# reverser.space

> The world's first and best in-browser AI-native collaborative reverse engineering platform. Drop a binary in, it runs through Ghidra in a sandboxed cloud container, and you share the session by link - with people or with an AI agent that joins as a full participant. Nothing to install.

reverser.space is a multiplayer layer on top of Ghidra. Every session is a normal Ghidra project under the hood: multiple editors work the same binary live with presence and peer cursors, read-only viewers watch through a share link, and sessions survive crashes by reopening from the saved project. AI agents are first-class session members: invite one in, chat with it, watch it rename functions and write notes in front of you. Every agent action is attributed to the agent and the human who invited it, the agent never holds more access than that human, and you bring your own API key and choose the model.

Current state: disassembly, decompiler, CFG graph, xrefs, strings, hex, types and call tree panels are in the browser today. Script console and niche widgets (headers, classes, vtables) are not there yet. Built and run by one person, iterating quickly.

## App

- [Open the app](https://app.reverser.space/): upload a binary and start a session
- [Tool comparison](https://reverser.space/collaborative-reverse-engineering-tools/): how collaborative RE tools compare in 2026
- [Live read-only demo session](https://app.reverser.space/v/bc1c0d369bc60cd9aab962d2ee17a99fa5208b2b6385999a): a real session, no account needed

## Community

- [Discord](https://discord.gg/u2hywnYJZk): where the roadmap gets decided
- [Book a demo](https://calendly.com/duckie-reverser/30min): 30 minutes with the builder

## Engine

- [Ghidra](https://ghidra-sre.org): the open-source reverse engineering framework everything is built on

## For AI agents

- MCP server: connect any MCP client to https://app.reverser.space/mcp/v/TOKEN (share link, read-only, no account) or /mcp/s/SESSION-ID with a bearer token (read-write, role-gated) - the same tools reverser.space's own agents use
- [Session API guide](https://app.reverser.space/agent-api): read any shared session as JSON with plain GET requests - functions, disassembly, decompiled C, strings, xrefs, notes, chat
- [OpenAPI spec](https://app.reverser.space/openapi.json): the read-only share-link API as machine-readable OpenAPI 3.1 with full response schemas, ready for GPT Actions and spec-driven tool generators
- [Account API spec](https://app.reverser.space/openapi-account.json): the signed-in read-write API - uploads, analysis, renames, comments, notes, sharing and agent runs - as OpenAPI 3.1 behind bearer auth

Quick facts: every share link app.reverser.space/v/TOKEN exposes JSON at
https://app.reverser.space/api/v/TOKEN/ (try /functions, /decompile?addr=0x...,
/notes). Address parameters are 0x-prefixed hex; response addresses are decimal
offsets. Errors are always {"error": "..."} - 404 bad token or address, 409 not
analysed yet, 503 at capacity. Start with /session (name and status, never wakes
the session) and /triage (ranked functions with reasons). Agents can also join
sessions as first-class participants with attributed actions and permission
caps; see the app.