The agent you already run
can read binaries.

Tools over what a binary does, contains and changed, installed into the agent you have with one command. The program is never run.

Works withClaude CodeCursorCodexGemini CLIVS CodeOpenCodeClaude Desktop
CLAUDE CODE · SYSPOLICYD · ONE SESSION, AS IT RANFACTS FROM THE ENGINE · REASONING BY THE AGENT

The build is the product.
Let the agent read it.

A coding agent reads source all day and goes blind the moment the compiler is done. Handed the binary, it cannot name a function, follow a call or say whether a bug is reachable. So it guesses, fluently.

openbinary hands it the facts instead. What a binary does, what is inside it and what changed, each as a tool call. Every answer carries the function, string, path or hash behind it. That replaces an afternoon in a disassembler before the first question.

Six questions. The questions an agent asks, and the tool that answers.

What is this binary?One call returns identity, verdict, counts and the top signatures. The next calls read headers, hardening and strings.describe_binaryidentity · verdict · countsget_headerssignature · entitlements · hardeningget_stringsinteresting, endpoints, full table
Read one functionOne function at a time, call targets resolved to names and string literals. A long render pages.decompile_functionpseudocode, 32 KB pagescall strcmp(x19, "prefs")targets resolvedtruncated → next_offsetthe next 32 KB
Does input reach the sink?Does A reach B, with the chain of calls. A predicate, with one witness path. The hubs worth reading first.graph_pathfrom → toshortest path, node chaingraph_reachablecrosses_authone witness pathgraph_neighborscallers and callees
Is the claim true?The validator skill re-queries every function, string and path the analyst cited. A claim that does not hold is marked unsupported.copies the request line uncheckedsupportedconnects to a hard-coded addressunsupported10 supported · 2 unsupportedverdict stands
Classify a thousand hashesA thousand hashes classified in one call. A new file is queued and polled. A firmware image is read member by member.verify_batchup to 1,000 hashesupload → job_statusa novel hash, analyseddescribe_packagelist_package_members
Keep what it learnedRename, retype, comment at an address. Kept in the workspace, shown in the web app, there for the next session.annotate_functiona name at an addressannotate_prototypea typed prototypeannotate_autofillfacts never overwritten
Does it solve the task

15 of 20 reversing challenges,
with the tools alone.

Claude Sonnet 5 holding only the openbinary MCP tools and Python. No Ghidra, no debugger, no network. Every solve derived from tool output; three were also recognised from memory. Median 6.2 minutes a solve.

See the run
Set
20 binaries from angr-examples, x86
Run
2026-09-19, engine 26.9.82, 67 tools served
Misses
2 missing a tool, 1 wrong answer, 1 over budget, 1 agent
Cost
$19.76 for all 20
Decompile
78x faster than Ghidra on syspolicyd, 1.73 s for 4,174 functions

One command. A key decides what it sees.

openbinary MCP setup · v0.2.0
API key, or Enter for anonymous public access
found 6 agents on this machine
Claude Code~/.claude.jsonwritten
Codex~/.codex/config.tomlwritten
Cursor~/.cursor/mcp.jsonwritten
Gemini CLI~/.gemini/settings.jsonwritten
VS Codeuser mcp.jsonwritten
OpenCode~/.config/opencode/opencode.jsonwritten
Claude Desktoppaste the printed entry into the appsnippet
6 written, 6 backups kept · restart the agent
Without a keyWith a key
SeesThe public corpus.Public corpus, your uploads and your workspaces.
Uploads5 an hour, always public.Private. 100 an hour free, unmetered on Pro, $100 a user a month.
AnnotationsNot available.Names and notes stay on the binary in your workspace. Pro.
Sign-upNone.A key from your account, kept in your own config, never in a repository.

72 tools. Grouped the way an agent reaches for them.

Find and orientsearch, query, resolve, describe_binary, get_headers, get_sections, read_bytes, get_libraries, get_dna, sightings, similar, cluster, binary_global_stats
Read the codelist_functions, list_imports, list_exports, get_strings, unusual_functions, decompile_function, emulate_function, function_suggestions
Findings and capabilitiesget_capabilities, get_findings, get_signatures, get_rule, get_sarif, vulnerabilities
Walk the call graphgraph_summary, graph_god_nodes, graph_find_node, graph_neighbors, graph_path, graph_reachable, graph_attack_surface
Compare and fuzzcompare, diff_functions, get_diff_text, put_diff_text, fuzz_function, fuzz_results
Packages and bulkdescribe_package, list_package_members, read_package_member, package_attack_surface, upload, download_binary, job_status, verify_batch, reanalyse
Annotate and readannotate_function, annotate_local, annotate_comment, annotate_data, annotate_prototype, annotate_list, annotate_autofill, annotate_clear, annotate_corpus_function, get_read, get_read_text, put_read_text, list_read_texts
Workflow and inboxget_workflow, set_workflow, add_note, get_activity, list_labels, get_inbox, mark_inbox_read, get_workspaces, presence, corpus_health
Graph, annotate and per-CVE detail from Pro · Fuzzing is an add-on · Decompile is switched on by the operator

Agents on binaries, asked plainly.

Short answers. Docs has the long ones.

Read the docs
  1. 01

    I already run GhidraMCP. What is different?

    Nothing runs on your machine: a hosted server answers over 76 tools. Reachability comes back with a witness path, every claim can be re-queried by the validator skill, and a thousand hashes classify in one call.

  2. 02

    How does the agent get a file in?

    Drop it on the web, send it through the upload tool or the API, or install the GitHub App so every release asset is analysed. An unknown hash is queued and returns a job to poll.

  3. 03

    Who can see what I upload?

    Anonymous and free uploads are public and join the corpus. Uploads with a workspace key stay private to that workspace.

  4. 04

    What does a tool call return?

    The same facts the web UI and the API serve, gated the same way. A finding comes with its function and whether it is reachable. A path comes with every hop, a function with its pseudocode.

  5. 05

    Can I check what the agent claimed?

    Yes. Every cited function, string and path is re-queried against the same tools, a claim that does not hold is marked unsupported, and the report says whether the verdict survives without it.

  6. 06

    Can the agent confirm a bug it found?

    Yes. It can fuzz one function and get back the input that triggers the bug, saved so the result replays.

  7. 07

    What happens when the engine cannot answer?

    A function it cannot read is marked unsupported, with the reason, and no pseudocode is invented for it. No route within the search bound is reported as none.

Put your agent on the binary.

npx openbinary setupRead the docs