rikugan: LLM reverse-engineering agent for IDA Pro and Binary Ninja

What it is

Rikugan is a plugin for IDA Pro and Binary Ninja that puts an LLM chat panel inside the analysis UI (Ctrl+Shift+I). It does not use an MCP server to reach the database. It has its own generator-based agent loop, context management, role prompt and in-process tool layer. The author says it was vibecoded with Claude Code, the first version took one night, and the current form took about three days.

How it works

The loop streams the model response token by token, intercepts tool calls, runs them, and repeats. It has error recovery, mid-run user questions, plan mode and message queuing.

For exploration, an orchestrator maps imports, exports, strings and key functions. It then spawns isolated subagents to analyze in parallel and synthesizes their reports.

Findings are saved to RIKUGAN.md next to the database and persist across sessions. There are 12 built-in skills, custom skills, and MCP integration that can reuse skills and servers from Claude Code and Codex.

Profiles control which data the LLM can read, which tools it can use, and custom rules that filter data.

Preconditions

• IDA Pro 9.0+ with the Hex-Rays decompiler, or Binary Ninja in UI mode.
• Python 3.10+. The author calls 3.10 the safest choice.
• At least one LLM provider.
• Windows, macOS or Linux. On Windows, install the Microsoft Visual C++ Redistributable 2015-2022 x64 first, because an outdated runtime can crash IDA at startup (Rikugan uses IDA's bundled PySide6/Shiboken).

What to do

The installer auto-detects IDA, Binary Ninja or both.

curl -fsSL https://raw.githubusercontent.com/buzzer-re/Rikugan/main/install.sh | bash

irm https://raw.githubusercontent.com/buzzer-re/Rikugan/main/install.ps1 | iex

Provider notes from the README, which are the author's own local impressions:

• Claude Opus 4.6: best overall. The author recommends a Claude Pro/Max plan with OAuth over API billing.
• Claude Sonnet 4.6: strong at lower cost. Both Anthropic models use prompt caching.
• MiniMax M2.5 / Highspeed: on par with Opus in the author's local tests, with low cost.
• Gemini 2.5 / 3 / 3.1 Pro: solid, but hallucinates more than Anthropic or MiniMax.
• Kimi 2.5: strong at coding but lacks rigor for complex RE.
• LLAMA 70B and GPT 120B OSS: not production-ready for RE.

Any OpenAI-compatible endpoint and Ollama also work.

Caveats

• /modify (natural-language patching) is experimental. The README demo asks it to make a maze game pass through walls.
• The /deobfuscation skill is experimental and Binary Ninja only. It targets control flow flattening, opaque predicates, MBA expressions and junk code. The README shows a roughly 3x speedup against an original workflow of about 4.5 minutes, with no further method given.
• With IDA Pro and Python 3.14 or later, Shiboken has a known use-after-free bug. Rikugan includes a workaround, but the author still advises 3.10.
• The agent asks permission before running scripts and says it never executes the target binary.
• The author calls the project a work in progress. The provider ranking comes from the author's own tests, with no published benchmark.
• Both installers pipe a script from the main branch into a shell.