LABSCO SUMMARY

Renaming is what turns a session into progress you keep.

Read-only decompilation gives you a transcript; because this writes names back into the Ghidra database, the understanding accumulates in the project rather than in the chat log. The two-process shape is worth planning for: Ghidra must be open with the plugin enabled, and the bridge is a separate script your client launches.

What it is

Two pieces: a Ghidra plugin that runs an HTTP server inside the tool, and a Python bridge that speaks MCP to your client. Together they expose core Ghidra functionality — decompilation, symbol listing and renaming — so an assistant can work through a binary rather than being handed pasted output.

What you get

Binaries decompiled and analysed inside Ghidra from the conversation
Methods and data renamed automatically as the analysis works out what they are
Methods, classes, imports and exports listed
A configurable server address, so the bridge can point at a Ghidra instance on another host — it defaults to localhost:8080

Requirements

Ghidra installed, plus Python 3 and the MCP SDK. Download the release, install the zip through File → Install Extensions, restart Ghidra, and enable GhidraMCPPlugin under File → Configure → Developer; the HTTP server port is set under Edit → Tool Options. The client then runs bridge_mcp_ghidra.py with --ghidra-server, over stdio for Claude Desktop or with --transport sse for clients like Cline. Apache 2.0.

Setup effort

Follow the published steps

See installation options

USE CASES

01

Getting oriented in an unfamiliar binary

List the methods, classes, imports and exports first to see what the program touches, before deciding where to decompile.

02

Understanding what a function actually does

Decompile it and have the analysis explained in the conversation, instead of reading the pseudo-C alone.

03

Keeping the names you work out

Let the analysis rename methods and data as it identifies them, so the Ghidra project gets more readable as you go rather than the knowledge living in a chat window.

04

Analysing on one machine and driving from another

Point the bridge's server argument at the Ghidra instance's address and port rather than assuming localhost.

BEFORE YOU INSTALL

What to know first

Requires

Ghidra
Python 3
The MCP Python SDK (modelcontextprotocol/python-sdk)

INSTALLATION

Connect your client

Server setup

First, download the latest release from this repository. This contains the Ghidra plugin and Python MCP client.

Run Ghidra

Select File -> Install Extensions

Click the + button

Select the GhidraMCP-1-2.zip (or your chosen version) from the downloaded release

Restart Ghidra

Make sure the GhidraMCPPlugin is enabled in File -> Configure -> Developer

MCP Clients

Claude Desktop

CLAUDE DESKTOP · JSON

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "<YOUR_PATH_TO_BRIDGE_MCP_GHIDRA>",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}

Cline

Start the bridge over SSE first, from the folder holding bridge_mcp_ghidra.py from the release:

CLINE · TERMINAL

python bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/

In Cline, select MCP Servers at the top, then Remote Servers, and add Server Name GhidraMCP with Server URL http://127.0.0.1:8081/sse

5ire

Tool Key: ghidra

Name: GhidraMCP

Command: python /ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py

GhidraMCP by LaurieWired