Pyghidra Mcp

What is Pyghidra Mcp?

Pyghidra Mcp is a command-line Model Context Protocol (MCP) server that brings Ghidra’s full reverse engineering capabilities—via its ProgramAPI and FlatProgramAPI—to LLMs and intelligent agents. It bridges Ghidra to Python using pyghidra and jpype, then exposes that functionality through the MCP interface for headless, automated, and AI-assisted workflows.

How to use Pyghidra Mcp?

Run the server from the command line using uvx pyghidra-mcp (or as a Docker container) and pass one or more binary files as arguments. Choose the transport protocol with --transport (stdio, sse, or streamable-http). The server then loads the binaries into a Ghidra project and exposes MCP tools for analysis.

Key features of Pyghidra Mcp

• No Ghidra GUI required – runs entirely via CLI
• Designed for automation and CI/CD pipelines
• Supports stdio, SSE, and streamable HTTP transports
• Agent-ready for intelligent reverse engineering workflows
• Semantic code search using vector embeddings (ChromaDB)
• Concurrent analysis of all binaries in a Ghidra project

Use cases of Pyghidra Mcp

• Automating reverse engineering tasks in headless environments
• Integrating Ghidra analysis into LLM-based chat interfaces or agents
• Running batch decompilation and symbol searches in CI pipelines
• Simultaneously analyzing multiple binaries in a single project
• Enabling semantic search across decompiled functions and symbols for agent-driven triage

FAQ from Pyghidra Mcp

How is Pyghidra Mcp different from the original ghidra-mcp?

It does not require a Ghidra GUI, is designed for automation and CI/CD, supports faster command-line startup, concurrent project-wide analysis, and includes semantic code search via ChromaDB.

What runtime dependencies does Pyghidra Mcp require?

It requires a local Ghidra installation with the GHIDRA_INSTALL_DIR environment variable set. It can be run via Python (with uv or pipx) or as a Docker container from ghcr.io/clearbluejar/pyghidra-mcp.

What transports does Pyghidra Mcp support?

It supports standard I/O (stdio), server-sent events (SSE), and streamable HTTP. The transport is selected with the --transport flag.

How do I run Pyghidra Mcp with Docker?

Map a directory containing binaries into the container and pass the binary paths as arguments:
docker run -i --rm -v "$(pwd)/binaries:/binaries" ghcr.io/clearbluejar/pyghidra-mcp /binaries/*

What tools does Pyghidra Mcp expose?

It exposes tools for code search, cross-references, function decompilation, listing exports/imports, listing project binaries and program info, and searching functions and symbols by name.