REA vs GhidraMCP, ida-pro-mcp, r2mcp and Binary Ninja MCP

Short version: these projects are not all solving the same problem. GhidraMCP, ida-pro-mcp, r2mcp and the Binary Ninja MCP plugins each expose one disassembler to an AI agent, usually with close to the engine’s full feature set, including edits. REA, the open-source project by morluto, is a broader MCP server that drives several engines (Hopper, Ghidra, IDA) for native code and adds non-native targets such as JavaScript/Electron, .NET, Android, websites and firmware, wrapping results in Evidence with stated limitations. If you live in one disassembler and want the agent inside it, a single-engine server is the more direct fit. If your targets span formats, or you want reproducible evidence, REA is the more natural fit. They can also be combined: REA’s IDA provider is built on top of ida-pro-mcp.

This page is for developers choosing an MCP setup for AI-assisted reverse engineering. It compares coverage, backends, installation, pricing and licensing, and use cases.

Method and date. Everything about the other projects was checked against their repositories, release pages and vendor pricing pages as of 2026-10 (the checks were made on 2026-10-13). REA facts come from its repository docs for version 6.4.0. Projects in this space change monthly, so verify anything that matters to you against the linked sources. Where something could not be confirmed, the table says not verified. Star counts are omitted on purpose: they say little about fitness for a task.

The projects in one paragraph each

REA (morluto/rea). A Node.js MCP server and CLI (rea). Native analysis goes through a provider: Hopper, Ghidra, or IDA (the latter through an existing IDA MCP server). It also covers JavaScript/Electron, .NET, Android (JADX, Apktool, ADB), JEB projects, websites, saved network captures, SQLite, firmware (Binwalk/Unblob), packet captures and more, each with its own prerequisites. Results come back as Evidence with digests and limitations, and can be saved as snapshots. MIT licensed. Sources: README, installation.

GhidraMCP (LaurieWired/GhidraMCP). A Ghidra extension that runs an HTTP server inside Ghidra (default localhost:8080), plus a Python MCP bridge (ghidra-mcp). A headless mode uses PyGhidra to import and analyze a binary without the GUI. The README targets Ghidra 12.1.4 and lists decompiling, renaming methods and data, and listing methods, classes, imports and exports. Apache-2.0. Latest GitHub release 2.0, published 2026-10-10 (releases).

ida-pro-mcp (mrexodia/ida-pro-mcp). An MCP server for IDA Pro. The recommended mode is idalib-mcp, a headless supervisor that keeps each database in its own idalib worker; the older GUI plugin is described as no longer recommended. Tool groups include decompile/disassemble/xrefs, modification (comments, patching, types), memory reads, stack frames and structures, search, call graphs, an optional debugger extension, and py_eval. Requires IDA Pro 8.3+ (9 recommended); the README states IDA Free is not supported. Python 3.11+ and uv. MIT. The latest GitHub release is 1.4.0 (2025-10-06), and a later 1.5.0 tag (2025-11-18) has no release page; the default branch is active (last push 2026-09-26), and installation is from the branch or plugin marketplaces. Notably, the README now says: “I recommend using the Official Hex-Rays IDA MCP Server instead” (HexRaysSA/ida-mcp, which requires IDA 9.4+ with idalib, MIT, release v20261008.0.1).

r2mcp (radareorg/radare2-mcp). An MCP server for radare2, written in C on the native r2 APIs. It runs as a stdio server, as an r2 core plugin, or as an HTTP server with optional session multiplexing and bearer-token auth. It supports read-only mode, a sandbox lock and restricted tool sets, plus optional raw r2 command or r2js execution. Install with r2pm -Uci r2mcp, Docker, or a source build. MIT. Latest release 1.8.8, published 2026-09-06.

Binary Ninja MCP (fosdickio/binary_ninja_mcp). The most widely referenced community plugin: an MCP server inside Binary Ninja plus a bridge (npx -y binary-ninja-mcp or a legacy Python bridge). Features include decompilation, HLIL/MLIL/LLIL, renaming, comments, types, xrefs, strings, hexdumps, byte patching and multiple open binaries. Python 3.12+. GPL-3.0. Latest release v1.2.1 (2026-03-22); the default branch had pushes in 2026-10. Vector35 also documents a beta Sidekick MCP server that exposes Sidekick workspaces and its agent to external clients (Sidekick docs); this article does not evaluate it.

Comparison table

As of 2026-10. “Engine cost” is the cost of the underlying disassembler, not the MCP server.

Notes on engine pricing, from vendor pages checked 2026-10-13:

• IDA: Hex-Rays lists IDA Free at no cost (x86/x64, cloud decompilers), IDA Home from $365/year, and IDA Pro tiers starting from €1,099/year, with a headless OEM license on request (pricing). ida-pro-mcp requires IDA Pro. Whether IDA Home works with ida-pro-mcp or idalib: not verified.
• Binary Ninja: Vector35 lists Free ($0, no plugins), Personal/Non-Commercial ($199, plugins in the GUI only, no headless), Commercial ($1,799, headless) and Ultimate ($3,499) (purchase). The fosdickio plugin runs inside the GUI, so Personal or higher is needed. Whether every feature works on Personal: not verified.
• Hopper (used by REA): commercial with a vendor-defined free demo, per REA’s installation docs.

