AgentSmithers/x64DbgMCPServer

What it is

X64Dbg MCP Server is a C# plugin for the Windows‑only debuggers x64dbg / x96 / x32dbg. It runs a tiny built‑in HTTP server that speaks the Model Context Protocol (MCP) – a simple text/JSON‑over‑HTTP interface used by LLM‑based tools (Claude, Gemini, etc.). The server translates incoming MCP commands into x64dbg API calls so an AI client can inspect memory, registers, disassemble code, set comments/labels, control threads, etc., without the user manually typing debugger commands.

Why it matters

Reverse‑engineering and binary analysis are traditionally very manual. By exposing the debugger through MCP, you can let a large language model drive the analysis: it can ask the debugger to dump a module, set a breakpoint, or label a function, then use the returned JSON to decide the next step. This makes it possible to build AI‑assisted RE workflows, automate repetitive tasks, and integrate the debugger into larger security‑automation pipelines.

How it works (high‑level)

1. Plugin loading – The compiled DLL (x64DbgMCPServer.dp64) is placed in the x64dbg plugins folder. When the user selects Start MCP Server from the plugin menu, the plugin is loaded.
2. Self‑hosted HTTP listener – A lightweight HttpListener (no ASP.NET Core) binds to http://*:50300/sse (or message). It receives MCP requests, which are simple HTTP POSTs containing a command name and parameters.
3. Command dispatch – Methods in the code are marked with a [Command] attribute. The listener reflects over these methods, matches the incoming command name, parses parameters, executes the corresponding x64dbg API call (e.g., read memory, get registers), and returns the result as JSON or plain text.
4. AI client side – An external MCP client (e.g., the provided mcp-csharp-sdk-client or Claude’s MCPProxy STDIO‑to‑SSE bridge) sends prompts to the server. The server’s responses can be fed back to the LLM, enabling a loop where the model decides the next debugger action.

Who might use it

• Security researchers who want to prototype AI‑driven reverse‑engineering scripts.
• Red‑team/blue‑team engineers looking to automate repetitive debugging tasks (e.g., locating speed‑hack checks, extracting module lists).
• Tool builders who need a programmatic bridge between an LLM and a native debugger without writing a full‑blown RPC layer.

Getting started (quick steps)

1. Prerequisites – Visual Studio Build Tools 2019+, .NET Framework 4.7.2, and the DllExport utility.
2. Build – Clone the repo, run DllExport.bat to enable the native export, open the .sln, and build. Rename the output DLL to *.dp64.
3. Install – Copy the built plugin into x64dbg\release\x64\plugins\x64DbgMCPServer.
4. Run – Launch x64dbg, open Plugins → Start MCP Server.
5. Grant HTTP rights (if not running as admin):

   netsh http add urlacl url=http://+:50300/sse/ user=Everyone
   

6. Connect a client – Use the supplied C# sample client or Claude’s MCPProxy bridge, pointing it at http://127.0.0.1:50300/sse.
7. Issue commands – Send JSON commands like ReadMemAtAddress, GetAllRegisters, etc.; the server returns JSON suitable for LLM consumption.

Limitations & open work

• Not every debugger command is wrapped yet; the author is adding full stack/thread/module dumps.
• The default listener binds to all interfaces, requiring admin rights; future versions aim to bind only to localhost.
• Some commands (e.g., ExecuteDebuggerCommand) currently always return true regardless of actual success.
• Only Windows is supported because it relies on the .NET Framework and x64dbg’s native plugin model.

---

All information above is taken directly from the repository’s README.