REA vs Ghidra: Which One Should You Actually Use?

Our REA vs Ghidra MCP page compares the two MCP wiring approaches. This page answers the simpler, more common question behind searches like "rea vs ghidra" and "ghidra vs rea": if you are starting a reverse-engineering project today, which tool do you pick? The honest answer depends on four things — what you want to do, how you want to learn, whether you need an evidence trail, and how you work with AI agents. Every REA-side claim below comes from runs we executed in our own lab on 2026-10-12; Ghidra-side facts come from its public documentation, cited inline.

rea vs ghidra at a glance

One line each before the detail: Ghidra is a disassembler/decompiler suite; REA is an agent layer that drives disassembler engines — including Ghidra itself. They are not rivals on the same layer, and the "vs" mostly resolves once you see that.

Ghidra — a free, open-source reverse-engineering suite built by the NSA and released in 2019: interactive GUI, disassembler, decompiler, scripting, headless mode. [Source type: Ghidra project documentation, ghidra-sre.org]
REA — a free, open-source CLI and MCP server (the rea-agents npm package) that plans and chains analysis tool calls for you, records an evidence trail for every result, and drives Ghidra, Hopper, or IDA as its deep-analysis engines.

difference 1: what you actually get (applicability)

Pick by the job in front of you:

Interactive exploration: Ghidra. Code browsers, graph views, xref navigation, a full decompiler window — the classic RE workspace. Nothing else on the free tier matches its GUI depth. [Source type: Ghidra help documentation]
Question-driven, agent-run analysis: REA. You describe a goal ("what sections does this ELF have, where does the string table live"), REA plans the tool calls and returns structured results with evidence IDs.
Automation at scale: Ghidra's headless analyzer runs scripted analysis without the GUI — strong for batch jobs you script yourself. [Source type: Ghidra documentation, AnalyzeHeadless] REA automates the orchestration (deciding what to run next), which is a different axis.
Zero-engine day-one use: REA only. Its built-in pwntools-elf engine covers ELF layout analysis with no Ghidra install at all — we ran it on a 4.5MB system library in our lab. Ghidra is, by definition, a Ghidra install.

difference 2: learning curve

Ghidra: the industry-standard learning curve. Powerful from day one, fluent after weeks — GUI concepts (code browser, function graphs, xrefs) are the same vocabulary every RE course and book assumes. If your goal is to learn reverse engineering itself, that vocabulary is the curriculum; Ghidra teaches it. [Source type: general public commentary on Ghidra's role in RE education]

REA: the shorter path to a first result, and a different thing to learn. Install is one npm command, the free engine needs no Java runtime or engine download, and your first layout analysis runs minutes later — our setup guide does it in 30-45 minutes. What you learn instead is the agent workflow: phrasing goals, reading evidence records, auditing what the agent claims. Complementary, not competing: many people learn concepts in Ghidra's GUI and then let REA drive routine passes.

difference 3: evidence capability

This is the sharpest practical difference, and it is about trust, not power:

REA stamps every result. In our lab, each output carried a content-addressed evidence_id, the analyzed input's sha256, and the exact provider + library versions. Results too large to return are refused with resource_constraint and a pointer to the evidence bundle — never silently truncated. (Full mechanism explained in REA's evidence contract.)
Ghidra reports what its analyzers find in its own UI and exports; there is no built-in, cross-run, content-addressed audit artifact of the kind REA emits. That is not a defect — it was built as an analyst's workbench, where the analyst is the chain of custody. [Source type: absence claim — we describe only what Ghidra's public documentation does not list; no untested capability claimed for either side]

If your output needs to convince someone else — a report, a ticket, a reproducible claim — REA's trail does that out of the box. If your output is your own understanding, Ghidra's workspace is enough.

difference 4: working with AI agents

Ghidra reaches agents through community and third-party MCP bridges: your agent calls Ghidra operations over MCP while Ghidra does the analysis. You keep the full GUI and headless modes, and you assemble the loop yourself — bridge, agent, prompts. Our Ghidra MCP comparison covers that wiring in detail.

REA is the agent layer: it ships its own planning loop plus the MCP server (our lab enumerated 170 tools over a live handshake), so an agent connects once and gets the whole workflow — layout, evidence capture, and fail-closed refusals that tell the agent precisely why a step cannot run. And when REA needs deep analysis, it drives Ghidra as one of its three engines: install Ghidra, set GHIDRA_INSTALL_DIR, and the agent can reach a full decompiler through REA's evidence contract.

That last point closes the loop on "rea vs ghidra": the strongest configuration is both — Ghidra as the engine, REA as the auditable agent driving it, your GUI open for the screens that matter.

verdict: pick by your next milestone

CHOOSE REA IFYou want your first verified result today at zero cost, you work through an AI agent, or your conclusions need an evidence trail someone else can audit. Start at the setup guide.

CHOOSE GHIDRA IFYou want to learn classic reverse engineering in the industry-standard GUI, need interactive decompilation on screen, or already script headless analysis. [Source type: Ghidra project documentation]

FAQ

Is REA better than Ghidra?

Neither is "better" — they sit on different layers. Ghidra is a disassembler/decompiler suite; REA is an agent orchestration layer with its own free ELF engine that can also drive Ghidra as a deep-analysis engine. Choose Ghidra for interactive GUI learning, REA for agent-driven, evidence-backed workflows — or both together.

Can REA and Ghidra be used together?

Yes, and it is the strongest setup. REA lists Ghidra among its three deep-analysis engines: install Ghidra, point REA at it, and agent-driven analysis gains a full decompiler while every result keeps REA's evidence ID and input hash.

Which is easier for a complete beginner?

For a first result: REA — one npm install, no engine download, first analysis in minutes via its free pwntools-elf engine (our setup guide runs the full path). For learning the discipline itself: Ghidra's GUI teaches the standard RE vocabulary. A common path is REA first, Ghidra when you outgrow layout-level questions.

Is REA a Ghidra replacement?

No. REA does not decompile on its own — with no engine installed, its analyze/decompile commands refuse with a precise per-engine diagnosis (we recorded this refusal in our lab). It orchestrates engines; Ghidra is the most popular of the three it supports.

Is realearn affiliated with either project?

No. realearn is independent and non-affiliated — not endorsed by morluto (REA) or the Ghidra project. We run what we publish in our own lab and mark nothing verified that we did not execute.

Related: the beginner-view comparison (first-week pick) · MCP-wiring comparison · REA vs IDA Free · REA vs Binary Ninja MCP