IDA-Reverse and Radare2 Skill Modules for Binary Analysis: Architecture and Workflow Differences

The ida-reverse skill module leverages IDA Pro's idalib-mcp HTTP server for RPC-based decompilation and type analysis, while the radare2 module uses direct CLI commands via r2-pipe for lightweight, scriptable static reconnaissance.

The reverse-skill repository provides specialized automation for binary analysis through two distinct skill modules that integrate into the routing framework defined in skills/MASTER-ROUTING.md. While both modules utilize the shared scripts/bootstrap-reverse.ps1 for toolchain management, they target fundamentally different analysis ecosystems—one commercial and GUI-oriented, the other open-source and command-line-first. Understanding the architectural differences between these ida-reverse and radare2 skill modules for binary analysis enables security researchers to select the appropriate tooling for decompilation-heavy tasks versus rapid static reconnaissance.

Architectural Foundations

IDA-Reverse: MCP RPC Architecture

The ida-reverse skill operates through an HTTP-based Model Context Protocol (MCP) server. According to skills/ida-reverse/SKILL.md, the module requires the idalib-mcp Python package to expose IDA Pro functionality as structured JSON-RPC endpoints.

Key characteristics include:

• Commercial dependency: Requires a licensed IDA Pro installation and the idalib-mcp package installed from GitHub
• Server lifecycle: Managed via skills/ida-reverse/scripts/start.ps1, which handles background process cleanup and port management
• Binary handling: skills/ida-reverse/scripts/open.ps1 manages file locks through temporary copies and implements timeout logic
• Function exposure: All capabilities exposed through idapro_* MCP functions such as idapro_survey_binary, idapro_decompile, and idapro_xrefs_to

Radare2: Native CLI Architecture

The radare2 skill module interfaces directly with the r2-pipe ecosystem and native radare2 binaries. As documented in skills/radare2/SKILL.md, this module emphasizes shell command automation over RPC abstraction.

Key characteristics include:

• Open-source stack: Auto-installs via scripts/bootstrap-reverse.ps1 by downloading radare2 releases from GitHub
• Direct execution: Uses rabin2 for metadata extraction and r2 for interactive analysis
• Scripting model: The skills/radare2/scripts/recon.ps1 wrapper chains commands like rabin2 -I, rabin2 -z, and rabin2 -i
• Lightweight footprint: No persistent server process; commands execute via -c flags or r2pipe

Workflow Automation Comparison

IDA-Reverse Deterministic Orchestration

The ida-reverse workflow follows a strict three-phase initialization pattern:

1. Server initialization: start.ps1 launches the idalib-mcp HTTP server and validates process isolation
2. Binary loading: open.ps1 transmits the target path to the server API, handling System32 copies and locked files
3. RPC execution: Functions like idapro_decompile(addr="sym.main") return structured JSON for downstream parsing

This architecture guarantees deterministic state management but requires maintaining the HTTP server lifecycle throughout the analysis session.

Radare2 Command Chaining

The radare2 module implements immediate execution patterns:

1. Availability check: Verifies r2 -v via the bootstrap-generated tool-index.md
2. Reconnaissance: recon.ps1 executes rabin2 -I (file info), -z (strings), -i (imports), and -E (exports) in sequence
3. Interactive or scripted: Analysts invoke r2 <file> directly or use -c "aaa; afl; pdf~main" for one-shot analysis

Unlike the ida-reverse module, radare2 requires no background service, making it suitable for CI/CD pipelines and headless environments.

Capability Matrix

Decompilation and Type Analysis

IDA-Reverse provides access to the Hex-Rays decompiler through idapro_decompile(), along with full type system manipulation via idapro_declare_type and idapro_set_type. It supports automatic struct/enum detection and rich session management through idapro_idalib_* functions.

Radare2 offers no built-in decompiler in the base installation; analysis focuses on disassembly (pdf command) and static metadata extraction.

Cross-Reference Analysis

IDA-Reverse exposes idapro_xrefs_to() and idapro_xrefs_from() for comprehensive cross-reference graphs with data-flow analysis capabilities.

