Eleven Reverse Engineering Workbench
Bring ACP agents into a desktop workbench to inspect, annotate, and patch binaries.
- Source repo
- Zfinix/eleven
- Stars
- ★ 772
- Last updated
- 1d ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 58/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A reverse engineer needs to inspect a Mach-O, ELF, or PE file and choose between Ghidra and Rizin analysis.
- Not a fit if
- Users who need to run it directly on Intel Macs
- Source review
- 58/100 · Major gaps
What does this agent do, and when should you use it?
Eleven is a desktop reverse-engineering app for macOS, Windows, and Linux, with a React interface rendered natively through GPUIX. It connects to agents that speak the Agent Client Protocol (ACP), including Aster, Claude, Codex, Gemini, Cursor, Copilot, and OpenCode, and can run several agents in separate chats on one project. Native binaries are read by Ghidra through REA or by Rizin; Android apps are read by jadx. Agents can inspect code, follow references, rename functions, add notes, and propose patches for the user to review and approve in the same window. Projects can be saved as a single .eleven file, and byte patches are written to a copy so the original is not changed.
Open an app, binary, Android APK, GPU kernel, shader, or model and inspect its contents in function pseudocode, assembly, and source views. Eleven analyzes Mach-O, ELF, and PE files with Ghidra through REA or with Rizin, showing functions, control-flow graphs, cross-references, strings, segments, and hex; Android projects expose jadx Java, resources, and the manifest, with smali available when apktool is installed. ACP agents can use Eleven's MCP tools to open functions, switch views, change names and types, add notes, and propose patches; users can accept or decline suggestions and undo changes. The app also compares builds, debugs programs under LLDB, exports pseudocode or assembly, and writes patches to a new copy.
- A reverse engineer needs to inspect a Mach-O, ELF, or PE file and choose between Ghidra and Rizin analysis.
- An Android security researcher needs to inspect an APK's Java, manifest, resources, and optionally smali.
- A security analyst wants an ACP agent to trace function references and suggest renames or byte patches for review.
- An engineer needs to compare function changes between builds or set a breakpoint and inspect locals under LLDB.
- A GPU developer needs to inspect PTX in a CUDA or HIP fat binary and request rewrites in CUDA C++, HIP C++, or Metal.
- A researcher needs to relate model files or Metal shaders to the code that loads them and profile with Instruments.
How do you install or deploy this agent?
For macOS 14 or later on Apple Silicon, run the installer command. For Windows x64, run the PowerShell command. For Linux x64, download the AppImage or .tar.gz from the latest GitHub release. On first launch, Eleven guides you through choosing an engine and agent and installs missing components. macOS builds are not yet notarized; the installer clears the download quarantine.
curl -fsSL https://eleven.chizi.app/install.sh | bashirm https://eleven.chizi.app/install.ps1 | iexBuilding from source requires Bun, Node 20 or newer, Ghidra and its JDK, plus a REA 6.x checkout beside this repository or a path set with ELEVEN_REA:
git clone https://github.com/Zfinix/eleven
git clone https://github.com/Zfinix/rea
cd eleven/app
bun install
bun run devHow do you use this agent?
After installing and launching Eleven, follow the first-run flow to choose an analysis engine and ACP agent, then open a file. Select lines in pseudocode, assembly, or a source file to ask a question, request an explanation, or copy them; rename and patch suggestions appear as cards you can accept or decline. You can also use Eleven's MCP tools in an agent chat to open functions, switch views, rename, add notes, change types, or propose patches. Press ⌘S to save the project as a shareable .eleven file.
What are this agent's strengths and limitations?
- One desktop workflow supports multiple ACP agents, with Eleven's MCP tools letting them control views and analysis actions.
- Native code can be analyzed with Ghidra through REA for clearer pseudocode or with Rizin for faster opening.
- Rename, note, and patch suggestions are reviewable; changes record their author and can be undone, while patches go to a copy.
- The workbench covers Mach-O, ELF, PE, and Android APKs, as well as GPU kernels, shaders, and several machine-learning model formats.
- First-run setup involves choosing an agent and engine; the Ghidra route involves Ghidra 12.x and Java 21, while Android analysis requires jadx.
- The desktop app depends on local analysis tools; source builds also require Bun, Node 20 or newer, and REA 6.x.
