Ghidra gets an LLM co-pilot that actually knows the binary

What it does

GhidrAssist is a Ghidra plugin that pipes disassembly and decompiled pseudo-C to any OpenAI-compatible LLM, local or cloud. It explains functions in a persistent chat panel, answers custom queries with optional binary context, and can autonomously rename variables, jump to cross-references, or execute Ghidra commands via function calling. The plugin also builds a hierarchical knowledge graph of the binary so you can query pre-computed summaries without burning API tokens on every click.

The interesting bit

The Graph-RAG backend is the quiet workhorse: it indexes the binary into a five-level semantic hierarchy, runs the Leiden algorithm to auto-discover modules, and caches everything in SQLite with JGraphT. Once indexed, you can explore call relationships and security annotations offline while the LLM handles only the novel reasoning. It is essentially a static-analysis database wearing an LLM interface.

Key highlights

• Supports any OpenAI v1-compatible endpoint, including Ollama, LM Studio, Anthropic, Azure, and LiteLLM proxies.
• ReAct agentic mode proposes todo lists, executes Ghidra tools systematically, and synthesizes findings with full iteration history.
• Security feature extractor automatically flags network, file I/O, crypto, and string patterns with LOW/MEDIUM/HIGH risk levels.
• MCP client integration talks to external tool servers (like GhidrAssistMCP) over SSE for extended Ghidra-specific capabilities.
• Per-program reasoning effort levels let you throttle thinking depth—and API cost—independently for each binary.

Caveats

• Agentic mode and extended thinking demand strong models; the README admits smaller local LLMs can flail on complex multi-step investigations.
• Building the semantic graph requires an upfront indexing pass and LLM calls to generate summaries, so offline browsing only works after you have spent the tokens and time.
• Requires Ghidra 11.0 or newer.

Verdict

Worth a look if you reverse engineer binaries daily and want an LLM that can rename variables, trace data flow, and build a queryable graph of the program. Skip it if you open Ghidra only to check a single function once a month.