GhidraMCP README

The project's README from github.com/LaurieWired/GhidraMCP. As one markdown file: README.md.

License GitHub release (latest by date) GitHub stars GitHub forks GitHub contributors Follow @lauriewired

ghidra_MCP_logo

ghidraMCP

ghidraMCP is an Model Context Protocol server for allowing LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients.

https://github.com/user-attachments/assets/36080514-f227-44bd-af84-78e29ee1d7f9

Features

MCP Server + Ghidra Plugin

Installation

Prerequisites

Ghidra

First, download the latest release from this repository. This contains the Ghidra plugin and Python MCP client. Then, you can directly import the plugin into Ghidra.

  1. Run Ghidra
  2. Select File -> Install Extensions
  3. Click the + button
  4. Select the ghidra_12.1.4_PUBLIC_<date>_GhidraMCP.zip from the downloaded release
  5. Restart Ghidra
  6. Make sure the GhidraMCPPlugin is enabled in File -> Configure -> Developer
  7. Optional: Configure the port in Ghidra with Edit -> Tool Options -> GhidraMCP HTTP Server

Video Installation Guide:

https://github.com/user-attachments/assets/75f0c176-6da1-48dc-ad96-c182eb4648c3

MCP Clients

Theoretically, any MCP client should work with ghidraMCP. Most clients accept a JSON config like the following:

{
  "mcpServers": {
    "ghidra": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/LaurieWired/GhidraMCP",
        "ghidra-mcp",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}

The server IP and port are configurable and should be set to point to the target Ghidra instance. If not set, both will default to localhost:8080.

For clients that connect to a URL instead of launching a command, first run the MCP server yourself:

uvx --from git+https://github.com/LaurieWired/GhidraMCP ghidra-mcp --transport streamable-http --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/

Then add http://127.0.0.1:8081/mcp as a remote server in your client.

Example 1: VS Code

Run MCP: Add Server from the Command Palette, or add the following to .vscode/mcp.json in your workspace:

{
  "servers": {
    "ghidra": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/LaurieWired/GhidraMCP",
        "ghidra-mcp",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}

Example 2: Claude Code

Run the following command:

claude mcp add ghidra -- uvx --from git+https://github.com/LaurieWired/GhidraMCP ghidra-mcp --ghidra-server http://127.0.0.1:8080/

Headless (no Ghidra GUI)

ghidra-mcp can also import and analyze a binary itself using PyGhidra, with no Ghidra GUI running. This needs Python 3.10–3.13, the GhidraMCP extension installed in Ghidra (or --extension-jar /path/to/GhidraMCP.jar), and GHIDRA_INSTALL_DIR set to your Ghidra 12.1.4 directory:

uvx --python 3.13 --from "ghidra-mcp[headless] @ git+https://github.com/LaurieWired/GhidraMCP" ghidra-mcp --headless --binary /path/to/target

Use the same command and arguments in any of the client configs above. Add --project DIR to keep the Ghidra project (and save changes) between runs. On macOS, build Ghidra's decompiler once with support/gradle/gradlew buildNatives from the Ghidra directory.

Building from Source

  1. Set GHIDRA_INSTALL_DIR to your Ghidra 12.1.4 directory
  2. Build the extension with Gradle (Java 21) by running:

cd extension && $GHIDRA_INSTALL_DIR/support/gradle/gradlew buildExtension

The generated zip file in extension/dist/ includes the built Ghidra plugin and its resources. These files are required for Ghidra to recognize the new extension.

The Python MCP server can be run from a checkout with uv run ghidra-mcp, and tested with uv run pytest.

GhidraMCP (LaurieWired/GhidraMCP)

Searching Database…

11.4K ·GitHub
GhidraMCP
这是干什么的？GhidraMCP 是一个 Model Context Protocol（MCP）服务器，它把 Ghidra 的核心功能（反编译、重命名、列出导入/导出等）开放给任意 MCP 客户端，让大语言模型能够自主地对应用程序做逆向工程。
它是 Ghidra 插件，还是独立的服务器？两者都是：一个是运行在 Ghidra 内部并提供 HTTP 接口的 Ghidra 扩展（Java），另外还有一个独立的 Python MCP 服务器（ghidra-mcp），MCP 客户端连接的就是它。
怎么把它接到 MCP 客户端上？下载 release 的 zip 包，通过 File -> Install Extensions 把插件装进 Ghidra，重启 Ghidra 并在 File -> Configure -> Developer 里启用它，然后把你的 MCP 客户端（比如 VS Code 或 Claude Code）指向正在运行的服务器，默认地址是 localhost:8080。
试用之前需要先装什么？需要 Ghidra 12.1.4，另外还要有 uv 或 Python 3.10+（通过 pip install git+ 安装，然后以 ghidra-mcp 命令运行）。
用的时候必须开着 Ghidra 的图形界面吗？不用——用 PyGhidra 的无界面（headless）模式可以在不开 GUI 的情况下导入并分析二进制文件，但需要 Python 3.10-3.13、GhidraMCP 扩展的 jar 包，并且要设置 GHIDRAINSTALLDIR；在 macOS 上还得先编译一次 Ghidra 反编译器的本地库。
它支持哪些 MCP 客户端？理论上任何 MCP 客户端都可以；README 里给出了 VS Code（通过 .vscode/mcp.json）和 Claude Code 的配置示例。
开放出来的这些工具具体能做什么？它们可以对二进制文件进行反编译和分析、自动重命名方法和数据，还能从 Ghidra 里列出方法、类、导入和导出。
无界面模式下运行后，我的 Ghidra 项目还能保留吗？可以，在 headless 命令里加上 --project DIR，就能在多次运行之间保留项目以及已保存的改动。
What are similar projects?Seep-Reverse-Lab, reverify, Reverse-Engineer-anything, rea, ida-pro-mcp, rea, ghidra, ghidra-mcp
Which topics is it in?decompiler, malware-analysis, security-research, binary-analysis, hacking-tool, model-context-protocol, reverse-engineering, security-tools, java, mcp-server, agent, claude-code
Creator
LaurieWired
Size
0.4 MB
Stars
11.4K
Updated
CommitOct 10Release2.0Oct 10
Age
1y
Commits · 90 Days