An MCP server that exposes PE triage, Ghidra-backed decompilation, DLL/COM profiling, runtime evidence, and LLM-assisted analysis as reusable tools for any tool-calling LLM. 一个 MCP 服务器，将 PE 分诊、Ghidra 反编译、DLL/COM 分析、运行时证据采集 和 LLM 辅助审查作为可复用工具，提供给任何支持工具调用的大语言模型。
Every tool is designed to be composable, observable, and reusable by any MCP-compatible AI agent. 每一个工具都被设计为可组合、可观测、可复用的，适配任何 MCP 兼容的 AI 智能体。
EXE, DLL, COM libraries, Rust binaries, .NET assemblies, APK/DEX — all with dedicated profiling paths and automatic format detection. EXE、DLL、COM 库、Rust 二进制、.NET 程序集、APK/DEX — 全部支持专用分析路径和自动格式检测。
Function naming, explanation, and module reconstruction review exposed as structured MCP flows — not ad-hoc prompt chains. 函数命名、解释和模块重建审查作为结构化 MCP 流程暴露 — 而不是临时的提示链。
Seven analysis stages with preview-first contracts, nonblocking execution, and persisted run state. No more MCP timeouts on large samples. 七个分析阶段，预览优先，非阻塞执行，持久化运行状态。大样本不再超时。
C2 extraction, family classification, config recovery, YARA/Sigma rule generation, and IOC export — all from static and dynamic evidence. C2 提取、家族分类、配置恢复、YARA/Sigma 规则生成和 IOC 导出 — 全部基于静态和动态证据。
When Ghidra extraction fails, the server falls back to .pdata parsing, boundary recovery, symbol recovery, and imported function definitions. 当 Ghidra 提取失败时，服务器会退回到 .pdata 解析、边界恢复、符号恢复和导入函数定义。
Ghidra, Rizin, YARA-X, UPX, Wine, Frida, Qiling, angr, PANDA, RetDec, capa, DIE, FLOSS — everything bundled for instant deployment. Ghidra、Rizin、YARA-X、UPX、Wine、Frida、Qiling、angr、PANDA、RetDec、capa、DIE、FLOSS — 一键部署。
Layered design from MCP transport to native tooling, with observable intermediaries at every level. 从 MCP 传输到原生工具的分层设计，每一层都具备可观测性。
Nonblocking execution with seven stages. Preview-first, queue-friendly, no timeouts. 七阶段非阻塞执行。预览优先，队列友好，无超时。
Choose your MCP client and start analyzing binaries in minutes. 选择你的 MCP 客户端，几分钟内开始分析二进制文件。
{
"mcpServers": {
"rikune": {
"command": "npx",
"args": ["-y", "rikune"],
"env": {
"GHIDRA_INSTALL_DIR": "C:\\ghidra",
"RIKUNE_WORKSPACE": "D:\\rikune-workspace"
}
}
}
}
{
"servers": {
"rikune": {
"command": "npx",
"args": ["-y", "rikune"],
"env": {
"GHIDRA_INSTALL_DIR": "C:\\ghidra",
"RIKUNE_WORKSPACE": "D:\\rikune-workspace"
}
}
}
}
# Pull and run the full analysis image docker compose up -d # Or use the install script .\install-docker.ps1
# Install globally npm install -g rikune # Or run directly with npx npx -y rikune
Start analyzing Windows binaries with the power of AI agents and professional reverse engineering tools. 借助 AI 智能体和专业逆向工程工具的力量，开始分析 Windows 二进制文件。