Connect

Ghidra

LaurieWiredbyLaurieWired
•
12k
•
Developer Tools
Other
Security & Testing
Featured

Enables Large Language Models (LLMs) to autonomously reverse engineer applications by exposing Ghidra's core functionality through an Model Context Protocol (MCP) server.

Ghidra facilitates autonomous reverse engineering of applications by LLMs. It serves as an MCP server, granting client access to a wide range of Ghidra functionalities. This includes decompiling and analyzing binaries, automatically renaming methods and data, and listing methods, classes, imports, and exports, effectively bridging the gap between Ghidra's powerful reverse engineering capabilities and the analytical prowess of LLMs.

Key Features

012,450 GitHub stars
02MCP Server + Ghidra Plugin.
03Decompiles and analyzes binaries using Ghidra.
04Automatically renames methods and data.
05Lists methods, classes, imports, and exports.

Use Cases

01Automated vulnerability analysis using LLMs.
02Reverse engineering of malware samples with AI assistance.
03Automated code understanding and documentation generation.

License GitHub release (latest by date) GitHub stars GitHub forks GitHub contributors Follow @lauriewired

ghidra_MCP_logo

ghidraMCP

ghidraMCP is an Model Context Protocol server for allowing LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients.

ghidraMCP_demo.mp4

Features

MCP Server + Ghidra Plugin

  • Decompile and analyze binaries in Ghidra
  • Automatically rename methods and data
  • List methods, classes, imports, and exports

Installation

Prerequisites

Ghidra

First, download the latest release from this repository. This contains the Ghidra plugin and Python MCP client. Then, you can directly import the plugin into Ghidra.

  1. Run Ghidra
  2. Select File -> Install Extensions
  3. Click the + button
  4. Select the GhidraMCP-1-0.zip (or your chosen version) from the downloaded release
  5. Restart Ghidra
  6. Make sure the GhidraMCPPlugin is enabled in File -> Configure -> Developer

Video Installation Guide:

ghidra_MCP_Install.mp4

MCP Clients

Theoretically, any MCP client should work with ghidraMCP. Two examples are given below.

Example 1: Claude Desktop

To set up Claude Desktop as a Ghidra MCP client, go to Claude -> Settings -> Developer -> Edit Config -> claude_desktop_config.json and add the following:

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py"
      ]
    }
  }
}

Alternatively, edit this file directly:

/Users/YOUR_USER/Library/Application Support/Claude/claude_desktop_config.json

Example 2: 5ire

Another MCP client that supports multiple models on the backend is 5ire. To set up GhidraMCP, open 5ire and go to Tools -> New and set the following configurations:

  1. Tool Key: ghidra
  2. Name: GhidraMCP
  3. Command: python /ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py

Building from Source

Build with Maven by running:

mvn clean package assembly:single

The generated zip file includes the built Ghidra plugin and its resources. These files are required for Ghidra to recognize the new extension.

  • lib/GhidraMCP.jar
  • extensions.properties
  • Module.manifest