GhidraMCP is an MCP server that connects LLMs to Ghidra, the NSA's open-source software reverse engineering framework, enabling autonomous binary analysis and reverse engineering workflows. Key capabilities include: - Automated decompilation and analysis of binary executables within Ghidra - Programmatic renaming of methods, classes, and data structures to improve code readability - Enumeration of program elements including methods, classes, imports, exports, and symbols - Integration with MCP clients like Claude Desktop for AI-assisted reverse engineering - HTTP bridge connecting external LLM clients to Ghidra's core analysis engine

[](https://www.apache.org/licenses/LICENSE-2.0) [](https://github.com/LaurieWired/GhidraMCP/releases) [](https://github.com/LaurieWired/GhidraMCP/stargazers) [](https://github.com/LaurieWired/GhidraMCP/network/members) [](https://github.com/LaurieWired/GhidraMCP/graphs/contributors) [](https://twitter.com/lauriewired)

ghidraMCP

https://github.com/user-attachments/assets/36080514-f227-44bd-af84-78e29ee1d7f9

Features

Installation

Prerequisites

Ghidra

1. Run Ghidra 2. Select File -> Install Extensions 3. Click the + button 4. Select the GhidraMCP-1-2.zip (or your chosen version) from the downloaded release 5. Restart Ghidra 6. Make sure the GhidraMCPPlugin is enabled in File -> Configure -> Developer 7. *Optional*: Configure the port in Ghidra with Edit -> Tool Options -> GhidraMCP HTTP Server

Video Installation Guide:

https://github.com/user-attachments/assets/75f0c176-6da1-48dc-ad96-c182eb4648c3

MCP Clients

Theoretically, any MCP client should work with ghidraMCP. Three examples are given below.

Example 1: Claude Desktop

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}

Alternatively, edit this file directly:

/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json

The server IP and port are configurable and should be set to point to the target Ghidra instance. If not set, both will default to localhost:8080.

Example 2: Cline

python bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/

The only *required* argument is the transport. If all other arguments are unspecified, they will default to the above. Once the MCP server is running, open up Cline and select MCP Servers at the top.

Then select Remote Servers and add the following, ensuring that the url matches the MCP host and port:

1. Server Name: GhidraMCP 2. Server URL: http://127.0.0.1:8081/sse

Example 3: 5ire

1. Tool Key: ghidra 2. Name: GhidraMCP 3. Command: python /ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py

Building from Source

mvn clean package assembly:single

The generated zip file includes the built Ghidra plugin and its resources. These files are required for Ghidra to recognize the new extension.