rison1337/x64dbgMCP

x64dbg MCP gives an MCP client guarded control of a real
x64dbg or x32dbg session. It turns live debugging into a
replayable reverse-engineering workflow: bind the exact process, observe
runtime facts, recover useful artifacts, validate them independently, and hand
the evidence to IDA.
### What it does
Launches or attaches with arguments, working directory, environment and
child-process policy.
Reads and changes registers, memory, threads, modules and owned breakpoints.
Captures instruction, API, heap, exception and basic-block evidence.
Finds comparison values, runtime strings, indirect calls, OEPs and imports.
Produces memory PE dumps, minidumps, fixed imports and patched exports.
Exchanges runtime facts with IDA using a portable file SHA-256 + module RVA
identity instead of unstable runtime addresses.
### Tool groups
| Workflow | Representative tools | Result |
| Launch and bind | InitDebuggee, AttachToProcess, LaunchFileUnderDebugger, WaitForBreakpoint | Reproducible process and session identity |
| Live control | RegisterGet, RegisterSet, MemoryRead, MemoryWrite, DebugSetBreakpoint, SetHardwareBreakpoint | Controlled execution, memory and breakpoint changes |
| Runtime evidence | RunNativeTrace, GetNativeTrace, StartApiTrace, StartHeapTrace, GetBasicBlockCoverage, WaitForBreakpointCapture | Instruction paths, API/heap calls, exceptions and executed blocks |
| Key and unpack recovery | SearchStrings, ScanMemoryStrings, PatternFindMem, FindOEP, RunUntilOEP, FindIATCandidates, InspectRuntimeIAT | Comparisons, strings, OEP and runtime import candidates |
| Dump and repair | WriteMiniDump, DumpModuleRaw, DumpPeFromMemory, ScanMemoryForPEImages, FixDumpImports, ValidateDump, ExportPatchedFile | Replayable dumps and independently checked PE artifacts |
| IDA evidence handoff | ExportRuntimeEvidence, ImportStaticAnnotations, SyncBreakpoints, ResolveModuleRva | Hash/RVA-addressed comments, labels, coverage and API facts |
The complete catalog, parameters and response contracts are in the
tool reference. The compact profile keeps routine
model-facing responses short; detail="full" and the full profile expose
the complete evidence when it is needed.
### Quick setup
Download the combined Windows bundle from
Releases. It contains both
native plugins and the Python backend:
plugins\MCPx64dbg.dp64 for x64dbg
plugins\MCPx64dbg.dp32 for x32dbg
runtime\src and runtime\requirements.txt
self-contained x64/x86 managed-runtime probes under runtime\tools\bin\managedprobe
Close x64dbg/x32dbg. Open PowerShell in the folder containing the downloaded
ZIP, then run the block below. It asks where to keep the MCP bundle and where
x64dbg is already installed; no drive or installation directory is assumed.
Keep the same PowerShell window open for the client-specific commands below.
powershell
$Archive = Get-ChildItem -File .\x64dbg-mcp-windows-.zip |
Sort-Object LastWriteTime -Descending |
Select-Object -First 1
if (-not $Archive) { throw 'The x64dbg MCP release ZIP was not found in this folder.' }
$BundleRoot = Read-Host 'Absolute folder where x64dbg MCP should be extracted'
$X64dbgRoot = Read-Host 'Absolute folder containing the x64 and x32 x64dbg folders'