13bm/GhidraMCP

A Ghidra extension that exposes 70 reverse-engineering tools to AI assistants through the Model Context Protocol (MCP). Open a binary in Ghidra, enable the plugin, and let Claude (or any MCP client) decompile functions, rename symbols, annotate code, search for vulnerabilities, and more.
Architecture
The **Ghidra plugin** (Java) starts a TCP server inside Ghidra and auto-launches the **Go bridge** binary. The bridge speaks MCP over stdio to the AI client and forwards calls to the Java plugin over a local TCP socket with 4-byte length-prefixed JSON-RPC framing. Optional API-key authentication protects the TCP channel.
Features
- **70 MCP tools** spanning query, mutation, analysis, malware triage, IoT/embedded security, structure management, async decompilation, and multi-instance support
- **Easy setup** -- plugin auto-starts the bridge; use **MCP > Settings > Write to Claude Config** to configure your MCP client
- **Cross-platform** -- prebuilt bridge binaries for Linux x86_64, Windows x86_64, macOS x86_64 and macOS ARM64
- **Configurable** -- port, localhost-only binding, API-key auth, auto-start, bridge enable/disable via GhidraMCP.properties
- **Multi-instance** -- work with multiple Ghidra windows simultaneously using target_port to route tool calls
- **Async decompilation** -- decompile large functions without blocking; poll for results later
- **Connection retry** -- the bridge reconnects automatically if Ghidra restarts or the connection drops
- **Pagination** -- large result sets (functions, strings, imports, ...) support offset/limit for safe incremental retrieval
- **CI/CD** -- automated builds, Go + Java tests, Ghidra integration tests, and auto-release when a new Ghidra version drops
Quick Start
Prerequisites
- Ghidra 12.0.3+
- Java 21+
- An MCP-compatible AI client (Claude Desktop, Claude Code, etc.)
Install
1. Download the latest release ZIP from Releases
2. In Ghidra: **File > Install Extensions > "+" > select the ZIP**
3. Restart Ghidra
Enable
1. Open a project and a program (binary)
2. **File > Configure > GhidraMCP -- check MCPServerPlugin**
3. The plugin auto-starts the TCP server (default localhost:8765) and launches the bridge
To configure Claude Desktop, open **MCP > Settings** and click **Write to Claude Config**. For other MCP clients, click **Copy to Clipboard** and add this to your client config:
If you have an API key set, include it in the env block (the plugin does this automatically):
You can also grab the snippet from Ghidra: **MCP > Copy MCP Config** (copies it to your clipboard).
Tools
> **Full reference with parameters, types, and examples:** **TOOLS.md**
The tables below give a quick overview. See TOOLS.md for detailed parameter docs.
Query (1-21)
| Tool | Description |
|------|-------------|
| list_functions | List all functions with entry points, sizes, return types |
| list_classes | List all classes / namespaces |
| list_imports | List imported symbols and external dependencies |
| list_exports | List exported symbols |
| list_namespaces | List all namespaces |
| list_data_items | List defined data (globals, constants, arrays, structs) |
| list_strings | List strings with optional substring filter |
| search_functions_by_name | Search functions by name substring |
| get_function_by_address | Detailed info for a function at an address |
| get_current_address | Address currently selected in Ghidra |
| get_current_function | Function at the current cursor position |
| decompile_function | Decompile by name to C pseudocode |
| decompile_function_by_address | Decompile by address to C pseudocode |
| disassemble_function | Raw disassembly listing for a function |
| get_xrefs_to | Cross-references TO an address |
| get_xrefs_from | Cross-references FROM an address |
| get_function_xrefs | All xrefs (callers + callees) for a function |
| get_program_info | Program metadata (arch, compiler, format, etc.) |