Not in the top 1,000 by GitHub stars

cellebrite-labs/ghidra-rpc

A Ghidra agentic reverse engineering skill.

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → fa3866243dcf

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit fa3866243dcfcbc876baa7b13ae0deac2c443cd8

git clone --filter=blob:none --no-checkout https://github.com/cellebrite-labs/ghidra-rpc.git .hotskills/cellebrite-labs-ghidra-rpc && git -C .hotskills/cellebrite-labs-ghidra-rpc checkout --detach fa3866243dcfcbc876baa7b13ae0deac2c443cd8 # Copy each selected skill directory from .hotskills/cellebrite-labs-ghidra-rpc into .claude/skills/<skill-name>/
git clone --filter=blob:none --no-checkout https://github.com/cellebrite-labs/ghidra-rpc.git .hotskills/cellebrite-labs-ghidra-rpc && git -C .hotskills/cellebrite-labs-ghidra-rpc checkout --detach fa3866243dcfcbc876baa7b13ae0deac2c443cd8 # Copy each selected skill directory from .hotskills/cellebrite-labs-ghidra-rpc into .agents/skills/<skill-name>/
397GitHub stars
6stars in 7 days
1skill in this repository
24commits in 30 days

Heat

4.8
  • Star growth, last 7 daysNot available
  • Star growth, last 24 hoursNot available
  • Rank movement, last 7 daysNot available
  • Commits, last 30 daysNot available
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Oct 25, 2026Nov 6, 2026397

30-day change not yet available: not enough history.

Individual skills in this repository

How it works

ghidra-rpc

When your agent uses it

Reverse engineering assistant powered by Ghidra. Use for binary analysis, decompilation, vulnerability research, auditing compiled code, renaming symbols, annotating disassembly, cross-references, or any RE task - even without explicit mention of Ghidra.

What it loads into context

Frontmatter

68 tokens

Always available to the agent

SKILL.md

11,173 tokens

When the skill is activated

Reference documents

32,533 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. Running Commands
  2. Prerequisites Check
  3. Command Reference
  4. Error Handling
  5. Write Operations & Persistence
  6. Patch / Diff Analysis Quick Start
  7. Android APK / DEX Analysis
  8. Typical Workflow
  9. FAQ / Common Gotchas
  10. Reporting Bugs and Missing Features
  11. Further Documentation

Scripts executed separately

  • ghidra_rpc/__init__.py
  • ghidra_rpc/cli.py
  • ghidra_rpc/client.py
  • ghidra_rpc/daemon.py
  • ghidra_rpc/server/__init__.py
  • ghidra_rpc/server/_gui_launcher.py
  • ghidra_rpc/server/context.py
  • ghidra_rpc/server/launcher.py
  • ghidra_rpc/server/main.py
  • ghidra_rpc/server/tools/__init__.py
  • ghidra_rpc/server/tools/_common.py
  • ghidra_rpc/server/tools/analysis.py
  • ghidra_rpc/server/tools/bookmarks.py
  • ghidra_rpc/server/tools/cfg.py
  • ghidra_rpc/server/tools/cpp.py
  • ghidra_rpc/server/tools/data_types.py
  • ghidra_rpc/server/tools/decompiler.py
  • ghidra_rpc/server/tools/disassembly.py
  • ghidra_rpc/server/tools/memory.py
  • ghidra_rpc/server/tools/modifications.py
  • ghidra_rpc/server/tools/navigation.py
  • ghidra_rpc/server/tools/processor_context.py
  • ghidra_rpc/server/tools/search.py
  • ghidra_rpc/server/tools/tags.py
  • ghidra_rpc/server/tools/version_tracking.py
  • ghidra_rpc/server/tools/xrefs.py
  • ghidra_rpc/session.py
  • ghidra_rpc/timeouts.py
  • ghidra_rpc/transport.py
  • package.json
  • tests/conftest.py
  • tests/fixtures/testapp
  • tests/test_address_format.py
  • tests/test_cli.py
  • tests/test_client.py
  • tests/test_gui_context.py
  • tests/test_gui_modal_dialogs.py
  • tests/test_integration.py
  • tests/test_protocol.py
  • tests/test_search_decompiled.py
  • tests/test_session_registry.py
  • tests/test_tool_helpers.py