- The macOS instructions cover macOS 14 or later on Apple Silicon only, so Intel Mac support is not established by this source.
- macOS builds are not yet notarized, and release builds for Linux and Windows are packaged on their respective systems.
How does this agent compare with similar options?
For native code, Eleven offers two analysis paths: Ghidra through REA for clearer pseudocode, or Rizin to open most apps in seconds. Android APKs use jadx, with apktool optionally adding smali. The README does not provide a feature comparison with other desktop reverse-engineering apps.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Eleven Reverse Engineering Workbench This agent | 58 · Major gaps | Desktop appFree | ★ 772 | 1d ago | TypeScript | Codex · Claude Code |
| REA Reverse Engineering Workbench | 52 · Major gaps | CLIFree | ★ 65 | today | HTML | Codex · Claude Code |
| REA: Reverse Engineer Anything with Agents | 72 · Some gaps | CLIFree | ★ 327k | today | TypeScript | Codex · Claude Code · Claude.ai |
| fx Coding Agent | 63 · Some gaps | CLIFree + model costs | ★ 3.5k | today | Zig | ChatGPT · Codex · OpenAI API |
How does FollowAgents rate this agent?
Why each dimension lost points
The README says agents can read code, rename items, leave notes, and propose patches while the user reviews and approves changes in the same window. The supplied test also distinguishes suggestions from edits that require confirmation, and the README says changes can be undone. These support user confirmation and recovery. Deductions: the product claims broad capabilities, including debugging and writing patched copies, but the supplied files do not clearly define the agent's access boundaries for local files, processes, or data. A permissions and privacy document is referenced but not supplied, leaving data-flow and sensitive-data handling only thinly evidenced. Dependencies are named without security review evidence. Source attribution is partly traceable through named tools such as Ghidra, REA, Rizin, and jadx; the README says one person builds the product, while publisher identity remains unknown.
The README's platform, installation, and dependency descriptions are broadly consistent. The CI configuration shows typechecking on Linux and macOS, and supplied tests cover agent tools and Android resources. Deductions: the test and CI files show configured checks, not that they were run or passed during this review. The supplied material provides only limited evidence about failure messages and recovery behavior.
The README targets reverse-engineering workflows using ACP agents and names scenarios covering native binaries, Android, GPU, shaders, models, and debugging. It also states operating-system and architecture requirements and identifies some tools as optional. Deductions: the agent's capability boundaries and scenario-specific limits are not fully described; the referenced MCP permissions document was not supplied.
The README is organized into features, installation, build instructions, environment variables, documentation, and license sections. Installation notes give platform requirements and list several external dependencies, and the Apache-2.0 license file is complete. The README also discloses that macOS builds are not yet notarized and that Linux releases and the debugger are funding priorities. Deductions: examples and FAQ coverage are limited; no changelog is included in the supplied files, and maintenance responsibility is described only as a one-person effort without a clearer support or update commitment.
The product combines reverse-engineering views, agent interaction, proposed patches, and human review in one desktop workflow. The README also describes export, diffing, debugging, and project-saving workflows. Deductions: these benefits are primarily product claims in the README; the supplied static material cannot establish output quality or actual time savings, so scores remain moderate.
Several README claims can be compared with the supplied CI and tests, including agent-tool permissions, suggestion and confirmation behavior, and Android resource handling; the license claim is supported by the LICENSE file. Deductions: many broad feature claims are not mapped to implementation or independent evidence in the supplied files. There is a gap between the breadth of the product description and the code and tests shown, and some claims are not clearly distinguished from verified results.
- This assessment uses only the supplied README, LICENSE, CI configuration, and selected test files; no program or test results were independently run or verified.
- The installation instructions download and execute scripts. The README says the macOS installer clears download quarantine and that builds are not yet notarized.
- Before use, consult the referenced MCP permissions and privacy documentation, which was not supplied, and confirm what files and processes agents, decompilers, and debugging tools can access.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Full Changelog: https://github.com/Zfinix/eleven/compare/v0.1.8...v0.1.9View on GitHub ↗ -
Release notes excerpt
Full Changelog: https://github.com/Zfinix/eleven/compare/v0.1.7...v0.1.8View on GitHub ↗ -
Release notes excerpt
Full Changelog: https://github.com/Zfinix/eleven/compare/v0.1.6...v0.1.7View on GitHub ↗