Summary

Fourteen tools instead of a hundred.

The surface is deliberately narrow — one `functions` tool rather than a tool per operation — which keeps the tool definitions small while the paging cursors keep a large binary from arriving all at once. One thing to know while working: some script-driven operations open a Ghidra error dialog, and requests look like they are hanging until you close it.

What it is

A Ghidra extension that embeds an MCP server inside the tool itself — no bridge process in between. Start Ghidra with the extension enabled and point your client at `http://127.0.0.1:8080/mcp`.

What you get

14 MCP tools: `analyze`, `inspect` and `script_guidance` for analysis; `annotate`, `functions`, `symbols`, `data_types`, `memory` and `delete` for program changes; `debugger`; `project` and `batch_operations`; `vt_sessions` and `vt_operations` for Version Tracking
Resources for the views you keep reopening — `ghidra://programs`, and per program `info`, `functions`, `symbols`, `datatypes`, `memory`, `imports`, `exports`, `strings`, `rtti`, plus `listing/{address}` and `function/{address}/decompile`
Prompts for standard workflows: `analyze_function`, `analyze_vtable`, `compare_binaries`, `find_vulnerabilities`, `map_data_structures`, `rename_analysis`, `triage_binary`
Bounded output on every call — pass `page_size`, `max_lines` or `max_results`, then feed the returned `next_cursor` back as `cursor` to continue
debugger coverage over Trace RMI: connect, accept or launch a target, discover traces, threads, stacks and objects, read live memory, registers and watches, apply static mappings, call remote methods and run emulation
Typed memory mapping that applies a data type and returns byte-to-field rows, for a program or the active debugger trace
Image rebasing, either to an explicit address or to the ImageBase a PE binary states
Focused operations that move Ghidra's own CodeBrowser or Debugger to the function or address in question

Requirements

Ghidra 12.1, with the release zip installed through File → Install Extensions and Ghidra restarted. The server port defaults to 8080 and is configured in Browser → Edit → Tool Options → Miscellaneous → GhidraMCP HTTP Server, alongside auto-start and a request timeout that defaults to 600 seconds. Building from source needs JDK 21 or later. MIT.

Setup effort

One command — claude mcp add ghidra "http://127.0.0.1:8080/mcp" --transport http