Binary analysis infrastructure for AI agents

Agents already have sandboxes to run code and browsers to read the web. Dr.Binary gives them a hosted workspace for compiled binaries, with nothing to install.

Connect in one paste

Copy this prompt into Claude Code, Codex, Cursor, or any agent that can add an MCP server. It connects, walks you through sign-in, and checks that everything works.

Setup prompt
# Set up Dr.Binary

You are an AI agent. Your user wants you to analyze compiled binaries
(executables, libraries, firmware, APKs) with Dr.Binary, a hosted binary
analysis service. Follow these steps in order, then tell them you are ready.

## 1. Connect the Dr.Binary MCP server

Add it to your own MCP configuration, the way your tool adds MCP servers:

- name: `drbinary`
- transport: streamable HTTP
- URL: `https://mcp.drbinary.ai/mcp`

The server signs in with OAuth, so there is no API key. When you connect,
a browser sign-in opens; ask the user to complete it (a free account
works). If your tool needs a restart or a separate step to sign in, for
example `/mcp` in Claude Code, tell the user exactly what to do.

## 2. Install the skill

Install the `binary-analysis` skill from
https://github.com/DeepBitsTechnology/codex-plugins/tree/main/plugins/drbinary-chat-plugin/skills/binary-analysis
the way you normally load skills. Copy the whole folder. If you have no
skills support, read its `SKILL.md` before each binary task instead.

## 3. Check it works

Confirm these tools are available: `prepare_upload`, `inspect_binary`,
`run_sandbox` and `dump_data`. Report what passed and what did not.

## How to use it

- The server cannot see the user's files. To analyze a local file, call
  `prepare_upload`, then run the `curl` command it returns yourself, with
  the file's absolute path.
- Start with `inspect_binary`, then go deeper with `run_sandbox` and
  `dump_data`.
- Only upload files the user has asked you to analyze.
Or add it by hand: point any MCP client atFull setup guide

Same model. Same budget. Different results.

Shift the low-level work from the model to the engines and the model gets further on less. Two measurements, two angles.

Same model, with and without Dr.Binary

13 Cybench tasks, one 27B open-weight model

Plain shell

6/13

With Dr.Binary

11/13

Easy / Very Easy

7 tasks
Shell
6/7
Dr.Binary
7/7

Medium

2 tasks
Shell
0/2
Dr.Binary
2/2

Hard

4 tasks
Shell
0/4
Dr.Binary
2/4

Against frontier models

11 hard BinaryAudit detection tasks

Dr.Binary + open-weight model

5 of 11

45%

Best published model

same 11 tasks

39%

Average of 26 models

same 11 tasks

13%

Cheaper models, fewer tokens

Less of the reasoning is delegated to the model, so the same problem costs less and often runs on a smaller model.

Which is what makes local models viable

A model small enough to run on your own hardware becomes worth running, so sensitive binaries never leave your network.

Built for people who have to answer for a binary

Drive it yourself in the browser, or let the agents you already run drive it for you.

AI builders

Platform teams · AI engineers

“Your agent can call every tool and still cannot finish an investigation.”

  • Binary analysis in Claude Code, Codex, or VS Code over MCP
  • Custom agents on your own methodology
  • Release diffing in CI to catch XZ Utils and 3CX-class attacks

Researchers

Reverse engineers · CTF · Bug hunters

“You know where to look. You do not want to rebuild the plumbing every time.”

  • CVE analysis and patch diffing
  • Proof-of-vulnerability development
  • Embedded targets: STM32, ARM, bootloaders

Security teams

SOC · MSSP · Incident response

“A suspicious sample on the desk and no reverse engineer free this week.”

  • Malware triage with evidence you can hand to IR
  • Incident artifacts and dropped payloads
  • Firmware and IoT device assessments

Dr.Binary AirGap

The complete platform in a box, built on NVIDIA DGX, for defense, government, and critical-infrastructure teams whose binaries can never touch a third-party cloud. The same shift that makes a 27B model competitive in our benchmarks is what makes it worth running on your own hardware.

From $20,000

Desk-side and rack configurations

Nothing leaves the building.

Samples, prompts, and findings stay inside your security boundary. No external model provider, no internet required.

A local model is enough.

The engines carry the low-level analysis, so a model sized to run on the box reaches conclusions it could not reach on its own.

The whole platform, unmetered.

Every analysis, sandboxes, custom agents, and MCP into your internal tools. Unlimited analyses and seats, no credits, no rate limits.

Free to start. Pay as your team grows.

Cloud plans from $0 to $599 a month, private-cloud and enterprise deployments, and AirGap from $20,000. Expert services if you would rather hand it off.