SuperGhidra

Reverify is an AI-agent verification toolkit for reverse engineering and related code analysis. It places deterministic tools between an agent and its claims: the model proposes hypotheses about a binary or candidate implementation, while parsers, disassemblers, pattern scanners, emulators, equivalence checks, and optional analysis engines compare them with ground truth and return evidence-backed VERIFIED, REFUTED, INCONCLUSIVE, OBSERVED, or INVALIDATED results. Its pure-Python core handles PE, ELF, and Mach-O parsing, x86/x64 and ARM/ARM64 disassembly, byte and pattern inspection, CPU micro-emulation, Protobuf/TLV dissection, and Frida hook generation; optional installations add Capstone, Unicorn, LIEF, Z3, or angr for deeper analysis. The project exposes the verification loop through a command-line interface and an MCP server that agents such as Claude Code and Cursor can call. It also records verified, observed, proved, and refuted results in a content-keyed local ledger, allowing grounded facts and negative findings to survive context resets, compaction, and new sessions. A rollover and orchestration system hands sessions off through files rather than model-written summaries, keeping verified facts separate from unverified notes. Reverify includes claim types for bytes, typed reads, instructions, patterns, emulation, behavioral or formal equivalence, imports, exports, sections, and—when angr is installed—functions, calls, references, and reachability. It is distributed from PyPI and licensed under the MIT License. The repository states that it is intended for authorized reverse engineering, malware analysis, CTF work, interoperability research, and software the user owns or is permitted to analyze.

DwarfStar is a self-contained, model-specific native inference engine for running DeepSeek V4 Flash, GLM 5.2, and, on high-memory systems, DeepSeek V4 PRO locally. It combines model loading, prompt rendering, tool calls, persistent KV state, an HTTP server, and a coding agent rather than serving as a general GGUF runner. The engine supports Metal on Macs, CUDA including multi-GPU systems, and ROCm on Strix Halo hardware; it also provides SSD streaming for machines with insufficient RAM, distributed tensor and pipeline parallelism, and server-side micro-batching for multi-user inference. The repository includes tooling and data for GGUF, imatrix, quality, and speed testing, and acknowledges code and design contributions from llama.cpp and GGML.

geiger is a read-only command-line scanner from Atomburst that inventories AI agents, harnesses, MCP servers, plugins, skills, hooks, browser extensions, desktop AI applications, and related IDE configurations on a machine. It reads known configuration files and directories, identifies each finding's origin and evidence path, and labels capabilities such as code execution, secret storage, broad filesystem access, broad web access, and network access. Credential-shaped values are reported by key name, file, and secret type without exposing value contents; the scanner performs no telemetry and writes only an explicitly requested report file. It can emit terminal, HTML, or versioned JSON reports, scan specified project or home directories, enforce a strict exit status for findings that can execute code or hold secrets, and compare JSON snapshots to identify newly appeared, removed, or escalated findings. It runs through npx with Node.js 18 or newer, has no runtime dependencies or account requirement, and is licensed under MIT. The project notes that it reads configuration rather than runtime behavior, covers known locations, and does not determine whether a package is malicious.

Reverse Engineer Anything is an AI-agent workflow that decompiles native binaries, including ELF and PE files, JVM bytecode, firmware, and container layers, into human-readable pseudo-code.

REA is a local reverse-engineering tool for AI agents, distributed as a CLI and MCP server. It connects agents to analysis providers such as Hopper and Ghidra, and can inspect native binaries, macOS applications, JavaScript and Electron applications, .NET assemblies, websites, packages, and controlled runtime behavior. Its investigation workflow decompiles or maps a target, follows strings, symbols, calls, references, and control flow, records evidence and limitations, and uses the findings to help reconstruct features in another project without claiming to recover original source code or automatically clone an application. Analysis runs on the local host; REA configures agent integrations and can optionally install Hopper, while Ghidra and Java must be installed separately. The project is distributed under the MIT license.