Installation and Setup

This page covers installing ReVa, connecting an AI client, and configuration. The two most common setups are:

Plugin Installation

ReVa is distributed as a standard Ghidra extension archive (.zip file).

  1. Download the ReVa extension archive matching the installed Ghidra version.
  2. Open Ghidra and navigate to FileInstall Extensions from the Project window.
  3. Click the + button (top right) and select the ReVa .zip archive.
  4. Ensure the checkbox next to ReVa is checked, then click OK.
  5. Restart Ghidra to load the extension.

The extension must match the Ghidra version. ReVa requires Ghidra 12.0+ and Java 21+.

Plugin Activation

ReVa has STABLE status, which means it auto-loads in Ghidra's default tool configurations after installation. If you're using a fresh Ghidra setup, ReVa should already be active after restarting — look for this message in the log:

Starting MCP server on http://127.0.0.1:8080
MCP server started successfully

If you're using a customized tool configuration, ReVa must be activated manually in two places:

Step 1: Project Window

This starts the MCP server.

  1. From the Project window, select FileConfigure.
  2. Find the ReVa package and enable it.
  3. Click OK.

Step 2: CodeBrowser

This makes open programs visible to the AI.

  1. Open a program in the CodeBrowser.
  2. Select FileConfigure.
  3. Find the ReVa package and enable it.
  4. Click OK.

Save the tool configuration after activating ReVa (FileSave Tool) so you don't have to repeat this step.

MCP Client Configuration

Once ReVa is running in Ghidra, connect an MCP client.

Claude Code (HTTP)

Add ReVa to Claude Code's MCP configuration:

{
  "mcpServers": {
    "ReVa": {
      "url": "http://localhost:8080/mcp/message"
    }
  }
}

VS Code / Cursor

Add the same configuration to your editor's MCP settings:

{
  "mcpServers": {
    "ReVa": {
      "url": "http://localhost:8080/mcp/message"
    }
  }
}

Other MCP Clients

Any client supporting streamable HTTP transport can connect. Default endpoint: http://localhost:8080/mcp/message. If API key auth is enabled, send the key in the X-API-Key header.

CLI Setup (Claude Code without Ghidra GUI)

ReVa can run entirely from the command line through Claude Code, without opening Ghidra's GUI. The reverse-engineering-assistant Python package handles everything: it starts Ghidra headlessly, creates a project, and bridges Claude Code to the MCP server.

Installation

Install the package (requires Python 3.10+ and a Ghidra installation):

uv tool install reverse-engineering-assistant

Or with pip:

pip install reverse-engineering-assistant

Add to Claude Code

claude mcp add ReVa -- mcp-reva

Usage

That's it. Now just run claude in a directory with a binary and ask the AI to analyze it:

"Import ./firmware.bin and tell me what it does."

ReVa automatically creates a temporary Ghidra project, imports the binary, runs analysis, and makes everything available to the AI. The temporary project is cleaned up when the session ends.

The GHIDRA_INSTALL_DIR environment variable must point to a Ghidra installation for the CLI to work.

Headless Mode

For automation, scripting, or server deployments, ReVa can run without any GUI using the RevaHeadlessLauncher Java API via PyGhidra. The CLI mode (mcp-reva) is the simplest way to run headless — it handles all the setup automatically. See the project README for advanced headless configuration.

Configuration Options

In GUI mode, configure ReVa through EditTool OptionsReVa Server Options.

Server

Option Default Description
Server Port 8080 TCP port for the MCP server.
Server Host 127.0.0.1 Bind address. Use 0.0.0.0 for remote access (enable API key auth first).
Server Enabled true Set to false to disable the server.

Security

Option Default Description
API Key Authentication Enabled false Require an API key for all requests.
API Key (auto-generated) The key value. Auto-generated as ReVa-{UUID} if left empty.

Analysis

Option Default Description
Decompiler Timeout (seconds) 10 Max time per decompilation. Increase for complex functions.
Max Decompiler Search Functions 1000 Warns the AI about performance above this threshold.

Import

Option Default Description
Import Analysis Timeout (seconds) 600 Max time for auto-analysis after import (10 min).
Wait for Analysis on Import true Run auto-analysis after importing a file.
Import Max Depth 10 Max depth for importing containers/archives.

Debug

Option Default Description
Debug Mode false Enable debug logging.
Request Logging Enabled false Log all MCP requests to reva-tools.log.

Follow Me Mode

Follow Me is a GUI-only demo mode that automatically navigates the active CodeBrowser to whichever address the AI is operating on. It is useful for live demos and screen-shares because viewers can watch the listing scroll along with each MCP tool call.

Toggle Follow Me from the CodeBrowser toolbar (the navigate-on-event arrow icon) or from ToolsReVaFollow Me. The toggle is off by default and is not persisted — it resets every Ghidra session, so demos do not accidentally follow tools during normal analysis.

The toolbar button only appears in CodeBrowser tools. It has no effect in headless mode or when ReVa is driven through the stdio CLI.

For each tool call, the listing scrolls to the address being read or modified before the tool's work runs — so during a write, viewers see the cursor land first and the change appear afterwards. Consecutive calls targeting the same address are coalesced (the cursor does not jiggle in place).

Read / Write Filters

The two checkboxes under EditTool OptionsReVa Server Options control which kinds of tool calls trigger navigation when Follow Me is on. Both default to true.

Option Default Description
Follow Reads true Follow tools that inspect program state — for example get-decompilation, find-cross-references, read-memory, get-call-graph. Turn off if the AI's exploration is too noisy to watch.
Follow Writes true Follow tools that modify program state — for example set-comment, rename-variables, create-function, apply-data-type.

Multiple Programs

If the AI operates on a program that is not the one currently displayed in the active CodeBrowser, the navigation is silently skipped — Ghidra does not switch programs underneath you. Open the program first if you want the cursor to follow.

Build from Source

Requirements: Java 21+ (JDK), Gradle 9.x+, Ghidra 12.0+.

  1. Set GHIDRA_INSTALL_DIR: 
    export GHIDRA_INSTALL_DIR=/path/to/ghidra
  2. Build: 
    gradle
  3. The extension archive is in dist/.

Use gradle directly, not ./gradlew.

To install directly into Ghidra (for development):

gradle install

Troubleshooting

Server Does Not Start

  • Port in use — Another process is using port 8080. Change the port in Tool Options, or stop the other process.
  • Plugin not activated in Project window — The server is managed by the application-level plugin. See Plugin Activation.
  • Server disabled — Check that Server Enabled is true in Tool Options.

No Programs Visible

  • Plugin not activated in CodeBrowser — Each CodeBrowser needs ReVa activated. See Step 2.
  • No program open — Open a program in the CodeBrowser, or ask the AI to import one.

Client Cannot Connect

  • Wrong URL — Use http://localhost:8080/mcp/message (the full path matters).
  • API key required — Include the key in the X-API-Key header if auth is enabled.

Jackson Library Conflicts

If the extension fails to load with Jackson errors:

rm lib/*.jar
gradle

CLI Issues

  • PyGhidra fails — Ensure GHIDRA_INSTALL_DIR is set correctly.
  • Stdio bridge hangs — Make sure nothing else is writing to stdout (e.g., shell init scripts printing messages).
  • Slow startup — Initial startup takes 4–7 seconds while Ghidra initializes. This is normal.

Provided by: ReVa

Related Topics