Reverse engineering MCP
for obfuscated binaries
A reverse engineering MCP workflow connects a coding agent to tools that can inspect a binary, trace calls and return evidence. REA is one example: it connects an agent to local native analysis tools and returns findings with their limits. When VMProtect, Themida or another obfuscator turns the function you need into a virtual machine loop, local pseudocode may stop being useful. That is where a scoped Devirt handoff can help.
Devirt is independent and is not affiliated with or endorsed by REA, IDA, Ghidra, Binary Ninja or any model provider. The workflow described here works with REA or another MCP-compatible reversing agent and keeps the user in control of upload, authorization, scope and payment.
What is a reverse engineering MCP server?
A reverse engineering MCP server is a Model Context Protocol server that exposes binary analysis tools, such as a disassembler, decompiler or debugger, as functions an AI agent can call. Open-source examples include GhidraMCP for Ghidra, IDA Pro MCP for IDA Pro and radare2-mcp for radare2.
REA goes further. It describes a workflow across native binaries, applications and runtime behavior, using local tools such as Hopper, Ghidra or IDA when they are available, and it runs the same workflows over MCP or a command line. Its findings can include pseudocode, assembly, strings, symbols, calls and references. The agent can then ask a narrower question, follow a call chain and explain the evidence it received.
The important distinction is the boundary: a reverse engineering MCP agent can only reason from what its connected tools can read. A model summary does not make a protected function readable, and a plausible decompilation is not proof of semantic equivalence.
The MCP tools specification recommends visible tool use and human control for model-triggered actions. Devirt keeps that boundary explicit: its first MCP connector is read-only and cannot silently upload a customer binary or start a paid job.
Why do MCP reversing agents stall on virtualized code?
Packing and obfuscation can make a file harder to inspect, but virtualization changes the representation of selected functions. A disassembler may show a dispatcher, virtual registers and handlers instead of the operations that implement the function. An MCP reversing agent can describe that interpreter accurately and still be unable to answer what the protected function does.
Tool authors and researchers describe the same limit. The IDA Pro MCP README warns that “LLMs will not perform well on obfuscated code”, and a 2026 review of agentic reverse-engineering systems lists obfuscation among the cases where current systems still fail. Commercial protectors such as VMProtect and Themida let developers virtualize the functions they most want to protect, which are often the ones an analysis needs.
First identify the question and the smallest function set that answers it. If the target is packed only, unpacking may be enough. If it is obfuscated, a deobfuscation step may improve readability. If it is virtualized, devirtualization is the relevant recovery step. See devirtualization versus deobfuscation versus unpacking for the difference.
How to hand a blocked scope to Devirt
- Inspect locally. Ask REA or another MCP-compatible agent to identify the protector, blocked functions, dependencies and the question your investigation must answer.
- Create an account and upload. Submit only a binary you own or are authorized to analyze. Include the function addresses or names and the analysis question in the assessment.
- Review feasibility. Devirt checks the family, architecture, build, layers and complexity. Complex or unfamiliar files may require manual review, a separate written quote or a decline.
- Approve the agreed work. Paid work starts only after the scope, deliverables, price and timing are visible and accepted in the account.
- Continue with evidence. After completion, the read-only Devirt MCP connector can return status, coverage, proof metadata and an explicitly requested temporary artifact link for the agent or analyst to use.
What does Devirt return to the agent?
The Devirt MCP server is read-only and exposes six tools: devirt_get_capabilities, devirt_list_assessments, devirt_get_assessment, devirt_list_jobs, devirt_get_job and devirt_get_result. None of them can upload a file, start a job, accept an offer or pay.
The connector returns structured metadata instead of placing raw binaries into a model context by default. Depending on the accepted package, the result can identify an IDA database, annotated pseudocode, API JSON or another agreed output, together with the coverage ledger and proof summary. The ledger separates proven, runtime-dependent, unresolved and permanently bounded units.
A signed artifact URL is short-lived and is returned only when explicitly requested. An expired or deleted output is reported as unavailable. The MCP server does not copy the artifact into its own storage or expose API keys in tool output.
This is not original-source recovery. Compilation and protection discard names, comments, structure and sometimes behavior that depends on an environment the analysis did not observe. The result states what the accepted scope establishes and what remains open, so an agent can continue without turning an inference into a fact.
REA, MCP and Devirt: common questions
Is this an official REA integration?
No. Devirt is independent. The connector is a general MCP server that can be registered beside REA or another MCP-compatible agent.
Does REA upload my application to Devirt?
No. REA is designed for local analysis. Devirt upload and authorization happen through your account, and the first connector release only reads work you have already submitted and approved.
Can Devirt devirtualize every VMProtect or Themida file?
No. The protector name is an intake signal, not a guarantee. Exact build, architecture, VM profile, layers and complexity determine whether the requested scope is feasible. Start with an assessment for any file that is outside the published bounded offer.
What should I use first?
Start with your local MCP reversing agent for triage and function selection. If the protected boundary is the blocker, see how agent-assisted reverse engineering hands the blocked functions to Devirt, and submit the smallest authorized scope.
For the commercial path and individual plan choices, see AI reverse engineering for protected binaries.