Rikugan is a reverse-engineering agent that runs inside IDA Pro and Binary Ninja, adding an LLM-driven chat panel to the analysis UI. It is not an MCP client: it carries its own agentic loop, context management, role prompt, and in-process tool orchestration, so it reads and writes the host's database directly rather than through a server.
The loop is a generator-based turn cycle: each user message starts a stream, execute, repeat pipeline in which the model response is streamed token by token and tool calls are intercepted and dispatched, with automatic error recovery, mid-run user questions, plan mode, and message queuing.
More than 60 native tools cover navigation, the decompiler, disassembly, cross-references, strings, annotations, type engineering, microcode and IL read and write, and scripting. For a larger binary, an orchestrator first maps imports, exports, strings, and key functions, then spawns isolated subagents that analyse in parallel and report back for synthesis. The agent asks permission before running scripts, shows a syntax-highlighted preview for execute_python, and never executes the target binary.
Twelve built-in skills cover Windows PE malware triage with IOCs and ATT&CK mapping, Linux ELF analysis, deobfuscation, vulnerability audit, driver analysis, CTF solving, IDAPython and Binary Ninja scripting, and binary patching; custom skills can be added, and skills and MCP servers from Claude Code and Codex can be reused. The experimental /modify skill takes a plain-English description of a change and applies it through explicit explore, plan, patch, and save stages. Findings are written to a RIKUGAN.md file beside the database so they persist across sessions.
Profiles control what the model can see and do: tools can be denied, indicators such as IP addresses, hashes, domains, URLs, and wallet addresses redacted, binary metadata hidden, and custom filter rules added. Documented provider notes:
| Provider | Note |
|---|---|
| Claude Opus 4.6 / Sonnet 4.6 | Prompt caching for both; a Pro or Max plan with OAuth suggested over the API |
| MiniMax M2.5 / Highspeed | Comparable to Opus in local tests, with higher limits and lower cost |
| Gemini 2.5 / 3 / 3.1 Pro | Hallucinates more than the Anthropic and MiniMax models in those tests |
| Kimi 2.5 | Capable at coding, less rigorous on complex reverse-engineering tasks |
| LLAMA 70B / GPT 120B OSS | Not production-ready for reverse engineering in those tests |
Features
- In-process agent: its own agentic loop and tool orchestration inside IDA Pro or Binary Ninja, not an MCP client talking to the host
- 60+ native tools: navigation, decompiler, disassembly, cross-references, strings, annotations, types, scripting, and host-specific IL or microcode read and write
- Subagent exploration: an orchestrator maps the binary and delegates isolated investigations returning one consolidated report
- Twelve built-in skills: malware triage, ELF analysis, deobfuscation, vulnerability audit, driver analysis, CTF solving, and patching, plus custom skills
- Natural-language patching: /modify describes a change in plain English and applies it through explore, plan, patch, and save stages
- Deobfuscation: plan-mode removal of control-flow flattening, opaque predicates, and junk code on Binary Ninja
- Persistent memory: findings stored in RIKUGAN.md next to the database, carried across sessions
- Profiles: tool denial, IOC redaction, metadata hiding, and custom rules that bound what leaves the machine
- Operator gates: approval prompts with previews, reversible mutations, no execution of the binary
- Provider range: Anthropic, OpenAI, Google Gemini, MiniMax, Ollama for local inference, and any OpenAI-compatible endpoint
- Reuse of agent config: skills and MCP servers from Claude Code and Codex work unchanged
- Requirements: IDA Pro 9.0+ with Hex-Rays or Binary Ninja in UI mode, Python 3.10+, on Windows, macOS, or Linux