Dimension by dimension

Coverage

The single-engine servers expose what their engine can do, and they tend to go deep. ida-pro-mcp reaches into stack frames, structures, type inference, a debugger extension and arbitrary IDAPython through py_eval. r2mcp can pass raw r2 commands and r2js scripts. The Binary Ninja plugin exposes all three IL levels. GhidraMCP focuses on the core read-and-rename loop.

REA trades some of that per-engine depth for breadth. Its Ghidra adapter exposes 25 read-only operations plus a few session-scoped naming edits, documented in ghidra-provider.md. The difference is in everything around native code: Electron ASAR and IPC tracing, .NET metadata and CIL, APK decompilation through JADX, browser and HAR capture, Binwalk/Unblob firmware extraction, recorded crashes and more. Each target has its own documented host requirements, and several (firmware, packet captures, signal recordings, recorded crashes) are Linux-only, and some are verified only on Linux x64.

Backend and how analysis runs

GhidraMCP, ida-pro-mcp and the Binary Ninja plugin can attach to an engine you have open, so the agent and you see the same database. That makes them good pair-programming tools: rename something in the GUI and the agent sees it.

REA’s Ghidra provider instead imports each target into an ephemeral project and deletes it afterwards. Executable bytes are never changed, and naming edits are discarded on close. That is less interactive but more reproducible, and pairs with REA’s snapshots: results are keyed by target bytes, operation, parameters, provider and settings (cli.md). For GUI-driven work REA points to Hopper. For IDA, REA can attach to an already-open GUI database through ida-pro-mcp’s legacy 1.4.0 tools and checks the input SHA-256 against IDA’s recorded hash (ida-provider.md).

Installation

• REA: npx rea-agents setup shows a plan, writes agent registrations and skill files after approval, and keeps backups. Engines are separate: it never installs Ghidra, Java or Python, though it can optionally install Hopper after approval. rea doctor --provider ghidra --json checks readiness.
• GhidraMCP: install the release zip through Ghidra’s File > Install Extensions, enable the plugin, then register the uvx-launched bridge with your client.
• ida-pro-mcp: activate idalib with IDA’s py-activate-idalib.py, then install through the Claude Code or Codex plugin marketplace, or via pip from the GitHub archive.
• r2mcp: one r2pm command if radare2 is already installed.
• Binary Ninja MCP: install from Binary Ninja’s Plugin Manager; it can auto-configure several clients.

Licensing

All five MCP servers are open source. Four are permissive (MIT or Apache-2.0); fosdickio’s Binary Ninja plugin is GPL-3.0, which matters if you plan to modify and redistribute it. The bigger licensing question is usually the engine. REA’s README is explicit that commercial tools such as IDA Pro, Hopper and JEB must be legally obtained and used under their licenses, and REA grants no license or activation.

Which one fits?

• You already work in IDA Pro and want the agent inside your database: ida-pro-mcp, or the official Hex-Rays IDA MCP if you are on IDA 9.4+. You get edits, types and debugger access.
• You want a free stack centered on Ghidra and like working in the GUI: GhidraMCP.
• You live in radare2, script with r2pipe, or need a small C binary with read-only and sandbox switches: r2mcp.
• You use Binary Ninja Personal or Commercial and want IL-level access: the Binary Ninja MCP plugin, or evaluate the beta Sidekick MCP server.
• Your targets are mixed (a native helper plus an Electron front end, an APK, a firmware image), or you need evidence you can save and compare: REA. It is also a reasonable choice if you want one MCP registration that can switch between Hopper, Ghidra and IDA per target.

Running more than one is fine, but give each server a distinct name in your client config. Hex-Rays’ README recommends disabling other IDA MCP servers to reduce agent confusion, and the same logic applies when two servers expose similar tool names.

Common questions

Is REA a replacement for GhidraMCP? Not exactly. Both use Ghidra 12.1.x, but GhidraMCP attaches to your interactive project while REA uses an ephemeral headless import. Pick based on whether you want shared GUI state or isolated, reproducible runs.

Does REA need IDA? No. Native analysis can use Hopper, Ghidra or IDA. Static JavaScript and .NET analysis need no native engine (README FAQ).

Can I use ida-pro-mcp with IDA Free? Its README says no. REA documents an optional separate native bridge (ida-free-mcp) for IDA Pro and IDA Free; note REA’s warning that its 1.1.2 release binds 0.0.0.0, so restrict it with a firewall.

Which is fastest? Not verified. No neutral benchmark was found, and speed depends far more on the engine’s auto-analysis than on the MCP layer.

Are these projects safe to point at untrusted binaries? Static analysis does not run the target, but each server has a different network posture (HTTP ports, auth options). Bind to loopback, read each project’s security notes, and only analyze software you are authorized to examine. See REA’s DISCLAIMER.md.

Next steps

• Install REA and connect it to your agent: Getting started with REA MCP.
• See the free Ghidra path in practice: REA + Ghidra for native binaries.
• Try a non-native target: Reverse engineering an Electron app or Android APK analysis.
• Learn how Evidence and snapshots make runs comparable: Evidence, snapshots and comparisons.

Sources (checked 2026-10-13)

• REA: README, installation, Ghidra provider, IDA provider, CHANGELOG
• GhidraMCP: repository, releases
• ida-pro-mcp: repository; Hex-Rays IDA MCP: repository, announcement
• r2mcp: repository
• Binary Ninja MCP: fosdickio/binary_ninja_mcp, Sidekick MCP server docs
• Pricing: Hex-Rays, Binary Ninja