ghidraMCP

What is ghidraMCP?

ghidraMCP is a Model Context Protocol (MCP) server that allows LLMs to autonomously reverse engineer applications by exposing core Ghidra functionality to MCP clients. It includes both a Ghidra plugin and a Python MCP bridge.

How to use ghidraMCP?

Install Ghidra and the GhidraMCP plugin via the release ZIP, then run the Python MCP bridge script (bridge_mcp_ghidra.py) with appropriate transport and server settings. Clients like Claude Desktop, Cline, or 5ire can then connect to the bridge to issue reverse‑engineering commands.

Key features of ghidraMCP

• Decompile and analyze binaries in Ghidra
• Automatically rename methods and data
• List methods, classes, imports, and exports
• Configurable HTTP server port in Ghidra
• Supports multiple MCP clients and transports

Use cases of ghidraMCP

• Automate binary reverse engineering with LLM assistance
• Let an LLM explore and rename functions in a Ghidra project
• Programmatically extract method lists, imports, or exports for analysis
• Enable natural‑language queries about decompiled code

FAQ from ghidraMCP

What are the prerequisites for ghidraMCP?

You need Ghidra installed, Python 3, and the MCP Python SDK.

How do I install the Ghidra plugin?

Download the latest release ZIP, then in Ghidra go to File → Install Extensions, click the + button, select the ZIP, and restart Ghidra. Ensure the plugin is enabled in File → Configure → Developer.

Which MCP clients are supported?

The README provides examples for Claude Desktop, Cline, and 5ire, but states that any MCP client should work theoretically.

What transport options are available?

The bridge script supports command‑line arguments for transport (--transport sse or default stdio), MCP host/port, and Ghidra server URL. Defaults are localhost:8080 for both.

Can I build ghidraMCP from source?

Yes. Copy required Ghidra JARs into the project’s lib/ directory and run mvn clean package assembly:single. The generated ZIP includes the plugin and resources.