duty1g/x64dbg-mcp-server

x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more. Built with Zig — zero dependencies, single-binary output, cros

What it solves

This project provides a way to connect AI assistants to the x64dbg debugger, allowing them to perform reverse engineering tasks programmatically. It eliminates the need for a human to manually interact with the debugger's UI, enabling an AI agent to control the debugger, analyze code, and inspect memory directly.

How it works

It is a native plugin for x64dbg written in Zig. It resolves the debugger's API symbols at runtime and starts an HTTP server on a background thread. AI assistants (MCP clients) connect via HTTP or SSE, sending JSON-RPC requests that the plugin translates into direct x64dbg SDK calls to control the debugger.

Who it’s for

Security researchers, malware analysts, and reverse engineers who want to use AI agents to automate and accelerate their analysis workflow in x64dbg.

Highlights

  • Extensive Toolset: Includes 84 MCP tools for full debugger control, including disassembly, breakpoints, memory allocation, and PE analysis.
  • Zero Dependencies: Built with Zig as a single binary plugin with no need for .NET or Python runtimes.
  • Dual Transport: Supports both streamable HTTP and SSE for compatibility with various MCP clients.
  • Secure Access: Enforces mandatory Bearer token authentication to prevent unauthorized access to the debugger.
  • Cross-Platform Build: Can be cross-compiled to both x32 and x64 architectures from Linux, macOS, or WSL.

Related

  • Project
    SetsunaYukiOvO/x64dbg-mcp

    An MCP server plugin for x64dbg and x32dbg that enables AI agents to programmatically control the debugger and perform reverse engineering tasks.

  • Project
    zhizhuodemao/js-reverse-mcp

    js‑reverse‑mcp is a Node.js MCP server that lets LLM agents debug and reverse‑engineer JavaScript in Chrome. It wraps DevTools data (scripts, breakpoints, network, WebSocket, storage) into 24 concise tools designed for AI‑driven reasoning, and includes optional stealth layers (Patchright fork and CloakBrowser) for anti‑bot sites.

  • Project
    microsoft/DebugMCP

    An MCP server that gives AI coding agents autonomous control over the VS Code debugger to set breakpoints, step through code, and inspect variables.

  • Project
    badchars/darknet-mcp-server

    darknet‑mcp‑server is a self‑hosted MCP server that wraps 66 security‑tool APIs (HIBP, ThreatFox, ransomware trackers, Tor onion search, blockchain intel, etc.) into a single endpoint. AI agents can call these tools conversationally to get breach, ransomware, dark‑web, malware and IP reputation data in one unified response, dramatically reducing the manual, multi‑tab workflow of traditional investigations.

  • Project
    svnscha/mcp-windbg

    An MCP server that connects AI models to WinDbg (CDB/KD), enabling natural language crash dump analysis and live kernel/user-mode debugging on Windows.