GhidraMCP

lastmod 2025-03-28created 2025-03-282 edits

Ghidra MCP server for reverse engineering

ghidraMCP is an Model Context Protocol server for allowing LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients.

About

• ghidraMCP is a Model Context Protocol (MCP) server that lets large language models (LLMs) reverse engineer applications autonomously
• Exposes Ghidra's core functionality to MCP clients so that LLMs can use the analysis tools directly
• Contributes to faster and more efficient reverse engineering by automating the traditional manual analysis process
• Can be used in various fields such as AI-based security analysis, malware analysis, and binary debugging

Key features

• MCP server and Ghidra plugin setup
  • Provides the connection interface between LLMs and Ghidra
  • Exposes Ghidra functionality to the MCP protocol as an API
• Binary decompilation and analysis
  • Decompiles and analyzes executables in various formats such as ELF and PE through Ghidra
• Automatic method and data naming
  • Automatically assigns meaningful names to obfuscated or unnamed methods and data
  • Improves code readability and analysis speed
• Code structure lookup
  • Extracts lists of methods, classes, imports, and exports
  • Useful for analyzing code flow and dependencies

See also

• Reverse engineering
• Ghidra
• Python3
• MCP

Favorite site

• Github - LaurieWired/GhidraMCP
• Ghidra MCP server for reverse engineering | GeekNews