Ghidra MCP 🔌 MCP server Open source

What it does

Ghidra MCP Server bridges Ghidra's reverse-engineering toolkit with AI coding agents via the Model Context Protocol. It ships as a Ghidra GUI plugin plus a Python bridge/headless server, giving an agent structured, high-level access to binary analysis, decompilation and documentation workflows instead of requiring a human to script Ghidra's Java API directly.

Tools it gives your agent

The project exposes roughly 250 MCP tools (up to 253: 239 in GUI mode, 226 headless), grouped into functional areas: program/session management, listing and enumeration (functions, strings, imports/exports), function analysis (decompile, rename, retype, tag), cross-references and call graphs, data type/struct/enum/union editing, batch comment operations, control-flow and P-code dataflow analysis, malware/anti-analysis helpers (crypto detection, IOC extraction), cross-binary documentation transfer via SHA-256 hash matching, P-code emulation and API-hash brute-forcing, Ghidra Server/version-control operations, and a 22-tool debugger integration over TraceRmi (breakpoints, stepping, register/memory reads). Tools load lazily by group to keep the surface manageable for a given client.

Works with

Any MCP-compliant client over stdio or streamable-HTTP transport; the README specifically shows configuration for Claude Desktop and Cursor. It requires Ghidra 12.1.2, Java 21, and Python 3.10+ with uv.

How to install or connect

Build and deploy the Ghidra extension with the included setup tool, then run the Python bridge:

python -m tools.setup ensure-prereqs --ghidra-path /path/to/ghidra_12.1.2_PUBLIC
python -m tools.setup build
python -m tools.setup deploy --ghidra-path /path/to/ghidra_12.1.2_PUBLIC
uv run bridge-mcp-ghidra

In Ghidra: Tools > GhidraMCP > Start MCP Server (default http://127.0.0.1:8089), then point your MCP client at the bridge via stdio or HTTP as shown above.

Maintenance and safety

Actively maintained (v7.0.0, 1,190+ commits, 11 open PRs, ~30 open issues, 3.9k stars). The server binds to localhost with no auth by default; remote access requires an explicit bearer token, and script execution is off by default given the tool's reach into live debugging and binary manipulation.

Who should use it

Reverse engineers, malware analysts and security researchers who want an AI agent to drive Ghidra's decompiler, debugger and documentation workflow at scale, and who are comfortable running a local, version-matched Ghidra + Java + Python toolchain.