REA vs GhidraMCP vs IDA Pro MCP vs Binary Ninja MCP: AI Reverse-Engineering Tools Compared (2026)
REA vs GhidraMCP vs IDA Pro MCP vs Binary Ninja MCP: license, backends, install, targets, tokens and which to use, verified from each README in October 2026.
Short version: GhidraMCP and IDA Pro MCP each connect an LLM to one disassembler. REA is a broader layer. It covers native binaries through Ghidra, Hopper or IDA (and can sit on top of an existing IDA MCP server), plus JavaScript/Electron, .NET, Android, websites and more, with evidence-tagged results. If you live in a single tool's GUI, a single-tool MCP may be all you need.
Background on REA: What is REA?. Setup: install guide · backend guide.
Comparison table (verified from each project's README, Oct 13, 2026)
| REA | GhidraMCP | IDA Pro MCP | Binary Ninja MCP (community) | |
|---|---|---|---|---|
| Repo | morluto/rea |
LaurieWired/GhidraMCP |
mrexodia/ida-pro-mcp |
e.g. fosdickio/binary_ninja_mcp |
| License | MIT | Apache-2.0 | MIT | Check each repo |
| GitHub stars (Oct 13) | ~168k | ~11k | ~12.7k | ~450 (largest one we found) |
| Disassembler | Ghidra 12.1.x, Hopper, or IDA (via an IDA MCP server) | Ghidra (plugin; README lists 12.1.4) | IDA Pro 8.3+ (9 recommended). IDA Free not supported | Binary Ninja (paid) |
| Install | npx rea-agents setup (Node.js 22.19+/24.11+/26+) |
Ghidra extension plus a Python MCP bridge (uv or pip) | Python 3.11+ plugin, idalib/uv for headless | Binary Ninja plugin |
| Needs the GUI open? | No. Ghidra runs headless; Hopper is launched for you | Yes, a Ghidra plugin with an HTTP server | GUI or headless idalib | Plugin-based (headless variants exist) |
| Non-native targets | JS/Electron, .NET, APK (JADX), websites, HAR, SQLite, WASM, firmware, Go metadata and more | No | No | No |
| Writes to your database | Ghidra: session-only renames/comments. Bytes never changed | Renames methods/data | Yes, edits in IDA | Varies |
| Agent auto-setup | Yes, for 20+ clients (Claude Code, Codex, Cursor, Gemini CLI...) | Manual JSON config | Auto-config for many clients | Manual |
| Free path end to end | Yes (Ghidra) | Yes | No (needs IDA Pro) | No |
Notes: star counts come from the GitHub API on Oct 13, 2026 and change daily. The IDA Pro MCP README now tells people to use the official Hex-Rays IDA MCP Server (HexRaysSA/ida-mcp) instead. Binary Ninja has several unofficial community MCP servers. We list one as an example and aren't endorsing any.
How they differ in practice
1. Scope. GhidraMCP describes itself as "an MCP server for allowing LLMs to autonomously reverse engineer applications" by exposing core Ghidra functions (decompile, rename, list methods/classes/imports/exports). REA's README calls itself "One MCP for reverse engineering across binaries, applications, and runtime behavior". Its target table runs from native binaries to Electron IPC, Android manifests and saved network captures.
2. REA can use IDA rather than replace it. REA's IDA provider "adapts an existing IDA MCP server", using mrexodia/ida-pro-mcp profiles or the ida-free-mcp native plugin. If you already run IDA Pro MCP, adding REA gives the agent one interface across IDA, Ghidra and the non-native workflows.
3. Evidence model. REA results carry evidence records (artifact identity, source locations, observations, inferences, unresolved findings) that you can export and compare (rea evidence-export, rea compare). Single-tool MCPs mostly return the raw tool output.
4. Footprint and tokens. REA's breadth costs something. Its docs measured about 172 tools and about 496 KB of tool definitions (~290 KB with the compact profile) when a client loads them all up front. Clients that defer tool loading avoid most of that. A small single-tool MCP is lighter. See token cost tips.
5. Maturity. GhidraMCP and IDA Pro MCP have been around much longer. REA moves fast (6.4.0 on Oct 11, 2026) and has hundreds of open issues and PRs. Expect to update often.
Which should you use?
- Free, all-round, agent-first: REA + Ghidra.
- You live in the Ghidra GUI and want the AI as a co-pilot there: GhidraMCP.
- You own IDA Pro: the official Hex-Rays MCP or IDA Pro MCP. Add REA if you also want Electron/.NET/APK workflows.
- Binary Ninja user: a Binary Ninja MCP plugin (check each one's maintenance status).
- Electron/JS-only work: REA. None of the others cover it.
Whichever you choose, the same legal limits apply. See the FAQ on what's allowed and try it on targets you own.
Facts and commands in this guide come from REA's official README and docs on GitHub (repository morluto/rea, npm release 6.4.0 checked by the project on 2026-10-11) and rea.tools. REA changes quickly. If something here doesn't match what you see, trust the current docs.
More in this REA series
- Background: What is REA? Timeline, the Adobe/Excel clone confusion and legal stakes
- How to Install REA and Connect It to Claude Code, Codex or Cursor (Step-by-Step, 2026)
- REA with Ghidra, IDA or Hopper: Which Backend to Pick and How to Set It Up (2026)
- REA Tutorial: Analyze an Electron App, .NET DLL or Android APK You Own With Your AI Agent (2026)
- REA Troubleshooting and FAQ: Common Errors, Token Cost, Privacy and Staying Legal (2026)
- Legal context: Is reverse engineering games legal?
← Back to all posts