RE:GINE
Ghidra Is Not Enough — drop a binary, give an objective, and an autonomous LLM agent drives headless Ghidra through 209 MCP tools. You get a structured Markdown report and an annotated Ghidra project: not a verdict, a starting point.
What it does
Drop-and-go ingest
Drop a binary in data/inbox/, upload it in the web UI, POST it to the REST API, or call submit_binary over MCP.
Curated workflows
Malware triage, vulnerability research, license validation and cross-revision comparison — plus an auto router that picks one for you.
Auto-enhance
Pin a function, click Enhance, and a scoped agent run renames, retypes and comments it back into Ghidra without touching the rest of the project.
Compare mode
Two binaries in one Ghidra project; the agent diffs added, removed and changed functions with a rationale for each.
Cross-binary recall
Session summaries and enhanced function signatures are embedded in pgvector so later analyses start from what earlier ones learned.
Multi-provider LLM
Local Ollama by default, or Anthropic, OpenAI, Gemini, vLLM and an OIDC-authenticated LiteLLM gateway. Bring your own key, per user.
REST, MCP and A2A
Three transports on one pipeline, plus a per-job WebSocket streaming the agent's thoughts and tool calls live.
Project persistence
Export the full Ghidra project (.gar) or a single program (.gzf) and re-import it as a replacement or a new job.
Flexible auth
OIDC with refresh tokens, a static bearer token, or fully disabled for trusted networks. Optional per-user credit wallet.