Open-source rizin-mcp lets LLMs run local binary and malware analysis via Rizin
Pure_Emergency1424 · reddit · 2026-10-16
A Reddit user released rizin-mcp, a lightweight open-source (MIT) MCP server that connects LLMs to Rizin, RzGhidra, and Mandiant capa for local binary analysis, aimed at malware analysis workflows.
- Motivation: the author couldn't find a lightweight, non-GUI MCP server that handled large or multiple binaries, so built one with AI pair-coding — with a local LLM, sensitive artifacts never leave the machine.
- Exposed tools:
- openandanalyze: runs Rizin's aaa auto-analysis
- decompilefunction: fetches C pseudocode via rz-ghidra
- getcapaanalysis: runs Mandiant capa to map capabilities to MITRE ATT&CK or malware behaviors
- listfunctions / getbinaryinfo: structural inspection (entry points, function sizes, sections)
- The first-time maintainer welcomes reverse engineers, malware analysts, and CTF players to test it and file issues.
Repo: github.com/kd992102/rizin-mcp
More from coding & agent
- Coding agents keep opening 3 stacked PRs per chat, and merging them is a nightmare — holdenmatt · 2026-10-16
- Google-led paper uses sequential auctions to organize decentralized LLM agent workflows — _onionesque · 2026-10-16
- Since OpenAI's math release, GitHub contributors keep driving down the integer-multiplication kappa — xennygrimmato_ · 2026-10-16
- Pattern MCP makes coding agents check existing components before writing new code — DonR954 · 2026-10-16
- Zero-keyframe procedural spider walks walls and ceilings using pure raycasts — yshan2u · 2026-10-16
- OpenCode v1.19.2 keeps 1.x installs off the 2.x update path — opencode-agent[bot] · 2026-10-16