Home / MCP / GhidraMCP Server

GhidraMCP Server

Exposes Ghidra’s decompile and analysis tools to MCP clients via HTTP and stdio bridges.

other

6.7kstars

View on GitHub

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
    "mcpServers": {
        "ghidra": {
            "url": "http://127.0.0.1:8080/"
        }
    }
}

ghidraMCP is a Model Context Protocol server that lets Large Language Models autonomously interact with Ghidra to reverse engineer applications. It exposes core Ghidra functionality through MCP clients, enabling automated decompilation, analysis, and metadata extraction for faster, hands-off exploration of binaries.

How to use

You connect an MCP client to the ghidraMCP server to leverage Ghidra’s analysis capabilities from your preferred workflow. Start the HTTP endpoint or a local stdio bridge, then point your MCP client at that endpoint. The server provides tools to decompile, analyze, rename methods and data, and list methods, classes, imports, and exports so you can build automated reverse engineering pipelines.

How to install

Prerequisites you need before installation are listed below. Ensure each item is installed and accessible from your command line.

Install Ghidra

Install Python 3

Install MCP SDK

Install Maven to build the MCP server component

Step-by-step installation flow

1) Download the GhidraMCP release package that contains the Ghidra plugin and the Python MCP client

2) Open Ghidra and install the GhidraMCP plugin extension

3) Enable the GhidraMCPPlugin in Ghidra under File → Configure → Developer

4) Return to Ghidra’s main window and optionally set the HTTP port for the embedded server in Edit → Tool Options → GhidraMCP HTTP Server

5) Build the MCP server component from source using Maven

6) Start the MCP bridge script to expose Ghidra through MCP to your client

Typical build and start sequence (shown as commands you will run) separate into individual steps:

mvn clean package assembly:single

# After building, run the bridge to expose Ghidra via MCP (example for SSE transport)
python bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/

# The Ghidra server URL you provide to clients is the host:port of the MCP bridge (8081 in this example) with /sse appended for SSE transport

Additional configuration and examples

The following examples show how to configure different MCP clients to connect to ghidraMCP. Copy the exact blocks into your client’s MCP configuration as shown.

Example 1: Claude Desktop configuration (HTTP bridge)

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}

Additional configuration for SSE transport (Example 2)

Example 2: Cline setup using an SSE transport bridge (MCP server started separately)

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "bridge_mcp_ghidra.py",
        "--transport",
        "sse",
        "--mcp-host",
        "127.0.0.1",
        "--mcp-port",
        "8081",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}

Example 3: 5ire client setup

Example 3 configures 5ire to run the bridge for ghidraMCP and connect to the local SSE endpoint.

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": ["/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py"]
    }
  }
}

Available tools

Decompile and analyze

Decompile binaries and perform static analysis using Ghidra's decompiler and analysis tools.

Rename methods and data

Automatically rename methods and data for clearer understanding and downstream processing.

List entities

List methods, classes, imports, and exports to provide a structured view of the binary.