Files

  • .github/workflows/integration.ymlasset5,661 bytes
  • .github/workflows/tests.ymlasset3,238 bytes
  • .gitignoreasset452 bytes
  • .pi/prompts/process-feedback.mddoc2,675 bytes
  • AGENTS.mddoc29,793 bytes
  • CHANGELOG.mddoc16,874 bytes
  • CLAUDE.mddoc29,793 bytes
  • README.mddoc5,348 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • SKILL.mdcore41,764 bytes
  • docs/flows/android-apk.mddoc7,610 bytes
  • docs/flows/binary-audit.mddoc1,150 bytes
  • docs/flows/patch-analysis.mddoc5,406 bytes
  • docs/flows/vulnerability-research.mddoc1,259 bytes
  • docs/install.mddoc3,118 bytes
  • docs/internals.mddoc16,775 bytes
  • docs/quickstart.mddoc3,432 bytes
  • docs/troubleshooting.mddoc8,407 bytes
  • ghidra_rpc/__init__.pyruns99 bytes
  • ghidra_rpc/cli.pyruns77,216 bytes
  • ghidra_rpc/client.pyruns5,996 bytes
  • ghidra_rpc/daemon.pyruns10,823 bytes
  • ghidra_rpc/server/__init__.pyruns33 bytes
  • ghidra_rpc/server/_gui_launcher.pyruns3,044 bytes
  • ghidra_rpc/server/context.pyruns40,157 bytes
  • ghidra_rpc/server/launcher.pyruns4,454 bytes
  • ghidra_rpc/server/main.pyruns5,764 bytes
  • ghidra_rpc/server/tools/__init__.pyruns979 bytes
  • ghidra_rpc/server/tools/_common.pyruns15,495 bytes
  • ghidra_rpc/server/tools/analysis.pyruns12,938 bytes
  • ghidra_rpc/server/tools/bookmarks.pyruns8,217 bytes
  • ghidra_rpc/server/tools/cfg.pyruns9,478 bytes
  • ghidra_rpc/server/tools/cpp.pyruns5,749 bytes
  • ghidra_rpc/server/tools/data_types.pyruns50,232 bytes
  • ghidra_rpc/server/tools/decompiler.pyruns7,617 bytes
  • ghidra_rpc/server/tools/disassembly.pyruns10,892 bytes
  • ghidra_rpc/server/tools/memory.pyruns13,316 bytes
  • ghidra_rpc/server/tools/modifications.pyruns57,261 bytes
  • ghidra_rpc/server/tools/navigation.pyruns783 bytes
  • ghidra_rpc/server/tools/processor_context.pyruns7,912 bytes
  • ghidra_rpc/server/tools/search.pyruns8,879 bytes
  • ghidra_rpc/server/tools/tags.pyruns6,743 bytes
  • ghidra_rpc/server/tools/version_tracking.pyruns30,324 bytes
  • ghidra_rpc/server/tools/xrefs.pyruns7,656 bytes
  • ghidra_rpc/session.pyruns8,190 bytes
  • ghidra_rpc/timeouts.pyruns706 bytes
  • ghidra_rpc/transport.pyruns4,721 bytes
  • package.jsonruns288 bytes
  • pyproject.tomlasset715 bytes
  • tests/conftest.pyruns2,261 bytes
  • tests/fixtures/README.mddoc2,023 bytes
  • tests/fixtures/dex/detectresolution-classes.dexasset1,901,504 bytes
  • tests/fixtures/dex/wifi-seeker-classes.dexasset1,234,040 bytes
  • tests/fixtures/testappruns16,552 bytes
  • tests/fixtures/testapp.casset3,877 bytes
  • tests/test_address_format.pyruns10,421 bytes
  • tests/test_cli.pyruns15,697 bytes
  • tests/test_client.pyruns12,222 bytes
  • tests/test_gui_context.pyruns8,625 bytes
  • tests/test_gui_modal_dialogs.pyruns7,532 bytes
  • tests/test_integration.pyruns159,067 bytes
  • tests/test_protocol.pyruns6,636 bytes
  • tests/test_search_decompiled.pyruns11,552 bytes
  • tests/test_session_registry.pyruns17,545 bytes
  • tests/test_tool_helpers.pyruns16,544 bytes

No excerpt is shown for this license. Read the source on GitHub.

View the complete source on GitHub

Skills included

  • ghidra-rpc

Repository facts

License
No license detected
Created
Jun 4, 2026
Last pushed
Nov 2, 2026
Forks
38
Open issues
0
Project activity
Active

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 6, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 17 notes
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
Show all 115 signals by file

.github/workflows/integration.yml

  • Network accessline 66
    run: |           set -euo pipefail           url=$(curl -fsSL \
  • Network accessline 67
    set -euo pipefail           url=$(curl -fsSL \             "https://api.github.com/repos/NationalSecurityAgency/ghidra/releases/tags/Ghidra_${GHIDRA_VERSION}_build" \
  • Network accessline 68
    url=$(curl -fsSL \
  • Network accessline 69
    "https://api.github.com/repos/NationalSecurityAgency/ghidra/releases/tags/Ghidra_${GHIDRA_VERSION}_build" \
  • Network accessline 70
    | python -c 'import json,sys; print(json.load(sys.stdin)["assets"][0]["browser_download_url"])')           echo "Resolved: $url"           curl -fsSL -o ghidra.zip "$url"
  • Network accessline 72
    curl -fsSL -o ghidra.zip "$url"

