GhidraMCP

What is GhidraMCP?

A Ghidra extension that exposes 70 reverse-engineering tools to AI assistants through the Model Context Protocol (MCP). It lets Claude or any MCP client decompile functions, rename symbols, annotate code, search for vulnerabilities, and more, directly from a Ghidra project.

How to use GhidraMCP?

Install the extension ZIP via Ghidra’s File > Install Extensions, then enable the plugin under File > Configure > GhidraMCP. The plugin auto-starts the TCP server and the Go MCP bridge. Configure your MCP client (e.g., Claude Desktop) by using the Write to Claude Config button in the plugin’s settings dialog or by copying the JSON snippet provided.

Key features of GhidraMCP?

• 70 MCP tools for query, mutation, analysis, malware triage.
• Auto-launching bridge with cross-platform prebuilt binaries.
• Configurable port, localhost binding, and API-key authentication.
• Multi-instance support for multiple Ghidra windows.
• Async decompilation for large functions with polling.
• Pagination for safe incremental retrieval of large result sets.

Use cases of GhidraMCP?

• Decompile and analyze binary functions with AI assistance.
• Rename symbols and annotate code in Ghidra from an AI client.
• Search for vulnerabilities such as format string flaws.
• Perform malware analysis: detect anti-analysis, extract IOCs.
• Work with multiple binaries open simultaneously in separate Ghidra windows.

FAQ from GhidraMCP

What MCP clients are supported?

Any MCP-compatible client works, including Claude Desktop and Claude Code.

What are the prerequisites?

Ghidra 12.0.3+, Java 21+, and an MCP