R
rison1337/x64dbgMCP
Dynamic x64dbg/x32dbg MCP backend: launch/attach, breakpoints, memory, API/heap traces, OEP/IAT/PE dumps, key recovery, and IDA hash+RVA evidence.
SECURITY.md ✓
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
We have neither an install command nor a public remote endpoint from this repository, so we do not print a config. A made-up one is worse than none. How each client wires MCP up →
- Star count
- 2 ★ · rison1337/x64dbgMCP · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- collected from the punkpeye/awesome-mcp-servers list · type: MCP server
- Harvest history
- first seen 2026-10-23 · last seen 2026-11-14 · seen 26× · listed by 23 sources
- Score
- score 2,300 · 2 ★ · 23 sources · mcp
FAQ (answers come from our records)
Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
rison1337/x64dbgMCP；first catalogued 2026-10-23；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.https://github.com/user-attachments/assets/07b813eb-4175-4f14-b21b-602548906398
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
x64dbg MCP gives an MCP client guarded control of a real
x64dbg or x32dbg session. It turns live debugging into a
replayable reverse-engineering workflow: bind the exact process, observe
runtime facts, recover useful artifacts, validate them independently, and hand
the evidence to IDA.
### What it does
Launches or attaches with arguments, working directory, environment and
child-process policy.
Reads and changes registers, memory, threads, modules and owned breakpoints.
Captures instruction, API, heap, exception and basic-block evidence.
Finds comparison values, runtime strings, indirect calls, OEPs and imports.
Produces memory PE dumps, minidumps, fixed imports and patched exports.
Exchanges runtime facts with IDA using a portable file SHA-256 + module RVA
identity instead of unstable runtime addresses.
### Tool groups
| Workflow | Representative tools | Result |
| Launch and bind | InitDebuggee, AttachToProcess, LaunchFileUnderDebugger, WaitForBreakpoint | Reproducible process and session identity |
| Live control | RegisterGet, RegisterSet, MemoryRead, MemoryWrite, DebugSetBreakpoint, SetHardwareBreakpoint | Controlled execution, memory and breakpoint changes |
| Runtime evidence | RunNativeTrace, GetNativeTrace, StartApiTrace, StartHeapTrace, GetBasicBlockCoverage, WaitForBreakpointCapture | Instruction paths, API/heap calls, exceptions and executed blocks |
| Key and unpack recovery | SearchStrings, ScanMemoryStrings, PatternFindMem, FindOEP, RunUntilOEP, FindIATCandidates, InspectRuntimeIAT | Comparisons, strings, OEP and runtime import candidates |
| Dump and repair | WriteMiniDump, DumpModuleRaw, DumpPeFromMemory, ScanMemoryForPEImages, FixDumpImports, ValidateDump, ExportPatchedFile | Replayable dumps and independently checked PE artifacts |
| IDA evidence handoff | ExportRuntimeEvidence, ImportStaticAnnotations, SyncBreakpoints, ResolveModuleRva | Hash/RVA-addressed comments, labels, coverage and API facts |
The complete catalog, parameters and response contracts are in the
tool reference. The compact profile keeps routine
model-facing responses short; detail="full" and the full profile expose
the complete evidence when it is needed.
### Quick setup
Download the combined Windows bundle from
Releases. It contains both
native plugins and the Python backend:
plugins\MCPx64dbg.dp64 for x64dbg
plugins\MCPx64dbg.dp32 for x32dbg
runtime\src and runtime\requirements.txt
self-contained x64/x86 managed-runtime probes under runtime\tools\bin\managedprobe
Close x64dbg/x32dbg. Open PowerShell in the folder containing the downloaded
ZIP, then run the block below. It asks where to keep the MCP bundle and where
x64dbg is already installed; no drive or installation directory is assumed.