CHANGELOG.md

  • Network accessline 144
    the *next* successful write on the following save, even an unrelated write   from a later command (see   https://github.com/NationalSecurityAgency/ghidra/issues/9347).
  • Network accessline 145
    from a later command (see   https://github.com/NationalSecurityAgency/ghidra/issues/9347). - GUI mode: `load` hung until someone clicked Ghidra's modal "Analyze now?"
  • Network accessline 146
    https://github.com/NationalSecurityAgency/ghidra/issues/9347).

README.md

  • Network accessline 3
    An agentic skill that gives an LLM access to [Ghidra](https://ghidra-sre.org/) so
  • Network accessline 13
    Developed at **[Cellebrite Labs](https://github.com/cellebrite-labs)**.
  • Network accessline 73
    The daemon runs Ghidra in-process via [PyGhidra](https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/PyGhidra).
  • Network accessline 74
    [PyGhidra](https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/PyGhidra).

docs/install.md

  • Network accessline 5
    1. **Ghidra** (11.0+): Download from [ghidra-sre.org](https://ghidra-sre.org/), unzip somewhere.
  • Network accessline 6
    2. **Python 3.11+**: Check with `python3 --version`. 3. **uv**: Install with `curl -LsSf https://astral.sh/uv/install.sh | sh`. 4. **Java 17+**: Required by Ghidra. Check with `java --version`.
  • Dangerous shell operationline 7
    3. **uv**: Install with `curl -LsSf https://astral.sh/uv/install.sh | sh`.
  • Network accessline 7
    3. **uv**: Install with `curl -LsSf https://astral.sh/uv/install.sh | sh`.

docs/internals.md

  • Network accessline 289
    The original design was based on [pyghidra-mcp](https://github.com/clearbluejar/pyghidra-mcp).

ghidra_rpc/__init__.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/cli.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 55
    [Credential-related source omitted]
  • Access to secretsline 185
    [Credential-related source omitted]
  • Access to secretsline 186
    [Credential-related source omitted]
  • Access to secretsline 223
    [Credential-related source omitted]
  • Access to secretsline 280
    [Credential-related source omitted]
  • Access to secretsline 281
    [Credential-related source omitted]

ghidra_rpc/client.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 91
    [Credential-related source omitted]
  • Access to secretsline 100
    [Credential-related source omitted]
  • Access to secretsline 101
    [Credential-related source omitted]

ghidra_rpc/daemon.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 84
    [Credential-related source omitted]

ghidra_rpc/server/__init__.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/_gui_launcher.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/context.py

  • Executable scriptline 1
    Executable file
  • Network accessline 243
    transaction then rolls back the whole intertwined group on the next         flush (confirmed as intended Ghidra behavior, not a bug; see         https://github.com/NationalSecurityAgency/ghidra/issues/9347).
  • Network accessline 244
    flush (confirmed as intended Ghidra behavior, not a bug; see         https://github.com/NationalSecurityAgency/ghidra/issues/9347).         Becoming our own consumer and releasing the project's makes our
  • Network accessline 245
    https://github.com/NationalSecurityAgency/ghidra/issues/9347).

ghidra_rpc/server/launcher.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 17
    [Credential-related source omitted]
  • Access to secretsline 110
    [Credential-related source omitted]
  • Access to secretsline 127
    [Credential-related source omitted]
  • Access to secretsline 134
    [Credential-related source omitted]

ghidra_rpc/server/main.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 47
    [Credential-related source omitted]
  • Access to secretsline 79
    [Credential-related source omitted]
  • Access to secretsline 81
    [Credential-related source omitted]
  • Access to secretsline 158
    [Credential-related source omitted]
  • Access to secretsline 177
    [Credential-related source omitted]

ghidra_rpc/server/tools/__init__.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/_common.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/analysis.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/bookmarks.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/cfg.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/cpp.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/data_types.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/decompiler.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/disassembly.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/memory.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/modifications.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/navigation.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/processor_context.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/search.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/tags.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/version_tracking.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/server/tools/xrefs.py

