Ghidra MCP Server exposes Ghidra's reverse-engineering engine to AI agents and automation over the Model Context Protocol (MCP). It has three parts: a Ghidra plugin that serves analysis operations over HTTP from the GUI, a standalone headless server for Docker, CI, and large-scale automated analysis without a GUI, and a Python bridge that translates MCP calls (stdio or streamable HTTP transport) into those HTTP endpoints. The catalog holds 209 tools, most of which are served by both the plugin and the headless server.
The tools go beyond reading: an agent can decompile and rename functions, set prototypes and variable types, create structs, unions, and enums, write comments and labels, run Ghidra analyzers, execute Ghidra scripts (opt-in), and work with multiple open programs. Batch variants rename, comment, and type in bulk inside atomic transactions. Dynamic analysis adds P-code emulation of a single function (used, for example, to brute-force API hash resolution) and a live debugger integration over Ghidra's TraceRmi framework with stepping, breakpoints, registers, memory reads, and ASLR-aware address translation.
Naming conventions and type rules are enforced in the tool layer rather than in prompts. A write is auto-fixed (a field prefix added on save), allowed with a warning (a function name that is not PascalCase with a verb), or rejected (a no-op type change), so output stays consistent across sessions and models. A completeness score from 0 to 100% reports how fully a function is documented, and a seven-step documentation workflow with Hungarian notation and verification is included for agents.
Documentation transfers between binaries: normalized opcode hashes and fuzzy matching find the same function across versions, and a bulk merge copies names, signatures, and comments from one program to another at matching addresses. Ghidra Server integration covers repositories, checkout and checkin, and version control for shared projects.
Because the full tool list is too large for some providers (the Gemini API rejects a request that declares all 209 tools), the bridge loads the listing, function, and program groups on connect and registers the rest on demand, with search, list, load, and unload tools for discovering the remaining groups. A strict program-routing mode makes every program-scoped call name its target when several binaries are open, and a four-tool read-only allowlist is documented for clients that gate tools. The server binds to loopback with no authentication by default and refuses a non-loopback bind without a bearer token.
Features
- 209 MCP tools: decompilation, call graphs, cross-references, symbols, data types, comments, strings, imports and exports, memory inspection, and analyzer control, with write access rather than read-only
- GUI plugin and headless server: the same tool catalog runs inside the Ghidra GUI or as a standalone server for Docker and CI, 186 tools served by both
- Convention enforcement: naming and type rules applied at write time in three tiers (auto-fix, warn, reject), plus a 0 to 100% completeness score per function
- Batch operations: bulk renaming, commenting, typing, and label management inside atomic transactions, cutting API calls by 93%
- P-code emulation: run a function in isolation with controlled register and memory inputs, including brute-force API hash resolution
- Live debugger: launch, step, breakpoints, registers, memory, and stack traces over Ghidra's TraceRmi framework, with static-to-dynamic address translation
- Data flow analysis: forward and backward PCode-graph value propagation from any variable or register
- Cross-binary documentation: opcode-hash and fuzzy function matching propagates names, signatures, and comments across binary versions
- Malware analysis: API call chain analysis, crypto constant detection, behavior detection, IOC extraction, and anti-analysis technique discovery
- Ghidra Server integration: repositories, checkout and checkin, version control, and multi-user projects
- Lazy tool loading: a core subset loads on connect and the rest registers on demand through search, list, load, and unload tools, keeping the schema inside provider limits
- Security controls: loopback-only by default, bearer-token requirement for non-loopback binds, opt-in script execution, and a filesystem root that blocks path traversal
