Ghidra MCP Zig Plugin

What is Ghidra MCP Zig Plugin?

A Ghidra plugin that provides a bridge between Ghidra and a Zig‑based MCP (Model Context Protocol) server for enhanced program analysis capabilities such as function decompilation, renaming, and symbol management. It is aimed at reverse engineers and analysts who want to extend Ghidra’s functionality via an MCP interface.

How to use Ghidra MCP Zig Plugin?

Build the plugin with make build-plugin, copy the resulting library to your Ghidra plugins directory, and restart Ghidra. Then start the MCP server with make run-server and use plugin features through Ghidra’s interface (e.g., commands like decompile, rename_function, list_functions).

Key features of Ghidra MCP Zig Plugin

• JNI‑based communication between Ghidra and Zig
• Function decompilation and renaming
• Data symbol management
• Import/Export listing
• MCP server integration
• Comprehensive test suite with Make targets
• Type‑safe JNI bridge implementation
• Go client library for easy integration

Use cases of Ghidra MCP Zig Plugin

• Decompile functions at a given address
• Rename functions or data objects
• List all functions, data, imports, or exports
• Automate analysis workflows via MCP commands
• Integrate Ghidra analysis into external tools using the Go client

FAQ from Ghidra MCP Zig Plugin

What are the prerequisites?

Zig 0.13.0+, Ghidra 11.3.1+, JDK 17+, Go 1.22.4+, Gradle 8.13+, and Make.

How do I install the plugin?

Build the plugin with make build-plugin, then copy zig-out/lib/libghidra-mcp-zig.dylib to your Ghidra plugins directory and restart Ghidra.

What MCP commands are available?

decompile, rename_function, rename_data, list_functions, list_data, list_imports, and list_exports.

How does error handling work?

The plugin defines specific error types (e.g., ConnectionError, InvalidAddress, DecompilationFailed, JNIError) and includes proper cleanup and null‑checking in the JNI bridge.

What is the JNI bridge implementation?

It is a type‑safe interface between Zig and Java that handles memory management, JNI reference lifecycle, type conversion, and error handling with compile‑time checks.