Rikugan v1.0.0 — First Release

A reverse-engineering agent for IDA Pro and Binary Ninja.

Rikugan is an LLM-powered agent that lives inside your disassembler. It has its own agentic loop, 60+ tools, streaming UI, and treats your binary like a codebase — reading, analyzing, renaming, and patching it through natural language.

Highlights

Agent Architecture

• Generator-based agent loop with streaming LLM responses, tool interception, and automatic error recovery
• 60+ tools across navigation, decompilation, disassembly, cross-references, strings, annotations, types, IL read/write, and scripting
• Multi-provider support — Anthropic (Claude), OpenAI, Google Gemini, MiniMax, Ollama, and any OpenAI-compatible endpoint
• Prompt caching for Anthropic models to reduce token spend
• Context window management with automatic compaction at 80% usage

Dual-Host Support

• IDA Pro 9.0+ with Hex-Rays decompiler — 56 tools including 6 microcode-specific tools
• Binary Ninja — 63 tools including 13 IL-specific tools for reading, analyzing, and transforming LLIL/MLIL/HLIL

Modes

Exploration & Subagents

• Main orchestrator maps the binary (imports, exports, strings, key functions), then spawns isolated subagents for focused analysis tasks
• Subagents run in their own context with zero knowledge of the parent session
• Findings are synthesized back into the orchestrator for deeper, faster analysis

Natural Language Binary Patching (Experimental)

• /modify make the maze game easy — the agent explores the binary, builds a patch plan, and applies it
• Runs through a full explore → plan → execute → save pipeline
• User approves/rejects each phase before the agent proceeds

Skills System

• 12 built-in skills: malware analysis, linux malware, deobfuscation, vulnerability audit, driver analysis, CTF, generic RE, IDA scripting, Binary Ninja scripting, modify, smart-patch (IDA), smart-patch (Binary Ninja)
• Custom skills — drop a SKILL.md in your host config directory
• Autocomplete with / in the chat input

Deobfuscation (Experimental, Binary Ninja)

• IL read/write primitives for control flow flattening, opaque predicates, MBA obfuscation, and dead code removal
• Plan mode ensures you review the deobfuscation strategy before patches are applied

UI

• Multi-tab chat with independent sessions per tab
• Session persistence — conversations auto-save per file and restore on reopen
• Session fork — right-click a tab to branch the conversation
• Chat export to Markdown with syntax-highlighted tool calls
• Message queuing — send follow-ups while the agent is working
• Mutation log with undo support
• Streaming Markdown rendering with collapsible thinking blocks
• Context bar showing token usage and model info

MCP Client

• Connect external MCP servers via mcp.json config
• Tools from MCP servers appear alongside built-in tools with the prefix mcp_<server>_<tool>
• Built on the official mcp Python SDK

Persistent Memory

• Agent saves important findings to RIKUGAN.md next to your binary
• Memory is loaded into the system prompt on every future session
• Cross-session context that builds over time

Security

Approval Gates

• Script approval — execute_python always shows a full code preview and requires Allow/Deny
• Plan approval — /plan and /modify disable text input; the user must click Approve or Reject buttons
• Plan rejection — rejecting a plan offers Regenerate (with optional feedback) or Cancel, instead of silently aborting
• Blocked patterns (subprocess, os.system, etc.) are rejected before reaching the approval step
• The agent never executes the target binary

Prompt Injection Mitigation

Rikugan analyzes untrusted binaries whose content flows into LLM prompts. A malicious binary could embed adversarial text to manipulate the agent. Defense-in-depth mitigations:

• Delimiter quoting — all untrusted data (tool results, binary context, MCP output, memory, skills) is wrapped in XML-like tags (<tool_result>, <binary_info>, <mcp_result>, <persistent_memory>, <skill>)
• Injection marker stripping — removes LLM role markers ([SYSTEM], <|im_start|>, <<SYS>>) and instruction override patterns from all untrusted data
• Length capping — truncates data to configurable limits per source type
• Model awareness — system prompt includes DATA_INTEGRITY_SECTION instructing the model to treat delimited content as data, not instructions
• Memory write sanitization — save_memory strips markers before writing to RIKUGAN.md

Requirements

• IDA Pro 9.0+ with Hex-Rays decompiler or Binary Ninja (UI mode)
• Python 3.9+ (Python 3.10 recommended for IDA Pro — see Shiboken UAF note)
• At least one LLM provider API key
• Windows, macOS, or Linux