setup_contextLABSCO SUMMARY
Analysis happens once, then everything is a read.
The design splits the expensive part from the interactive part: Ghidra runs headless a single time and dumps the analysis to JSON, after which listing functions or pulling one function's pseudocode costs nothing. That is what makes it usable in a conversation. Two setup traps are called out explicitly and both bite people — Java must be 21 exactly, not 17 or 24, and the client may need the full path to uv.
What it is
A bridge between Ghidra's headless analyzer and an MCP client. It runs Ghidra over a binary, extracts the analysis into a JSON context file, and then serves that analysis as tools so a model can read decompiled code and data structures without driving the Ghidra GUI.
What you get
- A setup call that runs Ghidra over a binary and builds the analysis context —
setup_context - Function-level access: the full function list, and decompiled pseudocode for any one of them by name —
list_functions,get_pseudocode - Data structures: every struct with the detail of any one, and every enum with its values —
list_structures,get_structure,list_enums,get_enum - Function prototypes: the full list, and the return type and arguments of one —
list_function_definitions,get_function_definition - Extraction that also carries names, parameters, variables, strings and comments out of the analysis
Requirements
Ghidra 11.3.1 or newer and Java 21 — Ghidra 11.3.1 rejects other Java versions, so JAVA_HOME must point at 21. uv, which runs the server from your clone and installs its Python dependencies — the project's pyproject.toml asks for Python 3.12 or later, although the README's own list still says 3.10+. The README's alternative is registering it with mcp install main.py through the mcp CLI. Tested on macOS. If your client cannot find uv by name, the config needs its absolute path.
Setup effort
Follow the published steps — brew install --cask temurin@21
USE CASES
01
Getting oriented in an unknown binary
Run the analysis, list every function, then read the pseudocode of the entry point to work out what the program does.
02
Understanding a data structure the code passes around
List the structs, open the one the function takes, and read its fields alongside the decompiled code.
03
Working out a function's interface
Read its prototype for the return type and arguments before tracing how callers use it.
04
Making sense of flag or state values
List the enums and read the values of the one the code compares against.
9 tools
Listed in project docs. Your client may show a different list.
list_functionsget_pseudocodelist_structuresget_structurelist_enumsget_enumlist_function_definitionsget_function_definitionBEFORE YOU INSTALL
What to know first
Tools you get
9 tools named in the project's documentation.
Requires
- Ghidra 11.3.1 or newer
- Java 21, with JAVA_HOME pointing at it
- uv (it installs the Python 3.12+ dependencies from pyproject.toml)
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
Install Java 21 (Temurin preferred) and point JAVA_HOME at it — Ghidra 11.3.1 rejects Java 17 and 24. On macOS:
TERMINAL
brew install --cask temurin@21
export JAVA_HOME=$(/usr/libexec/java_home -v 21)Download and extract Ghidra 11.3.1 or newer from https://ghidra-sre.org/ — the setup_context tool asks for the folder you extracted it to
TERMINAL
git clone https://github.com/Bamimore-Tomi/ghidra_mcp.git
cd ghidra_mcpAdd the configuration under MCP Clients, with the output of which uv as the command and the absolute path of your clone after --directory
MCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"ghidra": {
"command": "/Users/<YOUR_USERNAME>/.cargo/bin/uv",
"args": [
"--directory",
"/Users/<YOUR_USERNAME>/Documents/ghidra_mcp",
"run",
"main.py"
]
}
}
}/Users/<YOUR_USERNAME>/.cargo/bin/uv is the output of which uv (clients often cannot find uv by name), and /Users/<YOUR_USERNAME>/Documents/ghidra_mcp is the absolute path of your clone.
