# fosdickio/binary_ninja_mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/fosdickio/binary_ninja_mcp  
**GitHub Stars:** 457  
**npm Downloads (last month):** 658  
**Views:** 6  
**Installs:** 1  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/fosdickio-binary-ninja-mcp

## Description
A Binary Ninja plugin, MCP server, and bridge that seamlessly integrates Binary Ninja with your favorite MCP client.  It enables you to automate the process of performing binary analysis and reverse engineering.

## Tools
Capabilities this server exposes over MCP:

- **list_methods** — List all function names in the program with pagination.
- **get_entry_points** — List entry point(s) of the loaded binary.
- **search_functions_by_name** — Search for functions whose name contains the given substring.
- **decompile_function** — Decompile a specific function by name and return the decompiled C code.
- **get_il** — Get IL for a function in the selected view (hlil, mlil, llil).
- **fetch_disassembly** — Retrieve the disassembled code of a function as assembly mnemonic instructions.
- **rename_function** — Rename a function by its current name. The configured prefix will be automatically prepended if not present.
- **rename_single_variable** — Rename a variable in a function.
- **rename_multi_variables** — Rename multiple local variables in one call.
- **rename_data** — Rename a data label at the specified address.
- **set_comment** — Set a comment at a specific address.
- **get_comment** — Get the comment at a specific address.
- **delete_comment** — Delete the comment at a specific address.
- **set_function_comment** — Set a comment for a function.
- **get_function_comment** — Get the comment for a function.
- **delete_function_comment** — Delete the comment for a function.
- **define_types** — Define types from a C code string.
- **list_local_types** — List all local types in the database (paginated).
- **search_types** — Search local types whose name or declaration contains the substring.
- **get_user_defined_type** — Retrieve definition of a user defined type (struct, enumeration, typedef, union).
- **get_type_info** — Resolve a type name and return its declaration and details (kind, members, enum values).
- **declare_c_type** — Create or update a local type from a C declaration.
- **retype_variable** — Retype a variable in a function.
- **set_local_variable_type** — Set a local variable's type.
- **list_data_items** — List defined data labels and their values with pagination.
- **hexdump_address** — Hexdump data starting at an address.
- **hexdump_data** — Hexdump a data symbol by name or address.
- **get_data_decl** — Return a declaration-like string and hexdump for a data symbol.
- **get_xrefs_to** — Get all cross references (code and data) to the given address.
- **get_xrefs_to_field** — Get all cross references to a named struct field (member).
- **get_xrefs_to_struct** — Get cross references/usages related to a struct name.
- **get_xrefs_to_type** — Get xrefs/usages related to a struct or type name.
- **get_xrefs_to_enum** — Get usages/xrefs of an enum by scanning for member values and matches.
- **get_xrefs_to_union** — Get cross references/usages related to a union type by name.
- **function_at** — Retrieve the name of the function the address belongs to.
- **get_stack_frame_vars** — Get stack frame variable information for a function (names, offsets, sizes, types).
- **list_classes** — List all namespace/class names in the program with pagination.
- **list_namespaces** — List all non-global namespaces in the program with pagination.
- **list_segments** — List all memory segments in the program with pagination.
- **list_sections** — List sections in the program with pagination.
- **list_imports** — List imported symbols in the program with pagination.
- **list_exports** — List exported functions/symbols with pagination.
- **list_strings** — List all strings in the database (paginated).
- **list_strings_filter** — List matching strings in the database (paginated, filtered).
- **list_all_strings** — List all strings in the database (aggregated across pages).
- **get_binary_status** — Get the current status of the loaded binary.
- **list_binaries** — List managed/open binaries known to the server with ids and active flag.
- **select_binary** — Select which binary to analyze by ordinal, internal view id, full path, or basename.
- **set_function_prototype** — Set a function's prototype by name or address.
- **make_function_at** — Create a function at the given address.
- **list_platforms** — List all available platform names from Binary Ninja.
- **patch_bytes** — Patch bytes at a given address in the binary.
- **format_value** — Convert and annotate a value at an address in Binary Ninja.
- **convert_number** — Convert a number or string to multiple representations (hex/dec/bin, C literals).

