Ghidra MCP

Ghidra MCP Bridge is an MCP server project that enables AI assistants to interact with the Ghidra reverse engineering tool through a local HTTP bridge. It includes a Ghidra extension plugin and a Python MCP server, supporting operations such as querying program information, analyzing functions, renaming, patching, and adding comments.

Developer tools Security #Reverse engineering #AI assistant #Ghidra plugin #Protocol bridging .Java

rating : 2.5 points

downloads : 6.4K

update time : 2026-03-12

Open Site

What is Ghidra MCP Bridge?

Ghidra MCP Bridge is an innovative tool that builds a bridge between AI assistants and the professional reverse engineering software Ghidra. With this tool, you can directly communicate with the AI assistant in natural language, asking it to analyze binary programs, find functions, rename identifiers, and even modify program code, without manually operating the complex Ghidra interface.

How to use Ghidra MCP Bridge?

The usage process is very simple: First, install and enable the extension plugin in Ghidra. Then, run the MCP server in a Python environment. Finally, connect through an AI client that supports the MCP protocol (such as Claude Desktop or Cursor). Once the connection is successful, you can have the AI assistant complete various reverse engineering tasks just like having a conversation with it.

Applicable scenarios

This tool is particularly suitable for the following scenarios: 1. Quickly analyze unknown binary files 2. Batch rename automatically generated function names (such as FUN_xxx) 3. Find anti - debugging techniques in programs 4. Add explanatory comments to complex functions 5. Teach and learn reverse engineering techniques 6. Automate repetitive reverse analysis tasks

Main features

Program information query

Get basic information about the currently loaded program, including the program name and the base address of the memory image, to help quickly understand the analysis object.

Function management and analysis

List all functions in the program, view function prototypes, call relationships, and string references, and support batch renaming of automatically generated function names.

Intelligent renaming suggestions

Automatically identify default function names (such as FUN_, sub_, etc.) and provide intelligent renaming suggestions based on the function context to improve code readability.

Anti - debugging detection

Scan for common anti - debugging techniques in the program, including specific API calls and instruction patterns, to help identify protection mechanisms.

Binary patching

Directly modify program bytes at a specified address, support patching operations, without manually calculating offsets and editing binary files.

Comment management

Add end - of - line comments at specific addresses in the code to record analysis ideas and important findings for easy subsequent reference and collaboration.

Health status monitoring

Check the connection status of the Ghidra bridge service in real - time to ensure that the AI assistant can communicate with Ghidra normally.

Advantages

Natural language interaction: Complete complex reverse engineering operations with simple conversations

Improve efficiency: Batch processing functions significantly reduce repetitive manual work

Lower the threshold: Non - professional users can also perform basic reverse analysis through the AI assistant

Seamless integration: Perfectly integrate with the existing Ghidra workflow without changing usage habits

Flexible expansion: Based on the HTTP protocol, easy to integrate with other tools

Limitations

Dependent on Ghidra: The Ghidra software must be installed and running first

Requires network connection: Although it is local communication, it still requires HTTP protocol support

Learning curve: Basic reverse engineering concepts need to be understood for effective use

Function limitations: Currently only supports some commonly used functions and is not a substitute for all Ghidra functions

Configuration steps: Initial setup requires certain technical operations

How to use

Install the Ghidra extension

First, you need to install the MCP Bridge plugin in Ghidra. Open Ghidra, go to the File menu and select 'Install Extensions', then add the extended ZIP file you built.

Start Ghidra and load the program

After restarting Ghidra, create a new project and load the binary file you want to analyze. The plugin will start automatically and display connection information in the console.

Install Python dependencies

Open the terminal, enter the mcp_server directory, and install the necessary Python packages. It is recommended to use a virtual environment to avoid dependency conflicts.

Run the MCP server

Make sure Ghidra is running and a program is loaded, then start the Python MCP server.

Connect the AI client

Configure your AI client (such as Claude Desktop) to connect to the local MCP server, and then you can start using it.

Usage examples

Quickly analyze an unknown program

When you get an unknown binary file, you can quickly understand its structure and main functions.

Batch clean up automatically generated function names

When Ghidra performs automatic analysis, many function names in the format of FUN_xxx are generated, and these names lack descriptiveness.

Find security vulnerabilities

In security analysis, quickly identify potential dangerous functions or anti - debugging mechanisms.

Add analysis comments

In the complex reverse engineering process, add explanatory comments to important code segments.

Frequently Asked Questions

Do I need to purchase Ghidra?

Which AI clients does this tool support?

Can I use it without an internet connection?

Is this tool safe? Will it leak my analysis data?

What should I do if the extension fails to load?

Can I modify the default port number?

Does this tool support team collaboration?

Do I need programming experience to use it?

Related resources

Ghidra official website

Official download and documentation for the Ghidra reverse engineering tool

Model Context Protocol documentation

Official description and technical documentation for the MCP protocol

GitHub repository

Source code and latest updates for this project

Reverse engineering getting - started tutorial

Excellent reverse engineering learning resources, suitable for beginners

Claude Desktop download

AI desktop client supporting the MCP protocol

ghidra_health

Check if the Ghidra bridge is reachable

get_current_program

Get the current program name and image base address from Ghidra

list_functions

List functions in the current program (with an upper limit)

Parameters

limit : int*

Description

Upper limit of the number of returned functions

rename_function

Rename the function at the specified entry address

Parameters

entry : str*

Description

Function entry address

Parameters

new_name : str*

Description

New function name

patch_bytes

Patch bytes at the specified address

Parameters

address : str*

Description

Memory address

Parameters

bytes_hex : str*

Description

Hexadecimal byte string, e.g., '90 90 90'

set_comment

Set an end - of - line comment at the specified address

Parameters

address : str*

Description

Memory address

Parameters

comment : str*

Description

Comment content

get_function_context

Get function context: prototype, called functions, referenced strings, optionally decompiled text

Parameters

entry : str*

Description

Function entry address

Parameters

include_decompile : bool*

Description

Whether to include decompiled text

Parameters

decompile_timeout_sec : int*

Description

Decompilation timeout in seconds

scan_anti_debug

Scan for common anti - debugging heuristics (API calls + instruction mnemonics) in the program

Parameters

max_findings : int*

Description

Maximum number of findings

auto_rename_functions

Suggest (and optionally apply) deterministic function renaming for default FUN_/sub_ names. First use dry_run = True; then re - run with dry_run = False to apply

Parameters

limit : int*

Description

Upper limit of the number of functions to process

Parameters

only_default_names : bool*

Description

Whether to process only default names

Parameters

dry_run : bool*

Description

Whether it is a dry - run mode

Parameters

min_score : int*

Description

Minimum score threshold

Parameters

decompile_timeout_sec : int*

Description

Decompilation timeout in seconds

program_overview

A lightweight program overview (without LLM) for the analysis workflow: program information, function list (with an upper limit), and anti - debugging scan results (with an upper limit)

Parameters

function_limit : int*

Description

Upper limit of the function list

Parameters

anti_debug_max_findings : int*

Description

Upper limit of the number of anti - debugging findings