# reverser.space

> The world's first and best in-browser AI-native collaborative reverse engineering platform. Drop a binary in, it runs through Ghidra in a sandboxed cloud container, and you share the session by link - with people or with an AI agent that joins as a full participant. Nothing to install.

reverser.space is a multiplayer layer on top of Ghidra. Every session is a normal Ghidra project under the hood: multiple editors work the same binary live with presence and peer cursors, read-only viewers watch through a share link, and sessions survive crashes by reopening from the saved project. AI agents are first-class session members: invite one in, chat with it, watch it rename functions and write notes in front of you. Every agent action is attributed to the agent and the human who invited it, the agent never holds more access than that human, and you bring your own API key and choose the model.

Current state: the browser includes static and dynamic listings, decompilation, CFG and call graphs, xrefs, strings, hex, types, symbols, variables, call trees, comments, findings, bookmarks, entropy, notes, room chat and live debugging. Script console and niche widgets such as headers, classes and vtables are not there yet. Built and run by one person, iterating quickly.

## Live debugging

- Run x86-64 ELF samples under GDB in an isolated detonation container. Start, continue, step into, step over, step out, run to cursor, restart or stop from the top bar.
- Starting a run automatically opens an IDA/Ghidra-style Debug Layout. It keeps Dynamic Listing and Static Listing together, Decompiler beside them, Registers in a full-height rail, and Functions, Call Stack, Stack, Breakpoints, Memory and Terminal in the lower pane. Ending the run restores the Analysis Layout.
- Dynamic Listing reads instructions from live process memory. It follows execution through PIE binaries, shared libraries, unpacked code and generated code. Runtime modules can be imported, disassembled and decompiled without confusing runtime addresses with the original file.
- Breakpoints can be added by symbol or address, from the Breakpoints panel, the Edit menu, code context menus or the F2 shortcut. Static Listing and Decompiler share synchronized breakpoint gutters. Breakpoints belong to the current run and are cleared when it ends.
- Registers are grouped into stable x86-64 banks and highlight changes between stops. Values are interpreted as strings, symbols, code, stack, heap, mapped data or printable scalars, with direct links to Memory or Dynamic Listing.
- Register edits accept decimal or hexadecimal input, sanitize it to an unsigned 64-bit value and write on Enter, Apply or focus loss. RIP changes redirect control flow. EFLAGS has named bit toggles and an IOPL editor.
- Runtime Variables shows the current frame's arguments and locals, values, storage addresses and changes. Stack shows native words around SP or BP and labels the variables stored in each range.
- Memory reads live process bytes as hex, pointers, signed or unsigned integers, floats, ASCII or UTF-16. Terminal provides the program's real stdin, stdout and stderr through a PTY, including output captured while its tab is inactive.
- A run has one driver. Other collaborators watch state changes live, and any editor can take the wheel. Only the driver can step, edit breakpoints, change registers, patch memory or send terminal input. Any editor can stop the sandbox.

## App

- [Open the app](https://app.reverser.space/): upload a binary and start a session
- [Tool comparison](https://reverser.space/collaborative-reverse-engineering-tools/): how collaborative RE tools compare in 2026
- [Live read-only demo session](https://app.reverser.space/v/bc1c0d369bc60cd9aab962d2ee17a99fa5208b2b6385999a): a real session, no account needed

## Community

- [Discord](https://discord.gg/u2hywnYJZk): where the roadmap gets decided
- [Book a demo](https://calendly.com/duckie-reverser/30min): 30 minutes with the builder

## Engine

- [Ghidra](https://ghidra-sre.org): the open-source reverse engineering framework everything is built on

## For AI agents

- Full-control MCP (the default for signed-in and headless agents): register exactly one server at https://api.reverser.space/mcp/account using OAuth or an account bearer token. Do not register one server per session. The account endpoint discovers every session visible to the user; every routed tool takes an explicit session_id, so concurrent work cannot leak into hidden selected-session state.
- Account MCP is the user control plane, not an admin API. It uses the signed-in user's current viewer/editor/creator grant independently on every target session and rechecks that grant on every call. get_session reports explicit can_read, can_edit, can_delete, can_analyze, can_open, and can_debug capabilities. The server exposes static analysis, decompilation, graphs, xrefs, symbols, types, findings, renames, comments, full live debugging, read_notes, and editor-gated write_notes. For notes, call read_notes first, preserve or merge the current text, and pass its revision as expected_revision; a concurrent save returns revision_conflict instead of overwriting human work.
- Signed-in editor agents can drive the debugger headlessly: start and stop runs, continue, step into or over, step out, set breakpoints, read or set registers, read or patch runtime memory, inspect the call stack, send terminal input, and import, disassemble or decompile runtime modules. Debug control follows the same single-driver and takeover rules as the UI.
- Remote MCP cannot read a path on the client's computer. Upload a binary through the app or Account API first, or use the local revspace-mcp stdio connector to stream the file without putting binary bytes in MCP arguments or model context.
- Special-purpose endpoints remain for links and compatibility, not normal signed-in setup: https://api.reverser.space/mcp/v/TOKEN is an unauthenticated, always-read-only view of one shared session; https://api.reverser.space/mcp/s/SESSION-ID is the older authenticated one-session form. Prefer /mcp/account whenever an account is available.
- [Session API guide](https://app.reverser.space/agent-api): read any shared session as JSON with plain GET requests - functions, disassembly, decompiled C, strings, xrefs, notes, chat
- [OpenAPI spec](https://app.reverser.space/openapi.json): the read-only share-link API as machine-readable OpenAPI 3.1 with full response schemas, ready for GPT Actions and spec-driven tool generators
- [Account API spec](https://app.reverser.space/openapi-account.json): the signed-in read-write API - uploads, analysis, renames, comments, notes, sharing and agent runs - as OpenAPI 3.1 behind bearer auth

Quick facts: every share link app.reverser.space/v/TOKEN exposes JSON at
https://api.reverser.space/api/v/TOKEN/ (try /functions, /decompile?addr=0x...,
/notes). Address parameters are 0x-prefixed hex; response addresses are decimal
offsets. Errors are always {"error": "..."} - 404 bad token or address, 409 not
analysed yet, 503 at capacity. Start with /session (name and status, never wakes
the session) and /triage (ranked functions with reasons). Agents can also join
sessions as first-class participants with attributed actions and permission
caps; see the app.