GhidraMCP connects Ghidra, a software reverse-engineering suite, to Model Context Protocol (MCP) clients so that a language model can drive the analysis of a binary. It has two parts: a Ghidra plugin that exposes core Ghidra functionality over a local HTTP server, and a Python bridge that presents those operations to an MCP client as tools.
The plugin runs inside Ghidra and listens on a host and port set in the tool options. The bridge points at that address and speaks stdio or server-sent events, so clients such as Claude Desktop, Cline, and 5ire attach to the same running Ghidra instance.
Features
- Decompilation and analysis: an MCP client can decompile and analyze the binaries loaded in Ghidra
- Symbol renaming: methods and data are renamed from the client side
- Program listings: methods, classes, imports, and exports are listed on request
- Configurable endpoint: the plugin's HTTP host and port are set in Ghidra's tool options
- Transport choice: the bridge runs over stdio or server-sent events to suit different clients
