GhidraMCP: Revolutionizing Reverse Engineering by Connecting Ghidra to LLMs

ghidraMCP is an Model Context Protocol server for allowing LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients.

Features

MCP Server + Ghidra Plugin

• Decompile and analyze binaries in Ghidra
• Automatically rename methods and data
• List methods, classes, imports, and exports

Installation

First, download the latest release from this repository. This contains the Ghidra plugin and Python MCP client. Then, you can directly import the plugin into Ghidra.

1. Run Ghidra
2. Select File -> Install Extensions
3. Click the + button
4. Select the GhidraMCP-1-2.zip (or your chosen version) from the downloaded release
5. Restart Ghidra
6. Make sure the GhidraMCPPlugin is enabled in File -> Configure -> Developer
7. Optional: Configure the port in Ghidra with Edit -> Tool Options -> GhidraMCP HTTP Server

MCP Clients

Theoretically, any MCP client should work with ghidraMCP. Three examples are given below.

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}