ghidraMCP is an Model Context Protocol server for allowing LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients.
ghidraMCP_demo.mp4
MCP Server + Ghidra Plugin
- Decompile and analyze binaries in Ghidra
- Automatically rename methods and data
- List methods, classes, imports, and exports
- Install Ghidra 12.1.4
- Install uv (or Python 3.10+ with
pip install git+https://github.com/LaurieWired/GhidraMCP, then useghidra-mcpas the command below)
First, download the latest release from this repository. This contains the Ghidra plugin and Python MCP client. Then, you can directly import the plugin into Ghidra.
- Run Ghidra
- Select
File->Install Extensions - Click the
+button - Select the
ghidra_12.1.4_PUBLIC_<date>_GhidraMCP.zipfrom the downloaded release - Restart Ghidra
- Make sure the GhidraMCPPlugin is enabled in
File->Configure->Developer - Optional: Configure the port in Ghidra with
Edit->Tool Options->GhidraMCP HTTP Server
Video Installation Guide:
ghidra_MCP_Install.mp4
Theoretically, any MCP client should work with ghidraMCP. Most clients accept a JSON config like the following:
{
"mcpServers": {
"ghidra": {
"command": "uvx",
"args": [
"--from",
"git+https://github.com/LaurieWired/GhidraMCP",
"ghidra-mcp",
"--ghidra-server",
"http://127.0.0.1:8080/"
]
}
}
}The server IP and port are configurable and should be set to point to the target Ghidra instance. If not set, both will default to localhost:8080.
For clients that connect to a URL instead of launching a command, first run the MCP server yourself:
uvx --from git+https://github.com/LaurieWired/GhidraMCP ghidra-mcp --transport streamable-http --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/
Then add http://127.0.0.1:8081/mcp as a remote server in your client.
Run MCP: Add Server from the Command Palette, or add the following to .vscode/mcp.json in your workspace:
{
"servers": {
"ghidra": {
"type": "stdio",
"command": "uvx",
"args": [
"--from",
"git+https://github.com/LaurieWired/GhidraMCP",
"ghidra-mcp",
"--ghidra-server",
"http://127.0.0.1:8080/"
]
}
}
}Run the following command:
claude mcp add ghidra -- uvx --from git+https://github.com/LaurieWired/GhidraMCP ghidra-mcp --ghidra-server http://127.0.0.1:8080/
ghidra-mcp can also import and analyze a binary itself using PyGhidra, with no Ghidra GUI running. This needs Python 3.10–3.13, the GhidraMCP extension installed in Ghidra (or --extension-jar /path/to/GhidraMCP.jar), and GHIDRA_INSTALL_DIR set to your Ghidra 12.1.4 directory:
uvx --python 3.13 --from "ghidra-mcp[headless] @ git+https://github.com/LaurieWired/GhidraMCP" ghidra-mcp --headless --binary /path/to/target
Use the same command and arguments in any of the client configs above. Add --project DIR to keep the Ghidra project (and save changes) between runs. On macOS, build Ghidra's decompiler once with support/gradle/gradlew buildNatives from the Ghidra directory.
- Set
GHIDRA_INSTALL_DIRto your Ghidra 12.1.4 directory - Build the extension with Gradle (Java 21) by running:
cd extension && $GHIDRA_INSTALL_DIR/support/gradle/gradlew buildExtension
The generated zip file in extension/dist/ includes the built Ghidra plugin and its resources. These files are required for Ghidra to recognize the new extension.
- lib/GhidraMCP.jar
- extension.properties
- Module.manifest
The Python MCP server can be run from a checkout with uv run ghidra-mcp, and tested with uv run pytest.