Keep the same PowerShell window open for the client-specific commands below.
powershell
$Archive = Get-ChildItem -File .\x64dbg-mcp-windows-.zip |
Sort-Object LastWriteTime -Descending |
Select-Object -First 1
if (-not $Archive) { throw 'The x64dbg MCP release ZIP was not found in this folder.' }
$BundleRoot = Read-Host 'Absolute folder where x64dbg MCP should be extracted'
$X64dbgRoot = Read-Host 'Absolute folder containing the x64 and x32 x64dbg folders'
x64dbg or x32dbg session. It turns live debugging into a
replayable reverse-engineering workflow: bind the exact process, observe
runtime facts, recover useful artifacts, validate them independently, and hand
the evidence to IDA.
### What it does
Launches or attaches with arguments, working directory, environment and
child-process policy.
Reads and changes registers, memory, threads, modules and owned breakpoints.
Captures instruction, API, heap, exception and basic-block evidence.
Finds comparison values, runtime strings, indirect calls, OEPs and imports.
Produces memory PE dumps, minidumps, fixed imports and patched exports.
Exchanges runtime facts with IDA using a portable file SHA-256 + module RVA
identity instead of unstable runtime addresses.
### Tool groups
| Workflow | Representative tools | Result |
| Launch and bind | InitDebuggee, AttachToProcess, LaunchFileUnderDebugger, WaitForBreakpoint | Reproducible process and session identity |
| Live control | RegisterGet, RegisterSet, MemoryRead, MemoryWrite, DebugSetBreakpoint, SetHardwareBreakpoint | Controlled execution, memory and breakpoint changes |
| Runtime evidence | RunNativeTrace, GetNativeTrace, StartApiTrace, StartHeapTrace, GetBasicBlockCoverage, WaitForBreakpointCapture | Instruction paths, API/heap calls, exceptions and executed blocks |
| Key and unpack recovery | SearchStrings, ScanMemoryStrings, PatternFindMem, FindOEP, RunUntilOEP, FindIATCandidates, InspectRuntimeIAT | Comparisons, strings, OEP and runtime import candidates |
| Dump and repair | WriteMiniDump, DumpModuleRaw, DumpPeFromMemory, ScanMemoryForPEImages, FixDumpImports, ValidateDump, ExportPatchedFile | Replayable dumps and independently checked PE artifacts |
| IDA evidence handoff | ExportRuntimeEvidence, ImportStaticAnnotations, SyncBreakpoints, ResolveModuleRva | Hash/RVA-addressed comments, labels, coverage and API facts |
The complete catalog, parameters and response contracts are in the
tool reference. The compact profile keeps routine
model-facing responses short; detail="full" and the full profile expose
the complete evidence when it is needed.
### Quick setup
Download the combined Windows bundle from
Releases. It contains both
native plugins and the Python backend:
plugins\MCPx64dbg.dp64 for x64dbg
plugins\MCPx64dbg.dp32 for x32dbg
runtime\src and runtime\requirements.txt
self-contained x64/x86 managed-runtime probes under runtime\tools\bin\managedprobe
Close x64dbg/x32dbg. Open PowerShell in the folder containing the downloaded
ZIP, then run the block below. It asks where to keep the MCP bundle and where
x64dbg is already installed; no drive or installation directory is assumed.
Keep the same PowerShell window open for the client-specific commands below.
powershell
$Archive = Get-ChildItem -File .\x64dbg-mcp-windows-.zip |
Sort-Object LastWriteTime -Descending |
Select-Object -First 1
if (-not $Archive) { throw 'The x64dbg MCP release ZIP was not found in this folder.' }
$BundleRoot = Read-Host 'Absolute folder where x64dbg MCP should be extracted'
$X64dbgRoot = Read-Host 'Absolute folder containing the x64 and x32 x64dbg folders'
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/rison1337-x64dbgmcp/)
- Source
- awesome · https://github.com/rison1337/x64dbgMCP
- Browse by field
- MCP servers
- Traction
- 2 ★
- Listed by
- 23 independent sources
- added
- today
- Security policy
- the repository has
SECURITY.mdat its root (we checked that the file exists, not what it says)
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.