symgraph/GhidrAssistMCP

An native MCP server extension for Ghidra

What it solves

GhidrAssistMCP allows AI assistants to interact directly with Ghidra, a professional reverse engineering platform. It solves the problem of manually transferring data between a reverse engineering tool and an AI, by providing a standardized API that lets AI tools read code, analyze functions, and modify the program database in real-time.

How it works

It implements the Model Context Protocol (MCP) as a Ghidra extension. This creates a server that AI clients can connect to via SSE or Streamable HTTP. The extension exposes 49 built-in tools for tasks like decompilation, symbol renaming, and structure recovery, along with static resources for program info and pre-built prompts for common security analysis tasks.

Who it’s for

Reverse engineers and security researchers who want to augment their manual analysis with AI-powered automation and insights within the Ghidra environment.

Highlights

  • Extensive Toolset: 49 tools for binary management, auto-analysis, function discovery, and data analysis.
  • Context Awareness: Automatically tracks which binary window is currently in focus to provide the AI with the correct context.
  • Headless Mode: Can be run via Ghidra's analyzeHeadless launcher for automated, UI-less analysis.
  • Multi-Program Support: Ability to manage and target multiple open binaries simultaneously.
  • Async Task Management: Handles long-running operations like decompilation asynchronously to prevent blocking.