Recurse

Agentic reverse engineering environment — a Ghidra-class desktop app in the spirit of "Cursor for reverse engineering". Built with Tauri 2 (React + TypeScript frontend) on top of a pluggable analysis backend. The default is a pure-Rust native engine — no external process, no copyleft dependency, multi-architecture via Capstone. You can also run analysis through r2 (radare2) or IDA Pro: select either engine, and the whole app — agent tools and UI — drives it instead. The agent tool and the UI are backend-agnostic — see docs/backends.md.

Repository layout

Cargo workspace at the root; the desktop app is one package in it.

tauri/                   desktop app (Tauri + React)
  src/                     React frontend
  src-tauri/               Tauri Rust backend (engine sessions, agent wiring)
  package.json             app scripts (Vite, Vitest, Tauri CLI)
crates/
  recurse-agent/              agent framework: LLM loop, tool runtime, SQLite memory
  recurse-static/          static analysis: ELF/PE/Mach-O parsing, multi-arch disassembly,
                           CFG and cross-reference recovery, the engine seam
  recurse-vtil/            VTIL-inspired de-obfuscation/de-virtualization IL, lifter, optimizer
  recurse-mcp/             standalone headless MCP server (stdio) over the engine — no Tauri, no IDA
  recurse-debug/           cross-platform debugger (ptrace/Mach/Win32, breakpoints, stepping)
  recurse-eval/            headless eval harness (YAML-configured tiers)
justfile                 single entry point for both halves

recurse-agent is only the agent; static analysis lives in recurse-static and the debugger in recurse-debug, so the agent pulls in neither systems code it does not use. No crate depends on Tauri, and each builds/tests standalone; recurse-eval drives the agent headlessly. All are workspace members, so one Cargo.lock and one target/ cover the whole repo.

Features

• Cursor-style workspace: function list, disassembly/strings/imports tabs, CFG graph, and a chat agent sidebar (toggle with the Chat button or Ctrl+L)
• Recon page: binary info, MD5/SHA1/SHA256/CRC32 hashes, entropy, linked libraries, a self-contained hardening report (RELRO / PIE / NX / canary / FORTIFY / RPATH — no external checksec), and analysis counts
• Rename functions from the list (double-click or the ✎ button); names persist in SQLite and show up in the function list, disassembly annotations, and to the agent
• Annotate from the listing's function header: click a variable's name to name it, or a undefinedN cell to give it a type. A return type you set is shown in the header's signature line. Both persist in SQLite, keyed by function, and clearing a cell reverts it to what the instructions say
• Grounded agent: every address is a clickable object (function list, graph nodes, xrefs, decompiler annotations) — not pasted text that the model can hallucinate
• Live analysis session on any binary — including extension-less files
• Persistent project memory in SQLite with FTS5/BM25 retrieval — renames, findings and notes survive /clear and reopen, and seed the next session
• Headless core (recurse-agent) with per-turn debug tracing; the same agent loop runs in the UI and in the eval harness
• LLM agent backed by an OpenAI-compatible endpoint (OpenRouter by default) with a model picker; drives the session directly (disasm, xrefs, strings, imports, decompile)
• Dark-first UI built with Tailwind CSS v4 + shadcn/ui
• lift op: raises a function into a VTIL-style de-obfuscation IL and runs whole-routine propagation/folding/dead-code-elimination/branch-resolution passes over it — useful when disassembly looks like a VM dispatcher or opaque-predicate chain (see docs/vtil-lift.md)
• Native decompiler: decompile renders C-like pseudocode (if/while structuring, total instruction coverage) from the same recurse-vtil pipeline — no external tool, no r2 required
• Standalone recurse-mcp server: the same Engine over MCP stdio for any MCP-capable agent (Claude Code, Cursor, Claude Desktop, …) — no Tauri, no IDA seat, no Python bridge (see docs/recurse-mcp.md)

Analysis backends

Analysis goes through a single Engine trait (crates/recurse-static/src/engine.rs), so the engine is a choice, not a hard dependency:

• native (default) — pure-Rust ELF/PE/Mach-O parsing and multi-architecture disassembly (object + capstone): x86/x86-64, ARM, AArch64, MIPS, PowerPC, RISC-V, SPARC, SystemZ, M68K, BPF. No child process, no external tool, no LGPL in the build. Includes a decompiler (recurse-vtil's lift → optimize → structure pipeline — see docs/vtil-lift.md) and a lift op for VTIL-style de-obfuscation.
• r2 (radare2) — supported as an opt-in alternative for installs that want its own, more complete decompiler or a raw console. Install r2 and select it as the engine; it runs as a separate process and is never linked or bundled with Recurse.
• IDA Pro (ida) — opt-in headless analysis and Hex-Rays decompilation via idat.

Pick with the settings menu, the RECURSE_BACKEND environment variable, or the stored config. The agent gets one backend-neutral analyze tool (functions, disasm, graph, lift, decompile, xrefs, strings, imports, info, plus raw for the engine console) — filtered to the ops the active engine actually supports, so raw (native has no console) is only advertised when available. The UI consumes canonical result types, not any engine's JSON. See docs/backends.md for the trait, the crate choices, and the licensing rationale. Opening a large binary is fast because analysis is lazy — discovery indexes functions cheaply and basic blocks decode only when a function is viewed; see docs/lazy-analysis.md.

Why not just MCP-to-IDA / yolo it in Claude Code?

Stapling an MCP server onto IDA/Ghidra, or pasting disassembly into a CLI agent, works for 5-function CTFs and falls apart on real binaries. Recurse is a purpose-built environment, not a chatbot wrapper:

• Binary world-model, not text scraping. Functions, xrefs, strings and the CFG are first-class state shared by the agent and the UI. No re-parsing pdF dumps into context every turn, no invented 0x401023s.
• Verification > generation. In RE there is no npm test — verification is visual. Agent renames propagate to the function list, graph and decompile instantly, so a human confirms or rejects in one click.
• Built for scale. Real malware is 10k functions. Demand-driven tools + persistent memory beat dumping full decompiles until context OOMs.
• Agentable engine. A scriptable, pipeable engine means agents can run 100 turns, fork, reset and diff — and you can actually ship it. The default native engine needs no external tool at all.
• Malware-safe by default. Local-first, BYO-key/OpenRouter routing, and a path to offline models — no forced exfil of samples to a cloud chatbot.

Prerequisites

1. Core toolchains