playbooks

home / mcp / ghidramcp mcp server

GhidraMCP MCP Server

Provides a Model Context Protocol server that connects Ghidra to MCP clients for autonomous reverse engineering tasks.

Installation
Add the following to your MCP client configuration file.

Configuration

View docs
{
  "mcpServers": {
    "albertlab0-ghidramcp": {
      "url": "http://127.0.0.1:8080/"
    }
  }
}

ghidraMCP provides a Model Context Protocol server that lets you connect Ghidra to MCP clients. You can automate reverse engineering tasks by exposing core Ghidra functionality to clients, enabling streamlined analysis workflows.

How to use

You will run a local MCP bridge that connects a client to your Ghidra instance. Start Ghidra with the GhidraMCP plugin enabled, then run the MCP bridge so your client can reach Ghidra. Clients can connect to the local MCP server to request decompilation, analysis, and automatic renaming tasks. Use the bridge setup to point to your Ghidra instance, and configure your client to communicate with the bridge endpoint.

How to install

Prerequisites you need before installation:

  • Download and install the latest Ghidra release.
  • Ensure Python 3 is installed and accessible in your system PATH.
  • Obtain and install the MCP SDK as required by your setup.

Ghidra setup steps

1) Open Ghidra and install the MCP bridge plugin

2) In Ghidra, go to File, then Install Extensions

3) Click the + button and select the GhidraMCP-1-2.zip (or your chosen version) from the downloaded release

4) Restart Ghidra

5) Enable the GhidraMCPPlugin under File, Configure, Developer

6) Optional: Configure the port in Ghidra with Edit, Tool Options, GhidraMCP HTTP Server

Install guide for MCP clients

The server is designed to work with common MCP clients. You can connect to the bridge using a client configuration that references the GhidraMCP bridge and the target Ghidra server.

Additional setup for MCP clients

Example 1 demonstrates a typical client configuration JSON for Claude Desktop, pointing to a local Ghidra bridge. This config ensures the client talks to the MCP bridge that exposes Ghidra’s capabilities.

Example 2 demonstrates using Cline with a simple local bridge and an SSE transport, exposing the Ghidra MCP server over a local port.

Example 3 demonstrates configuring a client like 5ire to use the bridge as a command with a direct path to the bridge script.

Building from source

To build the MCP server extension for Ghidra, you need the Ghidra JARs copied into the project’s lib directory, and then you build with Maven.

Copy these JARs from your Ghidra installation into lib/:

- Ghidra/Features/Base/lib/Base.jar

- Ghidra/Features/Decompiler/lib/Decompiler.jar

- Ghidra/Framework/Docking/lib/Docking.jar

- Ghidra/Framework/Generic/lib/Generic.jar

- Ghidra/Framework/Project/lib/Project.jar

- Ghidra/Framework/SoftwareModeling/lib/SoftwareModeling.jar

- Ghidra/Framework/Utility/lib/Utility.jar

- Ghidra/Framework/Gui/lib/Gui.jar

Then build with Maven

mvn clean package assembly:single

Available tools

decompile_and_analyze

Decompile and analyze binaries within Ghidra to reveal program structure and behavior.

auto_rename

Automatically rename methods and data to reflect their true semantics and improve readability.

list_entities

List methods, classes, imports, and exports to provide an overview of program components.