  • Executable scriptline 1
    Executable file
  • Dangerous shell operationline 21
    rm = pi.program.getReferenceManager()
  • Dangerous shell operationline 149
    rm = pi.program.getReferenceManager()

ghidra_rpc/session.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 79
    [Credential-related source omitted]
  • Access to secretsline 153
    [Credential-related source omitted]
  • Access to secretsline 161
    [Credential-related source omitted]

ghidra_rpc/timeouts.py

  • Executable scriptline 1
    Executable file

ghidra_rpc/transport.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 23
    [Credential-related source omitted]
  • Network accessline 54
    if not _IS_WINDOWS:         server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
  • Network accessline 55
    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
  • Network accessline 60
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  • Network accessline 94
    if not _IS_WINDOWS:         client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
  • Network accessline 95
    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
  • Network accessline 114
    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

package.json

  • Executable scriptline 1
    Executable file

tests/conftest.py

  • Executable scriptline 1
    Executable file

tests/fixtures/README.md

  • Network accessline 26
    | File | Source | License | SHA-256 (dex) | |---|---|---|---| | `detectresolution-classes.dex` | [Septillion/Detect-Resolution-Android v1.1.2](https://github.com/Septillion/Detect-Resolution-Android/releases/tag/v1.1.2) — Java + AndroidX, u
  • Network accessline 27
    |---|---|---|---| | `detectresolution-classes.dex` | [Septillion/Detect-Resolution-Android v1.1.2](https://github.com/Septillion/Detect-Resolution-Android/releases/tag/v1.1.2) — Java + AndroidX, unminified | CC0-1.0 | `2763d45ce16ee29e5ab91
  • Network accessline 28
    | `detectresolution-classes.dex` | [Septillion/Detect-Resolution-Android v1.1.2](https://github.com/Septillion/Detect-Resolution-Android/releases/tag/v1.1.2) — Java + AndroidX, unminified | CC0-1.0 | `2763d45ce16ee29e5ab91d262d0ba4fe8492c07
  • Network accessline 29
    | `wifi-seeker-classes.dex` | [atomofiron/android-wifi-seeker v2.2.1](https://github.com/atomofiron/android-wifi-seeker/releases/tag/v2.2.1) — Kotlin, R8-minified | CC0-1.0 | `c969647681f46a263922e8f5a340883df55995a293874ee3f4a87d0623aad051
  • Network accessline 34
    curl -fsSL -o /tmp/a.apk https://github.com/Septillion/Detect-Resolution-Android/releases/download/v1.1.2/detectresolution1.1.2.apk
  • Network accessline 37
    curl -fsSL -o /tmp/b.apk https://github.com/atomofiron/android-wifi-seeker/releases/download/v2.2.1/wifi-seeker-v2.2.1.apk

tests/fixtures/testapp

  • Executable scriptline 1
    Binary executable

tests/test_address_format.py

  • Executable scriptline 1
    Executable file

tests/test_cli.py

  • Executable scriptline 1
    Executable file

tests/test_client.py

  • Executable scriptline 1
    Executable file

tests/test_gui_context.py

  • Executable scriptline 1
    Executable file

tests/test_gui_modal_dialogs.py

  • Executable scriptline 1
    Executable file

tests/test_integration.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 53
    [Credential-related source omitted]
  • Access to secretsline 277
    [Credential-related source omitted]
  • Access to secretsline 278
    [Credential-related source omitted]
  • Access to secretsline 279
    [Credential-related source omitted]
  • Network accessline 1504
    See https://github.com/NationalSecurityAgency/ghidra/issues/9347 --
  • Possible obfuscationline 2943
    assert bytes.fromhex(result["hex"]) == original[:-4] + b"\x05\x00\x00\x00"

tests/test_protocol.py

  • Executable scriptline 1
    Executable file
  • Access to secretsline 33
    [Credential-related source omitted]
  • Access to secretsline 34
    [Credential-related source omitted]
  • Access to secretsline 35
    [Credential-related source omitted]
  • Access to secretsline 136
    [Credential-related source omitted]
  • Access to secretsline 137
    [Credential-related source omitted]
  • Access to secretsline 175
    [Credential-related source omitted]
  • Access to secretsline 176
    [Credential-related source omitted]
  • Access to secretsline 177
    [Credential-related source omitted]

tests/test_search_decompiled.py

  • Executable scriptline 1
    Executable file

tests/test_session_registry.py

  • Executable scriptline 1
    Executable file

tests/test_tool_helpers.py

  • Executable scriptline 1
    Executable file
  • Possible obfuscationline 163
    out = _format_hexdump(_FakeStart(0), b"\x00\x1f\x7f\x80A~")

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Signal confidence: 109 facts

and 59 more

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeNativePath CLAUDE.md.claude/skills/<skill-name>/
CodexNativeManifest AGENTS.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.