# AI use cases for Recurse (Recurse-Labs/recurse) Repo: [Recurse-Labs/recurse](https://github.com/Recurse-Labs/recurse) | Use cases: 4 | Page: https://dedupedai.com/use-cases/recurse-labs-recurse/ Recurse is an open source desktop reverse engineering app, built with Tauri and Rust, with an AI agent that works on binaries through a pluggable analysis engine. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Triage an unknown binary in one desktop session: https://dedupedai.com/use-cases/recurse-labs-recurse/triage-unknown-binary/ - Let an MCP-capable agent query a binary headlessly: https://dedupedai.com/use-cases/recurse-labs-recurse/let-coding-agent-query-binary-over-mcp/ - Decompile and de-obfuscate a suspicious function: https://dedupedai.com/use-cases/recurse-labs-recurse/decompile-obfuscated-function/ - Run the agent against crackme eval tiers: https://dedupedai.com/use-cases/recurse-labs-recurse/run-agent-eval-tiers-headlessly/ ## How to triage an unknown binary in one desktop session with Recurse Repo: [Recurse-Labs/recurse](https://github.com/Recurse-Labs/recurse) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README Open a sample and read its hashes, hardening flags, libraries and function counts before deeper work. **Who it is for:** A malware analyst or security engineer who receives an unknown ELF, PE or Mach-O file and needs a fast first look. **The problem:** Getting basic facts about a binary (hashes, protections, linked libraries, size of the function set) usually means switching between several tools. **The outcome:** A clear first-pass summary of the binary that tells you whether it is worth deeper analysis. ### Steps 1. Clone the repository and run `just dev` from the repo root to start the desktop app. 2. Open the binary in the app. It works on live analysis sessions for any binary, including files with no extension. 3. Open the Recon page and note the MD5, SHA1, SHA256 and CRC32 hashes, the entropy value and the linked libraries. 4. Read the hardening report for RELRO, PIE, NX, canary, FORTIFY and RPATH. 5. Check the analysis counts, then use the function list and the imports tab to pick functions to examine. ### Prompt to paste into your agent ```text Use the Recurse repo at to triage the binary at . Report the SHA256, the hardening flags and the linked libraries from the Recon page. Expected output: a short written summary. Verify that the SHA256 matches a local sha256sum of the file. ``` ### Caveat The Recon page is a built-in view, so you need the desktop app running, and the README does not describe a command line triage mode. Risk, reverse engineering: Only analyze samples you are authorized to examine, and handle malware inside an isolated environment. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/recurse-labs-recurse/triage-unknown-binary/ ## How to let an MCP-capable agent query a binary headlessly with Recurse Repo: [Recurse-Labs/recurse](https://github.com/Recurse-Labs/recurse) | Difficulty: Advanced | Time: 1 hour | Basis: From the README Expose the Recurse engine to an agent such as Claude Code through the standalone MCP stdio server. **Who it is for:** A reverse engineer who already works in Claude Code, Cursor or Claude Desktop and wants the agent to inspect a binary without opening the desktop app. **The problem:** Pasting disassembly into a chat agent gets messy on real binaries, and the agent may invent addresses. **The outcome:** The agent reads functions, xrefs, strings and imports from the real engine state and cites addresses that exist in the binary. ### Steps 1. Clone the repository and install Rust 1.77 or newer with rustup. 2. Build and run the MCP server from the workspace root with `cargo run -p recurse-mcp`. (inferred, check the README) 3. Register the stdio server in your MCP-capable agent, such as Claude Code, Cursor or Claude Desktop, following that agent's own MCP setup steps. 4. Ask the agent to list functions in the target and then fetch disassembly for one of them. 5. Check that every address the agent cites appears in the function list or the xrefs output. ### Prompt to paste into your agent ```text Connect to the recurse-mcp stdio server from the Recurse repo at . Using the engine tools, list the functions in , pick the three largest, and report their start addresses and any cross-references. Verify each address against the function list before reporting. ``` ### Caveat The README names Claude Code, Cursor and Claude Desktop as MCP clients, but it does not give the exact server run command, so confirm it from the crate before relying on it. Risk, reverse engineering: The MCP server gives an agent full read access to the binary, so only connect it to samples you are allowed to analyze. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/recurse-labs-recurse/let-coding-agent-query-binary-over-mcp/ ## How to decompile and de-obfuscate a suspicious function with Recurse Repo: [Recurse-Labs/recurse](https://github.com/Recurse-Labs/recurse) | Difficulty: Advanced | Time: 2 hours | Basis: From the README Use the lift and decompile operations to turn a VM dispatcher or opaque predicate chain into readable pseudocode. **Who it is for:** A malware reverser who hits a function that looks like a virtualized dispatcher or a chain of opaque predicates and cannot read the raw disassembly. **The problem:** Plain disassembly of obfuscated code is hard to follow, and manual reading takes a long time. **The outcome:** C-like pseudocode for the function, plus a de-obfuscated intermediate form that you can compare against the original listing. ### Steps 1. Start the desktop app with `just dev` and open the target binary. 2. Select the suspicious function in the function list and open its disassembly tab. 3. Ask the chat agent to run the lift op on that function to get the VTIL-style de-obfuscation IL. 4. Ask the agent to run the decompile op to render C-like pseudocode for the same function. 5. Rename variables and functions from the list or the function header, then keep the names so they persist in SQLite. ### Prompt to paste into your agent ```text In the Recurse app, open and select the function at . Run the lift and decompile operations on it, then summarize what the function does in three sentences. Verify the summary against the disassembly listing. ``` ### Caveat The native decompiler is a lift, optimize and structure pipeline, so output may differ from the r2 or IDA Pro decompilers, which the README describes as more complete. Risk, reverse engineering: Decompiling malware to understand it is dual-use, so keep the work inside an isolated analysis environment and limit it to authorized samples. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/recurse-labs-recurse/decompile-obfuscated-function/ ## How to run the agent against crackme eval tiers with Recurse Repo: [Recurse-Labs/recurse](https://github.com/Recurse-Labs/recurse) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README Fetch the eval binaries, run the harness self-tests and execute an eval tier to measure the agent. **Who it is for:** A developer working on Recurse who wants to measure how well the agent solves crackme tiers after a change. **The problem:** Judging agent changes by hand is slow, and running the agent costs API calls. **The outcome:** Per-task traces and a run log that show how the agent handled each crackme in the chosen tier. ### Steps 1. Copy crates/recurse-eval/.env.example to crates/recurse-eval/.env and add your endpoint and key. 2. Run `just eval-fetch` to download the tier's binaries. 3. Run `just eval-test` to run the harness self-tests, which make no LLM calls. 4. Run `just eval-run` to execute the tier. This is the only way to execute an eval YAML. 5. Open target/eval-traces/ and read the run.log and the per-task JSON files. ### Prompt to paste into your agent ```text In the Recurse repo at , fetch the eval binaries, run the harness self-tests, then run the eval tier. Report the number of tasks that finished and the path of the run.log. Verify that the trace folder contains one JSON file per task. ``` ### Caveat Running the eval tier calls the configured LLM endpoint and can cost money, so run the self-tests first. Risk, credentials: The eval endpoint and API key are stored in crates/recurse-eval/.env, so keep that file out of version control. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/recurse-labs-recurse/run-agent-eval-tiers-headlessly/