Dr.Binary
Binary analysis infrastructure for AI agents, hosted or air-gapped
About Dr.Binary
Dr.Binary is binary analysis infrastructure for AI agents. Agents already have sandboxes to run code and browsers to read the web; Dr.Binary gives them a hosted workspace for compiled binaries such as executables, libraries, firmware and APKs, with nothing to install. It bundles hosted Ghidra, angr and sandboxes with its own proprietary binary diffing and symbolic execution, and results persist between calls. The idea is to move the low-level work from the model to analysis engines, so a model gets further on less. In the vendor's own test on 13 Cybench tasks, one 27B open-weight model solved 6 with a plain shell and 11 with Dr.Binary.
You can drive it in the browser or connect any MCP-capable agent, such as Claude Code, Codex or Cursor. For teams whose binaries cannot leave their network there are private-cloud and on-premise deployments, and the AirGap appliance, built on NVIDIA DGX, starts from $20,000. Cloud pricing runs on credits: Free at $0 with 1,000 credits a month (100 a day), Starter at $20/month with 3,000, Pro at $199/month or $1,990/year with 30,000 and remote MCP integrations, and Max at $599/month or $5,990/year with 100,000 and bring-your-own models. Enterprise and AirGap are sales-led, and expert services are available.
Setup is a single prompt pasted into your agent. It adds the Dr.Binary MCP server over streamable HTTP, opens a browser sign-in using OAuth, so there is no API key, and installs a binary-analysis skill. A free account is enough to connect.
The server cannot see your files directly. To analyze a local binary, the agent calls prepare_upload and runs the upload command it returns. Analysis then starts with inspect_binary for an overview, and goes deeper with run_sandbox and dump_data.
If you prefer not to use an agent, the same platform works in the browser. Teams that need everything in-house can run the full platform in their own private cloud or on the AirGap box with a local model, where samples, prompts and findings never leave the building.
- •Hosted Analysis Engines - Ghidra, angr and sandboxes run on Dr.Binary's side, alongside proprietary binary diffing and symbolic execution, so there is no local toolchain to maintain.
- •MCP Access for Agents - Any agent that can add an MCP server can use the tools, and the Pro plan adds integrations with remote MCP.
- •Custom Agents - Build agents on your own methodology, available from the Free plan up, for repeatable investigations.
- •Release Diffing - Diff release binaries in CI to catch XZ Utils and 3CX-class attacks. An expert audit service reports malicious changes source scanning cannot see.
- •Bring Your Own Models - The Max plan lets you use frontier, enterprise or local models.
- •AirGap Deployment - The whole platform in a desk-side or rack box with unlimited analyses and seats, no credits and no internet required.
Dr.Binary targets three groups. AI builders and platform teams use it to give Claude Code, Codex or custom agents real binary analysis, including release diffing in CI. Reverse engineers, CTF players and bug hunters use it for CVE analysis, patch diffing and embedded targets such as STM32, ARM and bootloaders.
Security teams in SOCs, MSSPs and incident response use it for malware triage, dropped payloads and firmware assessments. Defense, government and critical-infrastructure teams are the audience for private deployments and the $20,000-and-up AirGap appliance.
Pricing
$0 - $599/mo
- Free$0/mo
- Starter$20/mo
- Pro$199/mo
- Max$599/mo
- Enterprise & governmentContact sales
- AirGap$20000 once
From the vendor pricing page, 2026-11-06
