clearbluejar/pyghidra-mcp

Python Command-Line Ghidra MCP

What it solves

pyghidra-mcp enables AI agents and LLMs to interact with Ghidra, a powerful software reverse engineering (SRE) suite. It solves the problem of bridging the gap between complex binary analysis tools and the LLM ecosystem, allowing agents to automate deep reverse engineering tasks, perform semantic code searches, and manage Ghidra projects without requiring a human to manually navigate the GUI.

How it works

The project implements a Model Context Protocol (MCP) server that connects Ghidra's Program and FlatProgram APIs to Python via pyghidra and jpype. It offers two primary operating modes:

  • Headless Mode: A CLI-driven approach for automation and CI pipelines.
  • GUI Mode: Launches the Ghidra GUI, allowing the MCP server to share live program state and steer the CodeBrowser in the same JVM.

It uses ChromaDB for vector embeddings to enable semantic search across decompiled functions, comments, and symbols. It supports multiple transport layers, including stdio for local hosts and streamable-http for shared, long-running projects.

Who it’s for

  • Security Researchers: Who want to use AI agents to triage binaries or automate repetitive reverse engineering tasks.
  • Software Engineers: Looking to integrate binary analysis into CI/CD pipelines.
  • AI Agent Developers: Building tools that require deep structural knowledge of compiled binaries.

Highlights

  • Semantic Code Search: Uses vector embeddings for fuzzy lookup of pseudo-C code.
  • Agent-Optimized: Features narrow tool descriptions and focused data returns to minimize token usage.
  • Dual-Mode Operation: Supports both fully headless automation and live GUI synchronization.
  • Batch Operations: Allows decompiling multiple functions or listing cross-references in a single call to reduce LLM round-trips.
  • Flexible Transport: Supports stdio, streamable-http, and SSE for various client needs.

Related

  • Project
    symgraph/GhidrAssistMCP

    A Ghidra extension that implements the Model Context Protocol (MCP), enabling AI assistants to programmatically interact with Ghidra's reverse engineering capabilities.

  • Project
    bethington/ghidra-mcp

    A production‑ready server that exposes Ghidra’s reverse‑engineering engine via the Model Context Protocol (MCP). It provides 253 read/write tools—including decompilation, P‑code emulation, live debugging, and bulk annotation—so AI agents or scripts can control Ghidra headlessly or through HTTP/stdio transports. Features include convention enforcement, cross‑binary documentation propagation, and CI‑friendly Docker deployment.

  • Project
    cyberkaida/reverse-engineering-assistant

    ReVa is a Ghidra MCP server that enables AI models to interact with reverse engineering tools, allowing LLMs to perform deep binary analysis and automation while minimizing hallucinations.

  • Project
    blacktop/ida-mcp-rs

    A headless IDA Pro MCP server that enables AI agents to perform reverse engineering tasks like decompilation and binary analysis.

  • Project
    mrexodia/ida-pro-mcp

    An MCP server that integrates IDA Pro with LLMs, allowing AI assistants to perform reverse engineering tasks like decompilation, renaming, and binary analysis.