bethington/ghidra-mcp

What it solves

This project provides a production-ready bridge between Ghidra, a powerful reverse engineering tool, and modern AI agents. It solves the problem of limited AI integration in binary analysis by providing a comprehensive set of tools that allow AI models to read, write, and interact with Ghidra's analysis engine, debugger, and emulator in real-time.

How it works

The project implements the Model Context Protocol (MCP), allowing AI clients (like Claude or Cursor) to communicate with Ghidra. It consists of a Java-based extension for Ghidra and a Python-based bridge. The system provides over 250 tools for tasks such as decompilation, renaming variables, creating data structures, and running P-code emulation. It also enforces naming conventions and documentation standards directly at the tool layer to ensure consistent output from AI agents.

Who it’s for

Reverse engineers, security researchers, and developers who use Ghidra for binary analysis and want to leverage AI to automate documentation, data structure discovery, and dynamic analysis.

Highlights

• Massive Toolset: Includes 253 MCP tools covering read/write operations, P-code emulation, and live debugger integration.
• Convention Enforcement: Automatically fixes or warns about naming conventions (e.g., PascalCase for verbs) to ensure AI-generated labels are consistent.
• Cross-Binary Documentation: Uses SHA-256 function hash matching to propagate documentation from one binary version to another.
• Dynamic Analysis: Integration with Ghidra's TraceRmi framework for breakpoints, register reads, and non-breaking function tracing.
• Production Grade: Supports atomic transactions, batch operations to reduce API calls, and headless mode for CI/CD pipelines.