13bm/GhidraMCP

](https://github.com/13bm/GhidraMCP/actions/workflows/build.yml) [

A Ghidra extension that exposes 70 reverse-engineering tools to AI assistants through the Model Context Protocol (MCP). Open a binary in Ghidra, enable the plugin, and let Claude (or any MCP client) decompile functions, rename symbols, annotate code, search for vulnerabilities, and more.

The Ghidra plugin (Java) starts a TCP server inside Ghidra and auto-launches the Go bridge binary. The bridge speaks MCP over stdio to the AI client and forwards calls to the Java plugin over a local TCP socket with 4-byte length-prefixed JSON-RPC framing. Optional API-key authentication protects the TCP channel.

• 70 MCP tools spanning query, mutation, analysis, malware triage, IoT/embedded security, structure management, async decompilation, and multi-instance support
• Easy setup -- plugin auto-starts the bridge; use MCP > Settings > Write to Claude Config to configure your MCP client
• Cross-platform -- prebuilt bridge binaries for Linux x86_64, Windows x86_64, macOS x86_64 and macOS ARM64
• Configurable -- port, localhost-only binding, API-key auth, auto-start, bridge enable/disable via GhidraMCP.properties
• Multi-instance -- work with multiple Ghidra windows simultaneously using target_port to route tool calls
• Async decompilation -- decompile large functions without blocking; poll for results later
• Connection retry -- the bridge reconnects automatically if Gh

Works with Claude (desktop and mobile), Cursor, Windsurf, VS Code, and any MCP-compatible AI app.

Category: Developer Tools