GhidraMCP

What LaurieWired/GhidraMCP MCP server does

LaurieWired/GhidraMCP MCP server adds an MCP interface to Ghidra through two project components: a Ghidra extension and a Python bridge. The extension runs inside Ghidra, while the bridge exposes the MCP server that clients connect to. This arrangement lets an MCP-compatible assistant request reverse-engineering operations against the active Ghidra instance.

Supported work includes decompiling and analyzing binaries, renaming methods and data, and retrieving lists of methods, classes, imports, and exports. The repository describes the server as suitable for autonomous application reverse engineering, but the actual analysis remains tied to the Ghidra project and instance where the plugin is running.

How it works

Install the supplied extension into Ghidra and enable GhidraMCPPlugin. The plugin provides an HTTP endpoint, which defaults to http://127.0.0.1:8080/ and can be changed in Ghidra's tool options. The Python bridge targets that endpoint and presents the available operations through MCP.

For Claude Desktop and similar local clients, the bridge can run as a stdio process. The README also documents SSE mode: the bridge listens on a configurable host and port, and a client connects to its /sse URL. The MCP client configuration must point to the bridge script and, when needed, specify the Ghidra server address.

Setup and configuration

The prerequisites are Ghidra, Python 3, and the MCP Python SDK. Releases contain the Ghidra plugin and Python MCP client. Import the release ZIP through Ghidra's File → Install Extensions workflow, restart Ghidra, and confirm that GhidraMCPPlugin is enabled under File → Configure → Developer.

The bridge accepts options for the Ghidra server, MCP transport, MCP host, and MCP port. If the Ghidra address and port are omitted, the documented default is localhost on port 8080. An SSE configuration can use localhost port 8081 for the MCP endpoint while Ghidra continues to use port 8080.

Building from source requires copying the listed Ghidra JAR files into the repository's lib/ directory and running the documented Maven packaging command. The resulting ZIP contains the extension files required by Ghidra.

Tools and capabilities

LaurieWired/GhidraMCP MCP server exposes operations for:

• Decompiling binaries in Ghidra
• Analyzing loaded binary content
• Renaming methods
• Renaming data
• Listing methods and classes
• Listing imported and exported symbols

These capabilities are useful for navigating unfamiliar binaries, reviewing symbol relationships, and applying meaningful names during an assisted reverse-engineering session.

Limitations and notes

LaurieWired/GhidraMCP MCP server is not a standalone binary-analysis engine. It requires a running Ghidra installation with the project extension installed, plus Python to run the bridge. The client must be configured with a path to the bridge script when using stdio mode, or with the correct SSE URL when using SSE mode.

The repository says that any MCP client should theoretically work, while providing concrete setup examples for Claude Desktop, Cline, and 5ire. This listing does not establish compatibility with every MCP client. No API key or hosted service is described; communication is configured around local host and port values in the documented examples.