LinusandClaude Opus 5.5
9b921eeae5
install.sh builds the image (run.sh --build-only) and adds a "Claude RE Workstation" desktop entry that starts this checkout's run.sh, with Claude Desktop's icons taken from the image under their own name. --uninstall removes the launcher and icons again. run.sh gains --build-only, which needs no display, and shows errors in a zenity dialog when it has no terminal, as when started from the menu. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude_re_setup
A Docker-based reverse-engineering workstation for Linux. Claude Desktop is connected over MCP to Ghidra and to REA ("Reverse Engineer Anything"), and binwalk, unblob and esptool are installed alongside them. Nothing beyond Docker and an X server (or XWayland) is needed on the host.
Usage
./install.sh # build the image and add "Claude RE Workstation" to the app menu
./install.sh --uninstall # remove that launcher again
./run.sh # build the image if needed, pick a folder to share, start
./run.sh --build # rebuild the image first
./run.sh --workspace ~/re/target-x # share this folder without asking
docker stop claude-desktop # stop everything
The shared folder is mounted at /workspace in both containers. Sign in to
Claude Desktop on every start; the sign-in is not kept. Closing Claude
Desktop or Ghidra's project window stops everything.
The launcher runs run.sh from this checkout, so re-run ./install.sh after
moving it. Started from the menu, errors appear in a dialog.
What runs where
| Container | Contents | Network |
|---|---|---|
claude-desktop |
Claude Desktop, Ghidra GUI + GhidraMCP, binwalk, unblob, esptool | default + internal |
claude-re-mcp |
REA MCP server (headless Ghidra, binwalk, unblob), no display | internal only, no internet |
Both containers run from the same image. REA gets its own container because
some of its tools run the target. Claude Desktop reaches it at
http://rea:8765/mcp through mcp-remote.
MCP servers in Claude Desktop (claude-desktop/claude_desktop_config.json):
- ghidra: needs a program open in Ghidra's CodeBrowser.
- rea: opens files from
/workspaceby itself, with its own headless Ghidra project.
Sources
- Claude Desktop: Anthropic's apt repository (https://code.claude.com/docs/en/desktop-linux)
- Ghidra 12.1.4: https://github.com/NationalSecurityAgency/ghidra
- GhidraMCP 2.0: https://github.com/LaurieWired/GhidraMCP
- ESP32 Flash Loader: https://github.com/dynacylabs/ghidra-esp32-flash-loader
- REA 6.8.0 (Reverse Engineer Anything): https://github.com/morluto/rea, npm
rea-agents - mcp-remote 0.15.1: https://github.com/punkpeye/mcp-remote (formerly geelen/mcp-remote)
- binwalk 3.1.1: https://github.com/ReFirmLabs/binwalk
- unblob 26.6.4: https://github.com/onekey-sec/unblob
- esptool 5.6.0: https://github.com/espressif/esptool
Versions and checksums are pinned in the Dockerfile. CLAUDE.md has the
details.