clearbluejar/pyghidra-mcp

What it solves

pyghidra-mcp provides a bridge between the Ghidra software reverse engineering (SRE) suite and the Model Context Protocol (MCP), allowing LLM-based agents and AI tools to programmatically interact with Ghidra's analysis capabilities. It solves the problem of manually performing deep binary analysis by enabling AI agents to query decompiled code, search for symbols, and automate reverse engineering workflows.

How it works

The project uses pyghidra and jpype to connect Python to Ghidra's Java-based ProgramAPI and FlatProgramAPI. It then exposes these functions as MCP tools. The server can run in two primary modes:

• Headless mode: A CLI-driven server for automation and CI/CD pipelines.
• GUI mode: Launches the Ghidra GUI (CodeBrowser) and shares live program state, allowing the AI agent to steer the GUI or the user to see AI-driven changes in real-time.

It also implements semantic code search using vector embeddings via ChromaDB to allow fuzzy lookups across decompiled functions and symbols.

Who it’s for

• Reverse Engineers: Those who want to automate repetitive analysis tasks using LLMs.
• Security Researchers: Professionals performing large-scale binary triage and malware analysis.
• AI Agent Developers: Developers building autonomous agents for software security and vulnerability research.

Highlights

• Dual Operating Modes: Supports both headless automation and live GUI integration.
• Semantic Search: Uses ChromaDB for vector-based fuzzy search of pseudo-C code and symbols.
• Agent-Optimized: Features compact tool descriptions and focused data returns to minimize token usage.
• Flexible Transport: Supports streamable-http (recommended), stdio, and SSE for various MCP host integrations.
• Project-wide Analysis: Enables concurrent reverse engineering of multiple binaries within a single Ghidra project.