| Compare approaches | Mechanism | When to choose it |
|---|---|---|
| REA | An open-source MCP server: your agent calls REA to inspect a local target (native binaries, JavaScript and Electron apps, .NET, websites and more) and gets findings with their evidence. | Choose REA when you want your agent to investigate software you own or may examine and explain it with evidence. |
| GhidraMCP | An MCP server plus a Ghidra plugin (Apache-2.0) that exposes core Ghidra functions to MCP clients: decompile and analyse binaries, rename methods and data, list methods, classes, imports and exports. It connects to a running Ghidra (its README targets Ghidra 12.1.4) or imports a binary headlessly with PyGhidra. | Choose GhidraMCP when you work in a Ghidra project and want your agent to drive it, renames included. REA can also use an existing Ghidra installation as its native engine, but imports each target into a temporary Ghidra database instead of your project. |
Practical setup notes for running REA on Fedora-based Linux, with the problems hit along the way and a queue of tests.
How to run REA with local models on a single 12 GB GPU, and how five models compared.
A show-and-tell thread on keeping token use down in REA workflows and what other people are using.
Often yes, but check each tool's documentation for supported targets and setup, and analyse only software you own or are authorised to examine.