home / mcp / binary ninja mcp server

Binary Ninja MCP Server

A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.

Installation

Add the following to your MCP client configuration file.

Configuration

{
  "mcpServers": {
    "fosdickio-binary_ninja_mcp": {
      "command": "/ABSOLUTE/PATH/TO/Binary Ninja/plugins/repositories/community/plugins/fosdickio_binary_ninja_mcp/.venv/bin/python",
      "args": [
        "/ABSOLUTE/PATH/TO/Binary Ninja/plugins/repositories/community/plugins/fosdickio_binary_ninja_mcp/bridge/binja_mcp_bridge.py"
      ],
      "env": {
        "PYTHONPATH": "/ABSOLUTE/PATH/TO/Binary Ninja/plugins/repositories/community/plugins/fosdickio_binary_ninja_mcp/.venv/lib/python3.x/site-packages"
      }
    }
  }
}

This MCP (Machine Communication Protocol) server enables Binary Ninja to expose its analysis capabilities to your preferred MCP client. It lets you drive Binary Ninja from an external LLM or automation client in real time, making reverse engineering workflows faster and more interactive while you keep full control of the analysis environment.

How to use

You connect your MCP client to the Binary Ninja MCP server and start sending prompts that request analysis, decompilation, type definitions, or code exploration. The server exposes a rich set of actions you can perform on the currently open binary, such as decompiling functions, inspecting IL representations, patching bytes, renaming variables, and listing references. Use your MCP client to switch focus between active binaries, retrieve function information, and annotate or transform the analyzed code. You can also leverage multiple MCP clients in parallel to compare results or collaborate with teammates.

Working patterns you can use

Open a binary in Binary Ninja through your MCP client workflow and keep it as the active target. From there you can request decompiled views of specific functions, obtain cross references to addresses or symbols, or fetch type information for structures and typedefs. You can also patch bytes at a given address, rename variables or functions for clarity, and generate annotated reports based on your findings. If you work with multiple binaries, you can switch the active target and continue querying without restarting your session.

Common prompts you can try

Ask the MCP client to decompile a function by name and return a readable, HLIL-like representation. Request cross references to critical addresses to map out data flow. Retrieve a function’s stack frame variables to understand parameter passing and local storage. Generate a report summarizing the analysis after you finish investigating a binary.

Tips for best results

When integrating with Binary Ninja, prefer using descriptive function and variable names during analysis to keep decompiled output readable. Use the patch and rename capabilities to adjust code organization as you explore. If you encounter large binaries, paginate string and data listings to keep responses manageable. Document your findings with comments and summaries so you can return to them later.

Available tools

decompile_function

Decompile a specific function by name and return HLIL-like code with addresses.

get_il

Get intermediate language (IL) for a function in hlil/mlil/llil, with SSA supported where applicable.

define_types

Add type definitions from a C-like string declaration to the current analysis.

delete_comment

Delete the comment attached to a specific address.

get_entry_points

List the entry point(s) of the loaded binary.

get_binary_status

Query the current status of the loaded binary in the session.

get_xrefs_to

Get all cross references to a given address, including code and data references.

get_type_info

Resolve a type name to its declaration and related details.

make_function_at

Create a function at a given address; can specify a platform or use the default.

list_binaries

List all managed/open binaries with their IDs and active status.

select_binary

Set the active binary by ID or filename for subsequent operations.

list_strings

List all strings found in the program, with optional pagination.

get_stack_frame_vars

Retrieve stack frame variables for a function, including names, offsets, and types.

rename_function

Rename a function to a new user-defined name.

rename_data

Rename a data label at a specified address.

patch_bytes

Patch raw bytes at a given address; can modify entire instructions by providing the new byte sequence.

search_functions_by_name

Find functions whose names contain a given substring.

get_data_decl

Return a data symbol’s declaration and a hexdump for a given symbol or address.

get_xrefs_to_type

Get usages related to a specific type in the codebase.