Labsco
themixednuts logo

GhidraMCP

★ 65

from themixednuts

An embedded MCP server for Ghidra, exposing program data and reverse engineering functionalities.

🔥🔥🔥🔥✓ VerifiedFreeAdvanced setup
#automation#git#security

Install MCP Server

If your browser/GitHub blocks custom URI handlers, use the web fallback: Cursor install fallback

GhidraMCP

Connect Ghidra to MCP-compatible clients

Related project: WinDbg MCP Server

✨ Features

  • 14 MCP tools covering analysis, inspection, editing, project workflows, and Version Tracking
  • MCP resources for common program views such as program info, listing, imports/exports, strings, RTTI, and decompilation
  • Built-in MCP prompts and argument completions for common reverse engineering workflows
  • Structured responses with explicit per-call limits and opaque cursors for large datasets
  • Large outputs are bounded by tool arguments such as page_size, max_lines, or max_results; pass returned next_cursor values back as cursor to continue
  • Debugger support for Trace RMI connect/accept/launch, target lifecycle, trace/thread/stack/object discovery, live memory/register/watch operations, static mappings, remote methods, and emulation
  • Typed memory mapping applies a data type and returns bounded byte-to-field rows for program memory or the active debugger trace
  • Project workflows can rebase program image bases explicitly or from a PE binary's stated ImageBase
  • Focused CodeBrowser and Debugger operations automatically navigate the user's active Ghidra UI to the relevant function or address

Tool Commands

  • Analysis & inspection: analyze, inspect, script_guidance
  • Program changes: annotate, functions, symbols, data_types, memory, delete
  • Debugging: debugger
  • Project workflows: project, batch_operations
  • Version tracking: vt_sessions, vt_operations

Resource Templates

  • Project overview: ghidra://programs
  • Program views: ghidra://program/{name}/info, ghidra://program/{name}/functions, ghidra://program/{name}/symbols, ghidra://program/{name}/datatypes, ghidra://program/{name}/memory
  • Triage views: ghidra://program/{name}/imports, ghidra://program/{name}/exports, ghidra://program/{name}/strings, ghidra://program/{name}/rtti
  • Code views: ghidra://program/{name}/listing/{address}, ghidra://program/{name}/function/{address}/decompile

Prompts

  • analyze_function
  • analyze_vtable
  • compare_binaries
  • find_vulnerabilities
  • map_data_structures
  • rename_analysis
  • triage_binary

🛠️ Building from Source

If you are installing from a GitHub release zip, you can skip this section. The steps below are only for building from source.

  1. Clone the repository:

    git clone https://github.com/themixednuts/GhidraMCP.git

  2. Ensure you have JDK 21 or later installed.

  3. Build the project with just:

    just package

    To run the same checks used by the main build CI:

    just ci

    Or use the Gradle wrapper directly:

    bash ./gradlew package

    On Windows PowerShell, use:

    .\gradlew.bat package

    Ghidra jars are fetched automatically from the official release zip on first run.

    Useful development entrypoints:

    • just test runs the unit suite
    • just test-e2e runs the end-to-end suite
    • just update-verification-metadata refreshes Gradle dependency verification checksums after manual dependency changes
    • The manual "Dependency Maintenance" GitHub workflow validates dependency and Ghidra update candidates without opening bot PRs

  4. The installable zip file is written to target/ (for example, target/GhidraMCP-0.8.0.zip). Install it using the steps above.

Optional: Install Local Pre-commit Checks

To run formatting checks and full integration tests before every commit:

just install-hooks

The installed pre-commit hook runs:

  • just fmt-check
  • just test
  • just test-e2e

🤝 Contributing

Contributions are welcome! Please feel free to submit pull requests or open issues.