Install a reverse engineering MCP for three coding agents and cut its token cost

Ercan Atay had Claude Code build the REA reverse engineering server from source, wire it to Ghidra for Claude Code, Codex and opencode, and shrink its tool catalog from about 200K to 55K tokens in one session.

Done with

Claude Code

Apps touched

GitHub

NPM

ReportedOct 16, 2026

What they did

The author wanted coding agents that could look inside compiled apps with no source. In a single chat session on an Apple Silicon Mac, Claude Code read the README of REA (morluto/rea), an open-source MCP server that puts Ghidra and other reverse engineering engines behind 207 tools. It cloned and built version 6.5.0 from source, ran the setup command as a dry run first, then after approval registered the server and its skill for Claude Code, Codex and opencode, backing up each config file. Ghidra 12.1.4 and Java 21 came from Homebrew and were wired in through environment variables. It ran a smoke test against a copy of /usr/bin/true, then measured how many tokens the tool list costs by calling the server over MCP, and saved what it learned to memory for the next update.

How it went

The setup worked: Ghidra found the entry function of the test binary and every agent registration came back aligned. When REA's own doctor command reported all three as stale, the agent read the source and found the check compared a symlink path with the real path as strings, so the warning was false. Measured over MCP, the full tool catalog was about 200K tokens and the compact schema profile about 55K, so the compact profile went into Codex and opencode. Claude Code kept the full one because it loads MCP tools on demand. One tool probe timed out because Apktool was not installed; it was worked around. Disk cost was about 1.4 GB.

Worth knowing

REA's Ghidra provider needs exactly Ghidra 12.1.x and Java 21, so the author pinned Ghidra but pointed JAVA_HOME at Homebrew's stable opt path so Java still gets security updates. Decompiled strings from the target go to the model, so they can carry prompt injection and any binary under NDA reaches the provider. Only analyse software you are allowed to.

Try it yourself withTry it withClaude Code

5 parts to fill in

Install [REA or another reverse engineering MCP server] from source at [repo URL] and register it for [Claude Code, Codex and opencode]. Read the README and list the requirements first. Install the engine it needs ([Ghidra and Java 21]) and pin only what demands an exact version. Run the setup as a dry run and show me what it will change before you apply it, and back up every config file you touch. Smoke test it on a harmless binary like [a copy of /usr/bin/true]. Then measure how many tokens each client pays for the tool list and pick the leanest schema setting per client. Stop and ask me if a diagnostic warning does not make sense instead of reinstalling.

Square brackets are the parts to fill in. The prompt is ours; the story is theirs.