AIToday
Large Language ModelsAI Coding AssistantsZenn AI/MLPublished: Oct 22, 2026, 01:00 JST

Zume Editor ships beta with MCP binary analysis for Claude

Send on LINE
Zume Editor ships beta with MCP binary analysis for Claude

3 Key Points

  1. What happened

    Zume Editor, a native C++ text/code/HEX editor, released a free beta for Windows, macOS, and Linux and packed in an MCP server that lets AI agents like Claude call its PE/ELF/Mach-O parsing, disassembly, xrefs, Ghidra-linked decompile, and YARA tools.

  2. Why it matters

    Analysts can ask an AI in plain language to inspect a binary while the work stays local and static — no execution, no upload — which may lower the barrier to entry for routine malware-triage and binary-audit work.

WHO IT HITSSecurity analysts, malware triage teams, and developers who inspect binaries could get a single native app that pairs AI-driven static analysis with HEX editing and patching, instead of stitching together separate tools.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Context & Analysis

The pitch behind Zume Editor is consolidation. Its developer describes everyday work as a sprawl of separate viewers, HEX editors, Git clients, SFTP, database clients, and diff tools that start slowly and choke on large files. Zume's answer is a native app that avoids heavy runtimes, opens instantly, and is built to handle files of several GB without loading them fully into memory — the author says 10GB-class files have been measured. The same undo operation and UI carry across code editing, HEX editing, Git, and diff/merge.

The distinctive piece is how the binary analysis is exposed. Rather than a standalone reverse-engineering suite, Zume publishes its engines as an MCP server, so an AI agent such as Claude can invoke them as tools: structure parsing for PE/ELF/Mach-O, Capstone-based disassembly across x86, x64, ARM, Thumb, and AArch64, cross-reference and function-boundary recovery, Ghidra-linked decompilation, Objective-C/Swift interface recovery, and YARA scanning. A user can ask in natural language, for example, to list a file's imported functions or show where GetProcAddress is called.

The safety framing is deliberate: analysis is static only, the target is never run, everything stays local, and access scope can be constrained. The same engines are also usable manually from the editor's Code menu, so a user can jump from a code line to the matching HEX offset and disassembly and then patch in the same app. The beta is free until March 31, 2027, after which the app stops launching; a subscription is planned for the full release, with code signing for the portable ZIP still on the to-do list.

FAQ
How much does the beta cost, and how long does it last?
The beta is free on all three platforms until March 31, 2027. After that date the app will no longer launch, and the full release is planned as a subscription.
Does using the AI features send my binaries to an external service?
No. The analysis is static only — the target is never executed — and runs locally, with sandbox controls via ZUME_MCP_ROOTS and ZUME_MCP_READONLY.
What do I need to set up to use the AI-assisted analysis?
You register zume-mcp with an AI client such as Claude Desktop or Claude Code, then ask in natural language. Decompilation requires Ghidra installed separately.
Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.

Questions and answers are published on this page.

Related Articles

Next articlePHP2Shell: Calif and Wiz used AI to find critical PHP flaw