REA + Ghidra Toolkit

io.github.ethanhunt1981Published by GitHub account ethanhunt1981v1.0.0Updated Oct 29, 2026

Evidence-oriented REA + Ghidra static-analysis workflows, read-only PE32 and Delphi VMT tools.

VerifiedStreamable HTTPWeb executableKnowledge & MemoryDeveloper Tools

Overview

AI-generated overview

GitMCP-hosted remote server that lets an assistant fetch, search and cite the REA + Ghidra Toolkit docs and code for authorized PE32 static analysis.

What you can do
  • Fetch the repository's full documentation file for general questions about the toolkit
  • Semantically search that fetched documentation for specific queries
  • Search the repository's code via the GitHub Search API and return matching files
  • Fetch content from any absolute URL referenced in previously retrieved documentation, respecting robots.txt
When to use it
Useful when an assistant needs to answer questions about the REA + Ghidra Toolkit's workflows, PE32/Delphi VMT guidance or Ghidra export helpers without cloning the repository. It is a documentation and code lookup aid, not a binary analysis engine itself.
Requirements
A remote streamable HTTP endpoint at gitmcp.io; no package, API key, environment variable or header is declared. Network access to the endpoint and to URLs it fetches is needed.
Before you install
The generic URL fetch tool retrieves content from arbitrary absolute URLs, so fetched pages are third-party data. The repository covers static analysis of binaries and stresses legal authorization; the server itself only reads documentation and code.

Installation

In SourceWeft

  1. Open REA + Ghidra Toolkit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ethanhunt1981%2Frea-ghidra-toolkit/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "rea-ghidra-toolkit": {
      "type": "http",
      "url": "https://gitmcp.io/ethanhunt1981/rea-ghidra-toolkit/mcp"
    }
  }
}

README

REA + Ghidra Toolkit

[REA + Ghidra Toolkit — evidence-first analysis banner]

[GitMCP docs] [Glama MCP connector] [License] [Python] [Ghidra] [REA]

A small, dependency-light toolkit for authorized static analysis of native binaries with REA and Ghidra. It is intentionally built as a reusable knowledge base for agents, not as a dumping ground for a specific target.

Think in two layers

  • This repository contains only generic methods, tools, and synthetic tests.
  • Every target-specific artifact, decompilation, or private result stays in the private analysis project.

When this applies

The toolkit is aimed at native, unmanaged PE32 binaries on Windows:

Not a fit for managed runtimes (.NET / Java), PE32+ 64-bit images (the quick parser is deliberately PE32-only), executing code as a debugging workflow, or any target without solid legal authorization.

Why this exists

You want to avoid rebuilding the same reverse-engineering workflow from scratch every time. This toolkit answers:

  • How do I start a PE / Delphi analysis in a traceable way?
  • How do I combine REA, Ghidra, and small local tools without treating inferences as facts?
  • How do I export and document results so a later session can continue?
  • Which mistakes should be avoided early instead of discovered late?

Repository layout

text
.├── docs/│   ├── workflow.md│   ├── rea-ghidra.md│   ├── delphi-pe32.md│   ├── evidence.md│   ├── troubleshooting.md│   └── gitmcp.md├── tools/│   ├── pe32.py│   ├── pe_inventory.py│   └── delphi_vmt.py├── ghidra/│   └── scripts/ExportDecompilation.java├── templates/│   ├── analysis-log.md│   └── handover.md├── tests/├── assets/├── AGENTS.md├── LICENSE└── llms.txt

What you get

AreaWhat is insideGood next read
🧭 docs/Evidence-oriented, reproducible workflows and validation rulesworkflow.md
🩺 tools/Read-only PE32 inventory and VMT helperstools/pe_inventory.py
🧰 ghidra/Headless export helperExportDecompilation.java
🫙 templates/Private analysis and handover templatestemplates/analysis-log.md
🧪 tests/Synthetic, dependency-light teststests/test_pe32.py

Quickstart

powershell
# From the repository rootpython -m tools.pe_inventory "C:\analysis\program.exe"python -m tools.pe_inventory "C:\analysis\program.exe" --imports --json
# Check a known VMT candidatepython -m tools.delphi_vmt "C:\analysis\program.exe" --vmt 0x00412340
# Heuristic search; always validate candidates in a disassemblerpython -m tools.delphi_vmt "C:\analysis\program.exe" --scan

Run the synthetic test suite:

powershell
python -m unittest discover -v

GitMCP

This repository is designed to be used with https://gitmcp.io/ethanhunt1981/rea-ghidra-toolkit.

It is also listed in the official MCP Registry as io.github.ethanhunt1981/rea-ghidra-toolkit (streamable HTTP via GitMCP; metadata in server.json).

OpenCode / typical agent setup:

jsonc
{  "$schema": "https://opencode.ai/config.json",  "mcp": {    "servers": {      "rea-ghidra-toolkit": {        "type": "remote",        "url": "https://gitmcp.io/ethanhunt1981/rea-ghidra-toolkit"      }    }  }}

OpenCode CLI command:

sh
opencode mcp add rea-ghidra-toolkit --global --url https://gitmcp.io/ethanhunt1981/rea-ghidra-toolkitopencode mcp list

[GitMCP]

Core rule

Observation, inference, and unknown are three different things. A plausible name, string, or VMT candidate is not yet a behavioral proof. The templates are here to keep that distinction visible across sessions.

License

This repository is licensed under the MIT License. The license covers the included methodology and tooling only. It does not cover original binaries, target-specific specifications, third-party protected material, or private analysis results.

Source: README.md at commit 125877d

Tools

4

fetch_rea_ghidra_docs

Fetch entire documentation file from GitHub repository: ethanhunt1981/rea-ghidra-toolkit. Useful for general questions. Always call this tool first if asked about ethanhunt1981/rea-ghidra-toolkit.

Takes no parameters.

search_rea_ghidra_docs

Semantically search within the fetched documentation from GitHub repository: ethanhunt1981/rea-ghidra-toolkit. Useful for specific queries.

Parametersqueryrequired

search_rea_ghidra_code

Search for code within the GitHub repository: "ethanhunt1981/rea-ghidra-toolkit" using the GitHub Search API (exact match). Returns matching files for you to query further if relevant.

Parameterspagequeryrequired

fetch_generic_url_content

Generic tool to fetch content from any absolute URL, respecting robots.txt rules. Use this to retrieve referenced urls (absolute urls) that were mentioned in previously fetched documentation.

Parametersurlrequired

Version history

1
  1. v1.0.0LatestOct 29, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts