# Reverser Space > Reverser Space is a supply chain security product for firmware and binaries. Teams use it to identify components, verify SBOMs, review disclosed vulnerabilities, and investigate binary behavior with AI-assisted analysis and saved evidence. The browser dashboard organizes products and firmware versions with saved component inventories, SBOM comparisons, vulnerability matches, version changes, and evidence preparation. Track evidence preparation against a review template. AI analysis provides a deeper binary investigation when needed. Symbols, types, comments, notes, findings, and activity stay with each saved investigation. Editors can work together live. Viewers can follow through a share link. Agents use the same permission-scoped analysis and debugging interfaces as people. Only upload or run binaries that you are authorized to analyze. Live debugging depends on the deployment configuration, sample format, and available isolated compute. ## Supply chain security - Firmware and binary intake: identify embedded components and record each version. - SBOM generation and verification: generate inventories and check supplier SBOMs for gaps or version mismatches. - Continuous vulnerability monitoring: monitor newly disclosed vulnerabilities affecting identified components. - Binary security assessment: investigate suspected weaknesses, injected behavior, and embedded secrets with AI-assisted analysis. - Version and supplier tracking: compare deliveries for changed components and regressions. - EU Cyber Resilience Act evidence and reporting: organize software records, SBOMs, findings, and remediation evidence for your team's technical documentation and reporting workflow. AI agents and analysts share the binary analysis workspace. Findings link to code and saved observations. Analysts can inspect results and record corrections. Technical research: across 13 Linux tasks and 130 completed runs, the same model produced comparable answers with 33% fewer reported tokens and 35% fewer analysis calls. Each setup retained its own tool-specific instructions. These are usage measurements, not measured invoice or labor savings. [Read the benchmark and methodology](https://reverser.space/blog/the-harness-matters-ai-reverse-engineering/). Analyst hours and investigation turnaround were not measured in this benchmark. ## Product access and deployment Explore Reverser Space in a 30-minute technical demo. Discuss product pricing, team access, expected usage, and deployment requirements. Product access, capacity, support, fees, and billing terms are confirmed before purchase. Enterprise deployments support teams analyzing multiple suppliers, products, or releases. Choose hosted, dedicated managed, or on-premises deployment. Discuss analyst access, capacity, model providers, budgets, support, retention, and security requirements for your product setup. ## Static analysis - Decompilation, disassembly, control-flow graphs, call graphs, call trees, cross-references, functions, variables, strings, entropy, and hex - Imports, exports, libraries, symbols, sections, defined data, file metadata, hashes, certificates, and version information - Function and variable renaming, comments, labels, bookmarks, signatures, data definitions, parsed types, enums, and variable retyping - Findings, shared notes with revision checks, attributed activity, and undo or redo - Triage that ranks useful functions and explains why they matter ## Live debugging - Run supported Linux x86-64 ELF samples under GDB in isolated compute when debugging is enabled - Start, continue, pause, restart, stop, step into, step over, step out, or run to the cursor - Inspect threads, frames, registers, stack values, mapped regions, modules, memory, breakpoints, and terminal output - Change registers, patch memory, send terminal input, and import or decompile runtime modules - Follow execution through PIE binaries, shared libraries, unpacked code, and generated code - One editor drives a run at a time. Other collaborators can watch or take over with permission. ## Root analysis environments - Editors can start a disposable cloud Linux VM and run general shell commands as root across multiple MCP or hosted-agent tool calls. - The workspace binary and selected immutable artifacts transfer directly into the guest. Commands support bounded output polling, stdin, timeouts, and process-group cancellation. - Python, native build tools, binutils, common compression tools, OpenSSL, GDB, and QEMU user-mode emulators are included in the debug image. - Selected regular guest files up to 1 MiB can be saved as immutable workspace artifacts before the VM is stopped or expires. ## Collaboration and saved sharing - Invite editors or viewers and work with live presence, peer cursors, room chat, and attributed changes - Share a read-only investigation without requiring the viewer to create an account - Public links expose explicitly selected saved evidence without granting execution or raw binary downloads - Company blog and writeup publication routes remain unavailable ## Agents, MCP, and APIs Examples use acme.reverser.space. Replace acme with your company code. Each company has its own application, API, MCP endpoint, accounts, and credentials. Platform administration uses admin.reverser.space and an explicit administrator handoff. - Use the current stateless account MCP server at https://acme.reverser.space/mcp/account for signed-in agent access - Authenticate the remote MCP server with browser OAuth. The server discovers sessions visible to the user, and each routed tool takes an explicit session_id. - Every tool checks the caller's current role on the target session. Agents cannot gain more access than the account that connected them. - Account MCP covers session discovery, resumable binary/PDB ingestion into a project, owned-artifact import, lifecycle, static analysis, edits, notes, findings, and core debugger controls. Completing ingestion creates a pending workspace and does not start analysis. - Use read_notes before write_notes and pass expected_revision. Concurrent updates return revision_conflict instead of overwriting work. - Remote MCP cannot open a path on the user's computer. A client with programmatic local-byte access can use the bounded account MCP chunk tools directly. Other AI clients can use the local revspace-mcp connector, which reads an explicitly named binary or PDB without placing bytes in model-facing arguments or results. - Use https://acme.reverser.space/mcp/v/TOKEN for a public read-only share and https://acme.reverser.space/mcp/s/SESSION-ID for an authenticated single-session flow. These established URLs use the current stateless transport. - The account and share APIs are also available as OpenAPI 3.1 documents ### Connect a client - Codex: run `codex mcp add reverser --url https://acme.reverser.space/mcp/account`, then `codex mcp login reverser` - Claude Code: add the HTTP MCP server, open `/mcp`, select `reverser`, and authenticate in the browser - Other clients: register `https://acme.reverser.space/mcp/account` as a remote HTTP MCP server and complete OAuth ## Product links - [Product example: OpenWrt](https://reverser.space/sample-assessment/): follow one saved OpenWrt version through intake, component inventory, advisory review, and a downloadable sample summary. - [Technical demo preparation](https://reverser.space/onboarding/): discuss your software analysis workflow, team needs, supported formats, and deployment requirements. - [Product pricing](https://reverser.space/pricing/): discuss team access, product usage, deployment, support, and commercial terms. - [Enterprise deployment](https://reverser.space/enterprise/): plan shared product access, deployment, operating controls, and stakeholder review - [Agent connectivity](https://reverser.space/mcp/): plan MCP access for Codex, Claude Code, Cursor, or another supported client in your analysis workspace - [Binary analysis guide](https://reverser.space/agent-environment/): inspect code, review binary assessments, and compare deployment options - [Binary analysis guide PDF](https://reverser.space/agent-environment/reverser-space-agent-environment-brief.pdf): downloadable six-page brief - [Tool comparison](https://reverser.space/collaborative-reverse-engineering-tools/): compare tools for binary analysis, human review, and reduced manual work - [Reviews and public traction](https://reverser.space/reviews/): verified endorsements, coverage, published analyses, and community research pickups - [Reviews source ledger](https://reverser.space/reviews/sources.json): machine-readable canonical sources for the reviews page - [Discord](https://discord.gg/u2hywnYJZk): community and product feedback - [Book a technical demo](https://calendly.com/duckie-reverser/30min): see the product workflow and discuss team access and deployment with the builder - [Ghidra](https://ghidra-sre.org): the reverse-engineering framework behind each workspace ## Agent connectivity quick facts MCP and API access follow workspace permissions and deployment configuration. The account connection discovers authorized sessions, each routed tool uses an explicit session ID, and every operation checks the caller's current role. Model providers, budgets, enabled tools, and credential handling are configured for your deployment.