Malware Copilot: AI-Assisted Reverse Engineering Lab

Project Brief

Building AI Tools for Malware Analysis

Existing Ghidra MCP integrations are useful but limited. This track explores how to make them more effective for real-world reverse engineering workflows — building a new MCP server or improving existing open-source MCP tools by consolidating tool interfaces, improving tool descriptions, reducing token usage, and optimizing an agent's ability to analyze binaries efficiently. The work spanned simple learning exercises, harder malware samples, and CVE analysis, measuring how different tool designs and model choices affect analysis quality, speed, cost, and reliability.

Capstone Team

Charnnel Shane Thomas — Merritt College · Completed

Project Workstreams

Agent Harnesses

Integrated a Ghidra MCP server into an AI agent harness for CVE analysis, evaluating how tool surface area and tool descriptions affect the agent's reverse-engineering accuracy.

Test-and-Measure Engineering

Benchmarked model and tool-configuration changes in small, controlled batches before rolling them out — guarding against the agent silently pulling context from the wrong directory during CVE analysis.

Deliverables

GitHub Project (ghidra-mcp) Final Presentation

Track Scope: Potential Deliverables

A working MCP server for malware analysis or reverse engineering.
Improved Ghidra MCP tooling with cleaner, better-described tools.
Integration with an agent harness such as Claude Code, Codex, OpenCode, or a custom TUI.
Benchmark results comparing different models, tool designs, and MCP configurations.
Experiments on reducing token usage and improving tool-selection accuracy.
Final documentation explaining architecture, tradeoffs, lessons learned, and future improvements.

Skills Demonstrated

Malware Analysis AI-Assisted Reverse Engineering MCP Tool Development Agent Benchmarking Technical Documentation Python

Malware Copilot: AI-Assisted Reverse Engineering Lab

Sponsored by Delphos Labs

Building AI Tools for Malware Analysis