Repolode
Submit
LaurieWired

LaurieWired/GhidraMCP

An MCP server that exposes Ghidra's reverse engineering functions so LLM clients can decompile and analyze binaries.

View on GitHub
Stars
11,398
Forks
1,197
Open issues
93
Last commit
10 days ago

What is it?

GhidraMCP is a Model Context Protocol server paired with a Ghidra plugin. It lets MCP-compatible LLM clients call core Ghidra functions, so a model can decompile binaries, list methods, classes, imports and exports, and rename methods and data as it works through a reverse engineering task.

The project has two parts: a Java extension installed into Ghidra that runs an HTTP server inside the Ghidra instance, and a Python MCP server that translates client requests into calls to that HTTP server. Clients such as VS Code and Claude Code can launch the server over stdio or connect to it over streamable HTTP.

A headless mode uses PyGhidra to import and analyze a binary without the Ghidra GUI, with an optional persistent project directory. Installation requires Ghidra 12.1.4 and uv or Python 3.10+.

Key features

  • 01Decompiles and analyzes binaries inside Ghidra.
  • 02Automatically renames methods and data.
  • 03Lists methods, classes, imports, and exports.
  • 04Works with any MCP client, over stdio or streamable HTTP.
  • 05Supports headless analysis through PyGhidra without the Ghidra GUI.

Use cases

  • Letting an LLM assist with reverse engineering a binary through Ghidra's decompiler.
  • Batch or scripted analysis of binaries on a server without a GUI.
  • Speeding up triage of unfamiliar executables by having a model rename symbols and summarize functions.

Topics

#reverse-engineering#mcp#ghidra#llm#decompiler#binary-analysis#java#python

FAQ

What is GhidraMCP?
An MCP server that exposes Ghidra's reverse engineering functions so LLM clients can decompile and analyze binaries. GhidraMCP is a Model Context Protocol server paired with a Ghidra plugin. It lets MCP-compatible LLM clients call core Ghidra functions, so a model can decompile binaries, list methods, classes, imports and exports, and rename methods and data as it works through a reverse engineering task.
Is GhidraMCP free to use? What license does it have?
GhidraMCP is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is GhidraMCP still maintained?
Actively maintained. The last commit to GhidraMCP was on Oct 10, 2026.
What can I use GhidraMCP for?
Letting an LLM assist with reverse engineering a binary through Ghidra's decompiler. Batch or scripted analysis of binaries on a server without a GUI. Speeding up triage of unfamiliar executables by having a model rename symbols and summarize functions.
Where can I get GhidraMCP?
The source code and installation instructions are on GitHub: https://github.com/LaurieWired/GhidraMCP

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects