembler and decompiler to AI agents via the Model Context Protocol, enabling agents to leverage deep static analysis databases programmatically.

9. dnSpy (11K Stars)

A specialized decompiler, debugger, and assembly editor for the .NET ecosystem. dnSpy decompiles .NET assemblies directly into C# source code and allows agents to patch compiled IL bytecodes and re-execute binaries to observe behavioral changes immediately.

10. angr (9K Stars)

A Python-based multi-architecture binary analysis framework. Built around symbolic execution, angr allows agents to mathematically solve branch conditions and uncover hidden execution paths and security flaws that traditional static decompilation might miss.

Practical Considerations, Ethics, and Limitations

While integrating AI agents with decompilers substantially lowers the barrier to software auditing, security practitioners must observe key operational and legal boundaries:

• Legal Boundaries and Terms of Service (ToS): Reverse engineering proprietary closed-source applications or bypassing technological protection measures without authorization can violate terms of service agreements and intellectual property laws. These tools should strictly be deployed on owned assets, open-source projects, or authorized security audit targets.
• Cross-Verifying Decompiled Outputs: Decompiled pseudocode and natural-language summaries produced by LLM agents can occasionally suffer from hallucinations or misinterpret complex compiler optimizations. Critical architectural findings must always be cross-verified against actual debugger traces (e.g., via x64dbg) or authoritative disassembler outputs.
• Obfuscation and Anti-Analysis Defenses: Targets protected with commercial packers, control-flow flattening, or aggressive anti-debugging techniques will significantly degrade the success rate of automated agent decompilation, requiring human analyst intervention to bypass unpackers first.

Original source

• Deni (@0xDeniAi) on X: View original post