Ghidra MCP Server – AI-Powered Reverse Engineering

TL;DR

TL;DR: Ghidra MCP Server bridges Ghidra’s reverse engineering engine with any MCP-compatible AI assistant, giving you 256 tools for decompilation, P-code emulation, live debugging, and automated binary analysis — all through a production-ready Model Context Protocol server.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: github.com/bethington/ghidra-mcp
• License: Apache-2.0 (verified via GitHub API license.spdx_id)
• Topics: ai, binary-analysis, ghidra, mcp-server, reverse-engineering
• HN launch thread: not confirmed — repo shows active development, last commit recent
• Source last checked: 2026-07-07 (commit verified via GitHub API)

What Is Ghidra MCP Server?

Ghidra is NSA’s open-source reverse engineering framework. It decompiles binaries, analyzes P-code, and can debug live processes — but using it has always required manual interaction. Ghidra MCP Server changes that by exposing every major Ghidra operation as an MCP tool, so AI agents can drive the analysis.

The project was built by a reverse engineer who uses it daily on real binaries, not as a demo. That practicality shows in the tool count: 256 MCP tools, covering read operations, write operations, script execution, P-code emulation, and live debugging.

Setup Workflow

Prerequisites

• Python 3.10–3.13
• Java 21 (OpenJDK or Oracle)
• Ghidra 12.1.2 or later
• An MCP-compatible AI assistant (Claude, Copilot, etc.)

Step 1: Clone and Install

git clone https://github.com/bethington/ghidra-mcp.git
cd ghidra-mcp

Step 2: Add to Your MCP Client

For Claude Code:

claude mcp add ghidra -- \
  python scripts/start_rpc_server.py

For other MCP-compatible AI tools, add this server entry to your MCP configuration file:

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": ["/path/to/ghidra-mcp/scripts/start_rpc_server.py"]
    }
  }
}

Step 3: Verify the Connection

# Run the built-in test script to confirm Ghidra loads correctly
python scripts/test_server.py

Deeper Analysis

256 Tools, Not a Handful

Most Ghidra MCP implementations give you five or six read-only tools. This server covers every meaningful Ghidra operation:

• Decompilation & Function Analysis — decompile_function, get_function_pcode, analyze_function_completeness
• Data Structure Discovery — create structs, unions, and enums; get naming suggestions
• String Extraction — regex search with quality filtering
• Live Debugging — 17 Java endpoints + 22 Python bridge tools over Ghidra’s TraceRmi framework
• P-code Emulation — run any function in isolation via Ghidra’s EmulatorHelper
• Script Management — create, run, update, and delete Ghidra scripts entirely via MCP
• Cross-Binary Documentation — SHA-256 function hash matching propagates comments across binary versions

Convention Enforcement

v5.0 introduces a three-tier convention enforcement system baked into the tool layer:

| Tier | Behavior | |------|----------| | Auto-fix | Applied silently | | Warn | Change goes through, warning returned | | Reject | Change blocked with explanation |

This means AI agents and human engineers produce consistent output without pasting a style guide into every prompt.

Batch Operations

Bulk renaming, commenting, typing, and label management with 93% fewer API calls. For documenting a 500-function binary, this matters.

Practical Evaluation Checklist

• [ ] Ghidra 12.1.2 or later installed and on PATH
• [ ] Java 21 available (java -version)
• [ ] test_server.py runs without errors
• [ ] AI assistant connects and lists available tools
• [ ] Decompile a known binary — results match Ghidra GUI output
• [ ] Run a function documentation workflow end-to-end

Security Notes

• The server exposes write operations (renaming, commenting, structure creation) — restrict access to trusted environments
• API tokens and Zabbix credentials are passed via environment variables, not command-line arguments
• No authentication layer ships with the MCP server itself — depends on the host AI tool’s auth model

FAQ

Q: Does this work with Ghidra without a GUI? A: Yes. The server supports headless mode and ships with Docker support for CI/CD pipelines.

Q: Can I use this with GitHub Copilot? A: Yes. MCP tool names are normalized for GitHub Copilot CLI compatibility.

Q: How is this different from the Ghidra MCP Server that has 110 tools? A: That project (a separate Ghidra MCP Server with ~110 tools) covers read operations. This one (bethington/ghidra-mcp) adds write operations, P-code emulation, live debugging, convention enforcement, and batch processing — 256 tools total.

Q: Does it work with Ghidra Server for multi-user collaboration? A: Yes. The server integrates with shared Ghidra servers for checkout/checkin workflows and multi-user analysis.

Conclusion

Ghidra MCP Server is the most complete MCP integration Ghidra has received. 256 tools covering read, write, emulation, debugging, and batch operations make it viable for real reverse engineering workflows — not just demos. If you regularly analyze binaries with AI, this is the bridge between a capable model and Ghidra’s full engine.