duty1g/x64dbg-mcp-server

x64dbg‑MCP Server – AI‑enabled reverse‑engineering bridge

What it is

• A native plugin for the Windows debugger x64dbg that implements the Model Context Protocol (MCP). It runs inside the debugger and exposes the full set of x64dbg commands over an HTTP/JSON‑RPC interface.
• The server can be driven by any MCP‑compatible AI assistant (e.g., a large‑language‑model‑based agent) to perform typical reverse‑engineering tasks: load a binary, set breakpoints, step, read memory, dump registers, etc.

Why it matters

• By turning the debugger into a remote, programmatic service, the plugin lets an LLM act as an agentic reverse‑engineering partner. The AI can issue high‑level instructions ("load calc.exe and break at the entry point") and the plugin translates them into concrete debugger actions.
• The implementation is zero‑dependency and compiled with Zig, producing a single binary (.dp32/.dp64) that can be dropped into the x64dbg plugins folder. No extra runtimes (Python, .NET) are required.

Key features

Feature	What it gives you
71 MCP tools	Complete coverage of x64dbg functionality – disassembly, stepping, breakpoints, memory allocation, register access, PE analysis, pattern scanning, etc.
22 event callbacks	Real‑time notifications for debugger events (breakpoint hit, exception, DLL load, thread creation, etc.).
Dual transport	HTTP (streamable) and Server‑Sent Events (SSE) – works with both new and legacy MCP clients.
Bearer‑token auth	A token is auto‑generated on first run; every request must include Authorization: Bearer <token> to prevent unauthorized use.
Cross‑compile	One Zig codebase builds both x86 (x32) and x64 plugins from any host OS (Windows, Linux, macOS, WSL).
Auto‑start & config UI	The server starts when x64dbg launches; a simple dialog lets you change bind address, port, and token.

How it works

1. The plugin loads into x64dbg and resolves the debugger’s SDK symbols at runtime.
2. It spawns a background HTTP server (default ports 9094 for x64, 9095 for x32).
3. An MCP client sends JSON‑RPC requests (e.g., LoadBinary, SetBreakpoint, ReadMemory).
4. The server maps each request to the corresponding x64dbg SDK call and returns the result.
5. Event callbacks can push notifications to the client via SSE, enabling reactive AI workflows.

Typical AI‑driven workflow

You: Load calc.exe and break at the entry point
AI → calls LoadBinary → SetBreakpoint → run → WaitForPause

You: Show me the registers
AI → calls GetAllRegisters

You: Read 64 bytes at the current IP
AI → calls ReadMemory

The AI can iteratively query state, adjust breakpoints, and even automate complex analysis (e.g., pattern scans, PE dumping) without manual UI interaction.

Installation & usage

• Download the latest release, copy the dist/ folder contents into the x64dbg root (plugins are placed in plugins/).
• The server starts automatically; configure IP/port/token via Plugins → x64dbg‑MCP Server → Configure MCP Server….
• Add the server to an MCP client configuration (JSON) with the appropriate Authorization header.

Building

# Requires Zig 0.16‑dev or later
zig build -Doptimize=ReleaseSafe --prefix dist

The build produces the two plugin binaries (.dp32 and .dp64).

Safety note The server gives full debugger control over the network, so it should only be exposed on trusted interfaces. Authentication is mandatory, but communication is unencrypted HTTP; avoid exposing it to untrusted networks.

---

License: MIT – free to use, modify, and redistribute.