GhidraMCP

What 13bm/GhidraMCP MCP server does

13bm/GhidraMCP MCP server brings Ghidra’s program analysis features into MCP-compatible AI clients. After a binary is open in Ghidra and the extension is enabled, an assistant can inspect the program and request structured information about functions, classes, namespaces, imports, exports, strings, data items, memory regions, variables, and executable metadata.

The server also exposes operations that change the Ghidra project. These include renaming functions, data labels, variables, and structures; adding or removing bookmarks; changing prototypes and local variable types; setting comments; applying data types; editing memory permissions; patching bytes; and managing structures, enums, namespaces, and calling conventions. These mutation tools can alter the active analysis, so they should be used with the expected Ghidra project state in mind.

How it works

The integration has two parts: a Java plugin running inside Ghidra and a Go bridge process used by the MCP client. The plugin starts a TCP listener inside Ghidra and can launch the bridge automatically. The bridge communicates with the AI client over MCP and stdio, then forwards requests to the plugin over a local TCP socket using length-prefixed JSON-RPC messages.

13bm/GhidraMCP MCP server can route requests to different Ghidra windows with the optional target_port parameter. It also supports reconnecting after a dropped connection or Ghidra restart. Large result sets can be retrieved incrementally with offset and limit, while long-running decompilation jobs can be started asynchronously and checked later using a task ID.

Setup and configuration

Download the release ZIP, install it through Ghidra’s extension installer, and restart Ghidra. Open a project and program, then enable MCPServerPlugin under Ghidra’s configuration menu. The plugin starts its TCP service on localhost:8765 by default and launches the bridge.

Claude Desktop configuration can be written from the Ghidra MCP settings menu. Other MCP clients can use the generated bridge command and pass the local host and port as arguments. Configuration is controlled through GhidraMCP.properties, including the port, localhost-only binding, API-key authentication, automatic startup, and whether the bridge is enabled. If authentication is configured, the client receives GHIDRA_API_KEY in its environment configuration.

The documented prerequisites are Ghidra 12.0.3 or newer, Java 21 or newer, and an MCP-compatible AI client. Release bridge binaries are provided for Linux x86_64, Windows x86_64, macOS x86_64, and macOS ARM64.

Tools and capabilities

13bm/GhidraMCP MCP server groups its tools across several analysis areas:

• Query program structure, functions, symbols, strings, memory maps, variables, imports, exports, and cross-references.
• Decompile functions by name or address, inspect raw disassembly, and retrieve the current cursor address or function.
• Analyze basic blocks, call graphs, API call sequences, crypto patterns, obfuscated strings, input sources, and security mitigations.
• Support malware and binary triage with byte searches, emulation, IOC extraction, PE and ELF metadata, anti-analysis checks, and dynamic API-resolution detection.
• Inspect embedded-security concerns such as format-string vulnerabilities, ROP gadgets, control-flow flattening, and code coverage regions.
• Edit analysis results, manage structures, and run asynchronous decompilation for large functions.

Limitations and notes

The material describes a local Ghidra-based setup rather than a hosted analysis service. A program must be open in Ghidra for the plugin to operate, and the MCP client must be configured to reach the bridge. The default TCP endpoint is local, but the project provides settings for binding and authentication.

Results and edits depend on the active Ghidra instance and program. Multiple instances are supported through port routing, with instance discovery scanning ports 8765 through 8774. Large or slow decompilations may need the asynchronous tools instead of a blocking request.