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "binary-ninja-mcp": {
    "command": "npx",
    "args": ["-y","binary-ninja-mcp"]
  }
}
```

## Documentation

## What fosdickio/binary_ninja_mcp MCP server does

fosdickio/binary_ninja_mcp MCP server makes a loaded Binary Ninja database available to an MCP client. It supports both read operations and analysis annotations, so an agent can inspect a program and record findings in the same workspace. The repository provides a Binary Ninja plugin, an MCP-facing server, and a bridge for connecting client processes to the server.

The available operations cover common reverse-engineering tasks. An agent can enumerate functions and entry points, search names, decompile functions, retrieve HLIL, MLIL, or LLIL, and read function disassembly. It can also inspect data labels, produce hexdumps, resolve cross-references, and query local type definitions.

Write operations include renaming functions, variables, and data labels; adding or removing comments; defining or declaring C types; and changing variable types. These operations let an agent preserve intermediate analysis results in the Binary Ninja database rather than returning observations only in chat.

## How it works

The plugin runs inside Binary Ninja and exposes Binary Ninja capabilities through HTTP endpoints. A separate bridge can connect an MCP client to that server. The client sends tool calls through MCP, while the plugin performs the requested analysis against the currently loaded binary.

The normal workflow is to open a binary in Binary Ninja, activate the plugin interface, and then use the configured MCP client. The project also supports opening multiple binaries and switching the active target automatically. Function and data operations generally accept names, addresses, or both where the corresponding capability requires them; pagination is available for function, type, and data listings.

The tools distinguish among several intermediate-language views. Decompilation returns C-like output, while disassembly returns assembly mnemonic instructions.

## Setup and configuration

Running fosdickio/binary_ninja_mcp MCP server requires Binary Ninja, Python 3.12 or newer, and an MCP client. Install the extension through Binary Ninja's Plugin Manager or copy the repository into the Binary Ninja plugins directory.

The recommended client setup uses the `binary-ninja-mcp` npm package with `npx`. A typical MCP entry starts `npx -y binary-ninja-mcp` and passes `--host localhost --port 9009`. The repository also documents a globally installed command using the same host and port arguments.

For clients that need the legacy route, configure the Python bridge directly and use the virtual environment's Python interpreter. Its configuration must point to the bridge script with an absolute path. The project includes a command-line installer that can install or remove entries for supported clients and print a generic JSON configuration snippet.

Supported automatic setup targets named by the project are Cline, Roo Code, Claude Desktop, Cursor, Windsurf, Claude Code, and LM Studio. Install the client before the Binary Ninja extension if automatic setup is required.

## Tools and capabilities

The listed MCP operations provide these groups of functionality:

- Discover functions with paginated listings, entry-point queries, and substring searches.
- Read decompiled code, IL, and assembly for named functions.
- Rename functions, local variables, and data labels.
- Add, retrieve, and delete address comments and function comments.
- Create, update, search, and inspect local C types and user-defined types.
- Retype variables and set local variable types.
- List data items, inspect symbols, and generate hexdumps or declaration-like data output.
- Find code and data references to an address or references to a named structure field.

## Limitations and notes

The material describes interaction with binaries loaded in Binary Ninja; it does not describe standalone analysis without Binary Ninja. The server's usefulness therefore depends on a running Binary Ninja installation and an accessible active target.

The repository documents both an HTTP plugin server and a bridge-based client configuration. Clients that are not covered by automatic setup may require manual MCP configuration. The legacy bridge must use the virtual environment interpreter so its dependencies are available.

The tool list supplied for this listing does not document authentication, remote deployment, supported binary formats, or persistence behavior beyond changes made through Binary Ninja. Those details should not be assumed when evaluating the server for a production workflow.

_Full upstream README: https://allmcps.com/mcp/fosdickio-binary-ninja-mcp/readme_