Ghidramcp

🚀 GhidraMCP

A Ghidra plugin implementing the Model Context Protocol (MCP) for AI-assisted binary analysis.

GhidraMCP bridges the gap between Ghidra's powerful reverse engineering capabilities and AI assistants through the Model Context Protocol (MCP). This plugin enables AI models to connect to Ghidra and assist with binary analysis tasks, making reverse engineering more efficient and accessible.

✨ Features

• AI-driven Binary Analysis: Connect AI assistants to Ghidra via the Model Context Protocol.
• Natural Language Interface: Ask questions about binary files in simple English.
• In-depth Code Insights: Retrieve detailed function information and decompiled code.
• Binary Structure Analysis: Explore imports, exports, and memory layout.
• Automated Security Analysis: Get AI-assisted insights on potential security vulnerabilities.
• Socket-based Architecture: High-performance communication between Ghidra and AI assistants.
• Cross-platform Compatibility: Runs on all platforms supported by Ghidra.

📦 Installation

Prerequisites

• Ghidra 11.2.1+
• Java 17 or later
• Python 3.8+ (for the bridging script)

Steps

1. Download the latest release ZIP file from the Releases page.
2. Open Ghidra.
3. Navigate to File > Install Extension.
4. Click the “+” button and select the downloaded ZIP file.
5. Restart Ghidra to complete the installation.
6. Enable the extension by going to File > Configure > Other and checking the box next to “MCPServerPlugin”.

💻 Usage Examples

Starting the MCP Server

When you open a Ghidra project after enabling the plugin, the server starts automatically. By default, it runs at the following location:

• Host: localhost
• Port: 8765

You can verify that the server is running by checking for the following message in the Ghidra console:

MCP server has started on port 8765

Connecting with an AI Assistant

Connecting with Claude

To connect Claude to the GhidraMCP plugin:

1. Install the MCP bridging script:

   pip install FastMCP
   

2. Add the following configuration to your Claude MCP settings:

   {
     "mcpServers": {
       "ghidra": {
         "command": "python",
         "args": ["PATH-TO-REPO/GhidraMCP/ghidra_server.py"]
       }
     }
   }
   

The bridging script creates a connection between Ghidra and Claude, enabling real-time binary analysis through natural language.

Available Tools

The plugin exposes several powerful functions through the MCP interface:

Query Examples

Here are some examples of questions you can ask through an MCP-compatible AI client:

• "What cryptographic algorithms are used in this binary file?"
• "Can you show me the decompiled code of the function at address 0x401000?"
• "What suspicious API calls does this malware make?"
• "Explain the purpose of this binary file based on its imports and exports."
• "How does the authentication mechanism in this program work?"
• "Are there any potential buffer overflow vulnerabilities in this code?"
• "What network connections does this binary file establish?"
• "Can you rename this function to a more descriptive name?"
• "Show me all potential user input sources that could be exploited."
• "Generate a call graph for the main function."

🔧 Technical Details

Security Analysis Features

GhidraMCP provides specialized tools for security-focused analysis:

API Call Sequence Analysis

Extract and classify external API calls from functions for security analysis. This helps identify potentially dangerous functions and understand their interactions.

User Input Sources

Identify the entry points where external data enters the program, which is crucial for vulnerability assessment and understanding the attack surface.

Call Graph Generation

Create structured call graphs to understand the execution flow, track data propagation, and identify potential attack paths.

Crypto Pattern Detection

Identify cryptographic implementations, including standard algorithms (AES, RSA, etc.) and custom implementations based on code patterns.

Obfuscated String Detection

Find strings that may be obfuscated through techniques such as XOR encoding or character-by-character construction.

Custom Configuration

You can modify the server port by editing the MCPServerPlugin.java file:

server.setPort(YOUR_CUSTOM_PORT);

Integration with Analysis Workflows

GhidraMCP can be integrated into your existing analysis workflows:

1. Use Ghidra's standard analysis features to identify areas of interest.
2. Leverage AI assistance through GhidraMCP for deeper understanding.
3. Combine AI insights with your manual analysis.
4. Rename functions and data based on AI insights to improve readability.

🛠️ Building from Source

To build the plugin from source:

1. Clone this repository:

   git clone https://github.com/yourusername/GhidraMCP.git
   

2. Set up the Ghidra development environment according to the instructions in the Ghidra Developer Guide.

3. Set the GHIDRA_INSTALL_DIR environment variable:

   export GHIDRA_INSTALL_DIR=/path/to/ghidra
   

4. Build using Gradle:

   ./gradlew buildExtension
   

5. The extension ZIP file will be created in the dist directory.

🐞 Troubleshooting

Common Issues

• Connection Issues: Ensure that the Ghidra instance is running and the plugin is enabled.
• Port Conflicts: If port 8765 is already in use, modify the port in the plugin configuration.
• Bridging Script Errors: Check that all required Python packages have been installed using pip install FastMCP.
• Empty Results from Analysis Functions: Some security analysis functions may return empty results if the binary file does not contain relevant patterns.

Logs

Check the following logs for troubleshooting:

• Server-side messages in the Ghidra console.
• Bridging script issues in ghidra_mcp_bridge.log.

🤝 Contribution

Contributions are welcome! Please feel free to submit issues or pull requests.

1. Fork the repository.
2. Create your feature branch: git checkout -b feature/amazing-feature.
3. Commit your changes: git commit -m 'Add some amazing feature'.
4. Push to the branch: git push origin feature/amazing-feature.
5. Open a pull request.

🙏 Acknowledgments

• National Security Agency (NSA) for developing Ghidra.
• The Model Context Protocol community.
• All contributors to this project.

GhidraMCP is not affiliated with or endorsed by the NSA or the Ghidra project.