ghidra-mcp

Ghidra MCP Server is a Model Context Protocol server that exposes 249 tools for AI-assisted reverse engineering by bridging Claude and other MCP-compatible clients directly into Ghidra 12.1. It operates in both GUI plugin and headless modes, supports Docker deployment for CI/CD pipelines, and connects to shared Ghidra Server repositories with checkout/checkin version control workflows. Tools cover the full spectrum of reverse engineering tasks: renaming symbols, applying types, adding comments, creating data structures, executing Ghidra scripts, running P-code emulation, and integrating with live debuggers. A standout feature is cross-binary documentation transfer using SHA-256 function hashing, which automatically propagates existing annotations to new binary versions without manual re-labeling. Version 5.0 adds convention enforcement directly at the tool layer, auto-fixing Hungarian notation prefixes, warning on naming violations, and rejecting no-op type changes, so AI agents produce consistent output across sessions without needing style instructions in every prompt. Security researchers, malware analysts, and reverse engineering teams benefit most.

What people ask about ghidra-mcp