Agents already have sandboxes to run code and browsers to read the web. Dr.Binary gives them a hosted workspace for compiled binaries, with nothing to install.
Copy this prompt into Claude Code, Codex, Cursor, or any agent that can add an MCP server. It connects, walks you through sign-in, and checks that everything works.
# Set up Dr.Binary You are an AI agent. Your user wants you to analyze compiled binaries (executables, libraries, firmware, APKs) with Dr.Binary, a hosted binary analysis service. Follow these steps in order, then tell them you are ready. ## 1. Connect the Dr.Binary MCP server Add it to your own MCP configuration, the way your tool adds MCP servers: - name: `drbinary` - transport: streamable HTTP - URL: `https://mcp.drbinary.ai/mcp` The server signs in with OAuth, so there is no API key. When you connect, a browser sign-in opens; ask the user to complete it (a free account works). If your tool needs a restart or a separate step to sign in, for example `/mcp` in Claude Code, tell the user exactly what to do. ## 2. Install the skill Install the `binary-analysis` skill from https://github.com/DeepBitsTechnology/codex-plugins/tree/main/plugins/drbinary-chat-plugin/skills/binary-analysis the way you normally load skills. Copy the whole folder. If you have no skills support, read its `SKILL.md` before each binary task instead. ## 3. Check it works Confirm these tools are available: `prepare_upload`, `inspect_binary`, `run_sandbox` and `dump_data`. Report what passed and what did not. ## How to use it - The server cannot see the user's files. To analyze a local file, call `prepare_upload`, then run the `curl` command it returns yourself, with the file's absolute path. - Start with `inspect_binary`, then go deeper with `run_sandbox` and `dump_data`. - Only upload files the user has asked you to analyze.
Shift the low-level work from the model to the engines and the model gets further on less. Two measurements, two angles.
Same model, with and without Dr.Binary
Plain shell
6/13
With Dr.Binary
11/13
Against frontier models
Dr.Binary + open-weight model
5 of 11
45%
Best published model
same 11 tasks
39%
Average of 26 models
same 11 tasks
13%
Less of the reasoning is delegated to the model, so the same problem costs less and often runs on a smaller model.
A model small enough to run on your own hardware becomes worth running, so sensitive binaries never leave your network.
Drive it yourself in the browser, or let the agents you already run drive it for you.
Platform teams · AI engineers
“Your agent can call every tool and still cannot finish an investigation.”
Reverse engineers · CTF · Bug hunters
“You know where to look. You do not want to rebuild the plumbing every time.”
SOC · MSSP · Incident response
“A suspicious sample on the desk and no reverse engineer free this week.”
The complete platform in a box, built on NVIDIA DGX, for defense, government, and critical-infrastructure teams whose binaries can never touch a third-party cloud. The same shift that makes a 27B model competitive in our benchmarks is what makes it worth running on your own hardware.
Samples, prompts, and findings stay inside your security boundary. No external model provider, no internet required.
The engines carry the low-level analysis, so a model sized to run on the box reaches conclusions it could not reach on its own.
Every analysis, sandboxes, custom agents, and MCP into your internal tools. Unlimited analyses and seats, no credits, no rate limits.
Free to start. Pay as your team grows.
Cloud plans from $0 to $599 a month, private-cloud and enterprise deployments, and AirGap from $20,000. Expert services if you would rather hand it off.
From the blog
October 21, 2026
A 27B model more than doubled its CTF solve rate when we handed it a reverse-engineering toolkit instead of a bigger brain.
July 9, 2026
We compare DeepDiff and Google BinDiff across 21 binary pairs to measure function matching under compiler changes, stripped static code, and code movement between symbols.
May 12, 2026
The most fundamental failure mode of LLM-powered binary analysis: models evaluate binaries by their most obvious features and stop there. This post walks through how Dr. Binary addresses it with an exhaustive analysis tool that processes every function before the LLM draws any conclusions.
FAQ
Straight answers for security teams and the agents they connect.
Dr.Binary is an expert-grade binary analysis platform from Deepbits Technology Inc.. Security professionals and AI agents use it to answer questions about binaries — what changed between two releases, whether attacker input can reach a function, whether a CVE is triggerable in firmware. It orchestrates 30+ analyses including disassembly, decompilation, symbolic execution, binary diffing with DeepDiff, and GPU-accelerated disassembly with DeepDi. Analysis runs in the Dr.Binary cloud, in a private cloud, or fully air-gapped on Dr.Binary AirGap. Capabilities are callable over the Model Context Protocol at https://mcp.drbinary.ai/mcp.
Free is $0/month with 1,000 credits (100/day limit) and $20 per 1,000 add-on credits. Starter is $20/month with 3,000 credits. Pro is $199/month or $1,990/year with 30,000 credits, cheaper add-on credits, and remote MCP integrations. Max is $599/month or $5,990/year with 100,000 credits, bring-your-own AI models, and an on-premise option. Dr.Binary AirGap, the on-premise NVIDIA DGX appliance, starts at $20,000.
Dr.Binary provides 30+ pre-configured tools including Ghidra, angr, YARA, and VirusTotal, plus two proprietary tools: DeepDi (a GPU-accelerated AI disassembler that is fast and obfuscation-resilient) and DeepDiff (AI-powered binary diffing for vulnerability research and patch analysis). Tools are orchestrated automatically — no manual chaining required.
Connect over the Model Context Protocol to https://mcp.drbinary.ai/mcp. Claude Code and OpenAI Codex install the Dr.Binary plugin from the DeepBitsTechnology marketplace. VS Code with GitHub Copilot uses the DrBinary MCP extension. Sign-in is OAuth; there is no local reverse-engineering stack to install. Some plugin READMEs still list https://mcp.deepbits.com/mcp, which serves the same Dr.Binary MCP server.
No. Cloud analysis runs on Dr.Binary infrastructure, but binaries never have to leave your boundary. Use a private-cloud or on-premise deployment, or Dr.Binary AirGap — the full platform on NVIDIA DGX with local LLMs and no internet required.
Dr.Binary AirGap is the complete Dr.Binary platform as an on-premise appliance built on NVIDIA DGX. Local LLMs run on DGX GPUs with no external model provider. Unlimited analyses and seats, 30+ analyses, DeepDi, DeepDiff, sandboxes, and MCP integrations stay inside your security boundary. Desk-side and rack configurations start at $20,000.