Ghidra MCP Server

What is 🔍 Ghidra MCP Server?

🔍 Ghidra MCP Server lets you use Ghidra in headless mode to extract rich binary analysis data (functions, pseudocode, structs, enums, etc.) into a JSON file and expose it to LLMs like Claude via the Model Context Protocol (MCP). It turns Ghidra into an interactive reverse‑engineering backend for AI‑assisted analysis.

How to use 🔍 Ghidra MCP Server?

Install Java 21, Ghidra 11.3.1+, and Python 3.10+. Clone the project, then register the server with mcp install main.py. For testing, use mcp dev main.py. To connect with Claude Desktop, update its configuration file (claude_desktop_config.json) to point to the uv binary and the project’s main.py.

Key features of 🔍 Ghidra MCP Server

• Decompiles a binary using Ghidra headless mode
• Extracts function pseudocode, names, parameters, variables, strings, comments
• Extracts data structures (structs), enums, and function definitions
• Outputs all extracted data to ghidra_context.json
• MCP server exposes tools like list_functions(), get_pseudocode(name), list_structures(), get_structure(name), list_enums(), get_enum(name), list_function_definitions(), and get_function_definition(name)
• Designed to integrate with AI assistants for interactive reverse engineering

Use cases of 🔍 Ghidra MCP Server

• Reverse‑engineer unknown binaries with the help of an LLM
• Automatically generate pseudocode summaries and documentation for binary analysis
• Analyze malware or legacy code in a headless, scriptable workflow
• Combine Ghidra’s static analysis with natural‑language questions about decompiled output