Server facts
ghidraMCP MCP Server
Project
- Author
- LaurieWired
- Repository
- github.com/LaurieWired/GhidraMCP
- License
- Apache-2.0
- Category
- Security & Reverse Engineering
Tech
- Runtime / language
- javaJava and Python
- Transports
- stdio
- Remote available
- No
- Authentication
- Not specified
Activity
- GitHub stars
- 11,310
- Last commit
- Data as of
Tags
- Binary Analysis
- Decompilation
- Ghidra
- Reverse Engineering
Overview
ghidraMCP exposes Ghidra functionality to language-model clients for reverse-engineering applications. It combines a Ghidra plugin with an MCP bridge, giving assistants access to decompilation and binary analysis alongside changes to method and data names. The feature list also includes browsing methods, classes, imports, and exports. This places it within an existing Ghidra workflow: the analysis application remains central, while the MCP connection lets a compatible assistant request information and perform supported changes. The supplied README describes these capabilities at a feature level but does not list their individual MCP tool identifiers.
Installation begins with a release archive containing the plugin and Python client components. Users import the extension through Ghidra's extension manager, restart Ghidra, and enable the plugin in the Developer configuration. Python 3 and the MCP Python SDK are prerequisites for the bridge. A Claude Desktop example launches that bridge as a local process and points it to the Ghidra HTTP server, which defaults to localhost on port 8080. A separate example starts the bridge in SSE mode for Cline, with its own MCP listening port. The Ghidra target address and listening settings are configurable. For source builds, the README requires copying several JAR files from an existing Ghidra installation into the project before packaging it with Maven.
Install & configure
Requirements
- Ghidra
- Python 3
- MCP Python SDK
- The installed and enabled GhidraMCP plugin
- The Python bridge from a project release
python /ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py --ghidra-server http://127.0.0.1:8080/Replace the README’s absolute-path placeholder with the bridge location. The HTTP URL is the bridge’s Ghidra backend, not a remote MCP endpoint. Cline can instead use the documented SSE bridge mode.
Examples are translated from the published configuration. Supply your own credentials and verify requirements in the upstream README. Remote connectors are shown only where a supported configuration format is known.
Config file · macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Use Settings → Developer → Edit Config when available. Do not assume a Linux configuration path; check the client documentation for your platform. Remote servers use the app’s connector flow when supported, not the local stdio file shown here. Merge this example with existing settings; do not overwrite unrelated servers.
{
"mcpServers": {
"GhidraMCP": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
"--ghidra-server",
"http://127.0.0.1:8080/"
],
"env": {}
}
}
}Config file · Project: .cursor/mcp.json
User: ~/.cursor/mcp.json
The project path is relative to the workspace root. The tilde denotes your user home directory. Use Cursor’s MCP settings to confirm which configuration and scope your installed version is reading. Merge this example with existing settings; do not overwrite unrelated servers.
{
"mcpServers": {
"GhidraMCP": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
"--ghidra-server",
"http://127.0.0.1:8080/"
],
"env": {}
}
}
}Config file · Workspace: .vscode/mcp.json
For user scope, use the “MCP: Open User Configuration” command if available. Do not guess a user configuration path across operating systems, profiles, containers, or remote workspaces; check the client documentation. Merge this example with existing settings; do not overwrite unrelated servers.
{
"servers": {
"GhidraMCP": {
"type": "stdio",
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
"--ghidra-server",
"http://127.0.0.1:8080/"
],
"env": {}
}
}
}Config file · macOS/Linux: ~/.codeium/windsurf/mcp_config.json
Windows: %USERPROFILE%\.codeium\windsurf\mcp_config.json
Open the MCP configuration through Windsurf’s settings when possible to confirm the active file. Paths can differ in managed or future releases; check the client documentation if this location is not present. Merge this example with existing settings; do not overwrite unrelated servers.
{
"mcpServers": {
"GhidraMCP": {
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
"--ghidra-server",
"http://127.0.0.1:8080/"
],
"env": {}
}
}
}Config file · Project scope: .mcp.json at the repository root
The project file uses mcpServers. For user scope, use claude mcp add --scope user rather than assuming .mcp.json in your home directory is the user configuration. Check the client documentation for managed settings and storage details. Merge this example with existing settings; do not overwrite unrelated servers.
{
"mcpServers": {
"GhidraMCP": {
"type": "stdio",
"command": "python",
"args": [
"/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
"--ghidra-server",
"http://127.0.0.1:8080/"
],
"env": {}
}
}
}Examples are translated from the published configuration. Supply your own credentials and verify requirements in the upstream README. Remote connectors are shown only where a supported configuration format is known.
Tools
No individual tool names were confirmed in the source material. Check the repository for its current tool list.
Names, permissions, and defaults can change. Check the current upstream documentation before granting access.
Use cases
- Ask an assistant to decompile and inspect binaries in Ghidra.
- Rename methods and data during reverse-engineering analysis.
- Browse program methods, classes, imports, and exports.
- Connect a running Ghidra instance to Claude Desktop or Cline.
Strengths
- Combines analysis access with method and data renaming.
- Documents local-process and SSE client configurations.
- Release archives include both the plugin and Python bridge components.
Limitations
- Requires Ghidra extension installation, restart, and plugin enablement.
- Building from source requires Ghidra JAR files and Maven packaging.
- Individual MCP tool identifiers are Not stated in the README.
Frequently asked questions
Independent listing, not an affiliation or security review. Grant the least access needed and verify the upstream instructions before running code.
