cellebrite-labs/ghidra-rpc

Ghidra is a free reverse engineering tool released by the US National Security Agency. Reverse engineering means examining compiled software binaries to understand what they do, often because you do not have access to the original source code. It is commonly used in security research, vulnerability analysis, and malware investigation. Ghidra-rpc, built by Cellebrite Labs, is a Python project that connects Ghidra to AI coding assistants so those assistants can perform reverse engineering work on their own. The way it works is that ghidra-rpc runs Ghidra as a persistent background process on your machine and exposes everything Ghidra can do through a command-line tool that speaks structured data. An AI assistant that can run shell commands, such as Claude Code or Cursor, can then issue commands and reason over the results without a human guiding each step. Because Ghidra stays running between commands rather than restarting each time, the session is fast and retains context. The AI can do a wide range of tasks through this setup: decompile functions into readable pseudo-code, trace which functions call which, search for specific strings or byte patterns inside a binary, rename functions and variables to make them easier to understand, define data structures, and compare two versions of a binary to find what changed. Any annotations, renames, or comments the AI adds are saved back to the Ghidra project file, so they show up if you later open that project in the regular Ghidra graphical interface. You can also use the command-line tool manually for debugging or to inspect binaries yourself without involving an AI. The README includes a short example showing how to load a binary, decompile a function, look up cross-references, and rename a function, all from the terminal. The project requires Ghidra 11 or later, Python 3.11 or later, and Java 17 or later. It is licensed under the MIT license and was developed at Cellebrite Labs. Documentation covers installation, a quickstart guide, and workflow guides for tasks like binary auditing, vulnerability research, and patch analysis.