Radare2 utilizes axt (cross-references to) and axf (cross-references from) commands within the r2 shell for relationship mapping.

Binary Patching and Diffing

IDA-Reverse provides limited patching support through debugger extensions (idapro_open_file with ?ext=dbg).

Radare2 enables native patching via wa (write assembly) and wx (write hex), plus binary diffing through the radiff2 utility.

Implementation Examples

IDA-Reverse PowerShell Workflow

# Initialize the MCP server (background process management)

powershell -File "skills/ida-reverse/scripts/start.ps1"

# Open target with file-lock handling and timeout

powershell -File "skills/ida-reverse/scripts/open.ps1" `
    -Path "C:\samples\malware.exe" -TimeoutSeconds 600

# Execute MCP functions returning structured JSON

idapro_survey_binary(detail_level="minimal")
idapro_decompile(addr="0x140001000")
idapro_type_query(symbol="struct_EPROCESS")

Radare2 PowerShell Workflow

# Verify installation via bootstrap index

r2 -v

# Automated reconnaissance with analysis flag

powershell -File "skills/radare2/scripts/recon.ps1" `
    -TargetPath "/mnt/samples/malware.elf" -RunAnalysis

# Manual command pipeline for metadata extraction

rabin2 -I /mnt/samples/malware.elf    # Binary metadata

rabin2 -z /mnt/samples/malware.elf    # Extract strings

rabin2 -i /mnt/samples/malware.elf    # List imports

# One-shot analysis without interactive shell

r2 -qc "aaa; afl; iz; pdf @ main" /mnt/samples/malware.elf

Summary

• ida-reverse requires a licensed IDA Pro installation and operates through a persistent HTTP MCP server, offering superior decompilation via Hex-Rays and robust type system management through JSON-RPC calls defined in skills/ida-reverse/SKILL.md.
• radare2 functions as a lightweight, open-source CLI wrapper with no server dependencies, excelling at rapid static reconnaissance using rabin2 utilities and binary patching across diverse file formats (ELF, Mach-O, PE, WASM, DEX).
• Both modules integrate into the reverse-skill routing framework via skills/MASTER-ROUTING.md and utilize scripts/bootstrap-reverse.ps1 for automated toolchain installation and tool-index.md registration.
• Choose ida-reverse for Windows malware analysis requiring pseudocode output and struct recovery; choose radare2 for Linux/macOS automation, embedded systems, and license-constrained environments.

Frequently Asked Questions

Does the ida-reverse module work without a commercial IDA Pro license?

No. The ida-reverse skill module requires a fully licensed IDA Pro installation plus the idalib-mcp Python package as specified in skills/ida-reverse/SKILL.md. The module cannot function with the free IDA version because the MCP server relies on idalib APIs that are restricted in the commercial licensing model.

Can the radare2 skill module perform decompilation like ida-reverse?

The radare2 module does not include built-in decompilation capabilities in its default configuration. While radare2 supports plugins like r2ghidra-dec, the skill module as implemented focuses on disassembly (pdf command) and static metadata extraction via rabin2. For pseudocode output equivalent to Hex-Rays, you must use the ida-reverse module.

How does the bootstrap process differ between the two modules?

Both modules use the shared scripts/bootstrap-reverse.ps1 logic, but with different installation targets. The ida-reverse bootstrap verifies the presence of idalib-mcp in the Python environment and updates tool-index.md with the IDA installation path. The radare2 bootstrap automatically downloads the latest radare2 release from GitHub, extracts the binaries, and registers the paths without requiring manual intervention or commercial licenses.

Which module is better for automated CI/CD pipelines?

The radare2 skill module is significantly better suited for CI/CD environments. It requires no persistent background server (unlike ida-reverse's HTTP MCP server managed by start.ps1), consumes fewer resources, and can execute one-shot analysis commands via r2 -c without interactive shells. The recon.ps1 script provides deterministic output suitable for automated reporting, whereas ida-reverse's server lifecycle management adds complexity to containerized deployments.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}