Repolode
Submit
bethington

bethington/ghidra-mcp

MCP server letting AI assistants drive Ghidra for binary analysis, with 200+ tools for decompiling, renaming and annotating.

View on GitHub
Stars
5,821
Forks
347
Open issues
33
Last commit
5 days ago

What is it?

GhidraMCP is an MCP server that connects Ghidra's reverse engineering capabilities to AI assistants and automation tools. It exposes more than 200 tools covering decompilation, call graphs, cross-references, data types and structs, string and import analysis, and write operations such as renaming, typing and commenting. It runs either as a plugin inside the Ghidra GUI or as a headless server suitable for scripted and Docker-based analysis.

Beyond static analysis, the project offers P-code emulation of individual functions, live debugger integration built on Ghidra's TraceRmi framework, and P-code data flow tracing from a chosen variable or register. Hash-based function matching can carry documentation from one binary version to another. Tools load lazily by default so MCP clients are not flooded with the full catalog, and script execution is off unless explicitly enabled.

The project requires Ghidra 12.1.4 and Java 21, and the Python bridge can be installed from a release wheel with uv or pip.

Key features

  • 01Exposes over 200 MCP tools for decompilation, cross-references, and call graph analysis.
  • 02Supports write operations such as renaming, retyping, commenting, and struct creation.
  • 03Runs as a GUI plugin inside Ghidra or as a headless server, including Docker.
  • 04Provides P-code emulation of individual functions and P-code-based data flow tracing.
  • 05Integrates a live debugger through Ghidra's TraceRmi framework.
  • 06Transfers function documentation between binary versions using SHA-256 function hashes.

Use cases

  • Letting an AI assistant walk through a stripped binary, naming functions and documenting them.
  • Batch-annotating a large program with consistent naming conventions across sessions.
  • Carrying analyst work from one build of a binary to the next using function hash matching.
  • Running automated Ghidra analysis in CI or Docker pipelines without a GUI.

Quick start

  1. 1

    Install the prerequisites: Ghidra 12.1.4, Java 21 and uv

  2. 2

    Install the GhidraMCP extension zip in Ghidra via File > Install Extensions, then restart Ghidra

  3. 3

    Install the MCP bridge from the release wheel with uv

    uv tool install https://github.com/bethington/ghidra-mcp/releases/download/v7.0.0/ghidra_mcp_bridge-7.0.0-py3-none-any.whl
  4. 4

    Point your MCP client at the bridge using its absolute path

Things to know

  • The Ghidra extension only loads in the exact Ghidra version it was built for, 12.1.4.
  • Requires Java 21 and a running Ghidra instance with the GhidraMCP plugin enabled.
  • Main and release candidates are beta, and dev is experimental, so tool interfaces may change.
  • Live debugger features only work through the Ghidra GUI plugin.

Topics

#reverse-engineering#binary-analysis#model-context-protocol#ai-agents#decompilation#debugging#ai#ghidra#ghidra-extension#java

FAQ

What is ghidra-mcp?
MCP server letting AI assistants drive Ghidra for binary analysis, with 200+ tools for decompiling, renaming and annotating. GhidraMCP is an MCP server that connects Ghidra's reverse engineering capabilities to AI assistants and automation tools. It exposes more than 200 tools covering decompilation, call graphs, cross-references, data types and structs, string and import analysis, and write operations such as renaming, typing and commenting. It runs either as a plugin inside the Ghidra GUI or as a headless server suitable for scripted and Docker-based analysis.
Is ghidra-mcp free to use? What license does it have?
ghidra-mcp is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is ghidra-mcp still maintained?
Actively maintained. The last commit to ghidra-mcp was on Oct 16, 2026.
What can I use ghidra-mcp for?
Letting an AI assistant walk through a stripped binary, naming functions and documenting them. Batch-annotating a large program with consistent naming conventions across sessions. Carrying analyst work from one build of a binary to the next using function hash matching. Running automated Ghidra analysis in CI or Docker pipelines without a GUI.
How do I install ghidra-mcp?
Install the prerequisites: Ghidra 12.1.4, Java 21 and uv Install the GhidraMCP extension zip in Ghidra via File > Install Extensions, then restart Ghidra Install the MCP bridge from the release wheel with uv: uv tool install https://github.com/bethington/ghidra-mcp/releases/download/v7.0.0/ghidra_mcp_bridge-7.0.0-py3-none-any.whl Point your MCP client at the bridge using its absolute path
Where can I get ghidra-mcp?
The source code and installation instructions are on GitHub: https://github.com/bethington/ghidra-mcp

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects