A production-ready MCP server with 252 tools for AI-powered reverse engineering using Ghidra.
ghidra-mcp is worth checking the docs before setup with strong trust signals. Check agent compatibility and use-case fit before adding it to your workflow.
Repository setup guidance
gh repo view bethington/ghidra-mcp --webOpen the official README and confirm the supported install method.
Add the server entry to your MCP client config.
Restart your agent and verify that the server tools appear.
This tool connects Ghidra, a reverse engineering platform, to AI assistants like Claude. It gives AI agents over 250 tools to analyze binaries, rename functions, debug, and automate reverse engineering tasks. It's built for real-world use, not just demos.
Ghidra MCP Server is a comprehensive Model Context Protocol (MCP) server that bridges Ghidra's powerful reverse engineering capabilities with modern AI tools and automation frameworks. It provides 252 MCP tools — 3x more than competing implementations — including full write access for renaming, typing, commenting, structure creation, script execution, P-code emulation, and live debugging. The server supports atomic transactions, batch operations (93% API call reduction), configurable timeouts, and graceful error handling. It features cross-binary documentation transfer via SHA-256 function hash matching, Ghidra Server integration, Docker deployment, and a GUI plugin. The project includes battle-tested AI workflows, step-by-step prompts, Hungarian notation reference, batch processing guides, and orphaned code discovery. It is production-grade and used daily on real binaries.
Strong trust signals; still review the README and permissions before production use.
Last commit was about 51 days ago.
2301 GitHub stars indicate community interest.
13 open issues signal maintenance load.
Apache-2.0 license detected.
Automate reverse engineering of malware binaries with AI assistance.
Batch rename and document thousands of functions across multiple binary versions.
Perform live debugging and P-code emulation through natural language commands.
Integrate Ghidra analysis into CI/CD pipelines for firmware security audits.
Transfer documentation between different versions of the same binary automatically.
Running arbitrary scripts from AI agents could lead to unintended system modifications if not properly sandboxed.
The server provides write access to Ghidra projects; misconfiguration may corrupt analysis data.
2,301
Stars
19
Forks
13
Issues
Apache-2.0
License
Local codebase intelligence CLI and MCP server for AI coding agents with change-safety gates and audit evidence.
An offline MCP server that indexes your codebase for semantic search, code search, and git history retrieval.
Official MCP reference servers from Anthropic. Includes servers for filesystem, GitHub, Postgres, Slack, and more.
A production-ready MCP server with 252 tools for AI-powered reverse engineering using Ghidra.
Reverse engineers who want to leverage AI for faster binary analysis., Security researchers automating malware analysis workflows., DevOps engineers integrating static analysis into deployment pipelines.
The setup section provides repository-level starting guidance, not a guarantee of an independently verified installation. Check the official README and release notes.
Running arbitrary scripts from AI agents could lead to unintended system modifications if not properly sandboxed. The server provides write access to Ghidra projects; misconfiguration may corrupt analysis data.
Similar or complementary options to evaluate include roam-code, code-memory, MCP Server Collection.
Jun 6, 2026
2 security/trust notes recorded.
Setup difficulty is 4/5.