Ghidra MCP (pyghidra-mcp and GhidraMCP)

What our test produced

How it works

1. 1

   Ghidra does the analysis

   Both servers start Ghidra's analysis engine through PyGhidra, import the binary, run the normal auto-analysis and then answer the agent's questions from the analysed program: functions, strings, imports, exports, cross-references, decompiled C, disassembly and raw bytes.

2. 2

   pyghidra-mcp: headless first, whole projects

   It serves every binary in a Ghidra project at once, can start answering while analysis continues in the background, and indexes decompiled code and strings in ChromaDB so the agent can search by meaning. It runs over stdio or streamable HTTP, and --gui launches Ghidra with the same project open.

3. 3

   GhidraMCP: the GUI plugin, now also headless

   The original mode is a Ghidra extension that serves the open CodeBrowser on port 8080 and a small Python bridge that the agent talks to, so you and the agent work on the same window. Version 2.0 adds --headless, which loads the extension's jar into PyGhidra and needs no window.

Set it up

1. 1
   Ghidra and Java (both servers)

   # Download ghidra_12.1.4_PUBLIC from github.com/NationalSecurityAgency/ghidra/releases
   # Install Java 21, for example: brew install openjdk@21
   export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.1.4_PUBLIC
   # macOS only, once:
   cd "$GHIDRA_INSTALL_DIR/support/gradle" && ./gradlew buildNatives

   Copy

   On macOS the release has no decompiler for your machine, so decompiling fails until buildNatives has run (we copied its output from build/os/mac_arm_64 into the os/mac_arm_64 folders). Keep the Ghidra project folder out of any path with a folder that starts with a dot: Ghidra refused one, and pyghidra-mcp would not start.

2. 2
   pyghidra-mcp in Claude Code

   claude mcp add pyghidra-mcp \
     -e GHIDRA_INSTALL_DIR=/path/to/ghidra_12.1.4_PUBLIC \
     -- uvx pyghidra-mcp --project-path /path/to/ghidra-projects /path/to/binary

   Copy

   stdio is the default and is how we ran it. The README recommends a long-running HTTP server for larger work: uvx pyghidra-mcp --transport streamable-http ... and then add http://127.0.0.1:8000/mcp to your client.

3. 3
   GhidraMCP headless in Claude Code

   claude mcp add ghidra \
     -e GHIDRA_INSTALL_DIR=/path/to/ghidra_12.1.4_PUBLIC \
     -- uvx --python 3.13 --from "ghidra-mcp[headless] @ git+https://github.com/LaurieWired/GhidraMCP" \
     ghidra-mcp --headless --binary /path/to/binary --project /path/to/ghidra-projects

   Copy

   Headless needs the GhidraMCP extension installed in Ghidra, or --extension-jar pointing at GhidraMCP.jar from the release, and Python 3.10 to 3.13. --project keeps the analysis and the agent's renames between runs.

4. 4
   GhidraMCP with the Ghidra window

   claude mcp add ghidra -- uvx --from git+https://github.com/LaurieWired/GhidraMCP \
     ghidra-mcp --ghidra-server http://127.0.0.1:8080/

   Copy

   First install the release zip in Ghidra with File, Install Extensions, restart, and enable GhidraMCPPlugin under File, Configure, Developer. Open your binary in the CodeBrowser before you ask the agent. We did not test this mode.

What it can access

• Files: each server imports the binaries you name into a Ghidra project folder you choose, and the agent can rename, retype and comment inside that project. Neither server ran the binary in our test.
• Disk: Ghidra itself is about 1.4 GB unpacked. pyghidra-mcp adds a project-name-pyghidra-mcp folder beside the project with a ChromaDB index and saved analyses, and downloads a 167 MB embedding model into ~/.cache/chroma on first use.
• Network: pyghidra-mcp fetches that model once; uvx downloads the Python packages once. The analysis itself is local.
• Ports: in headless stdio mode neither opens a port. GUI GhidraMCP serves the Ghidra plugin on 127.0.0.1:8080, and pyghidra-mcp's recommended HTTP mode listens on 127.0.0.1:8000.
• Accounts and money: none. Ghidra and both servers are free and need no login or API key.

Reference

Our test

Ghidra is the free reverse engineering suite from the NSA. Two popular open-source MCP servers let an AI agent use it: pyghidra-mcp by clearbluejar, built to run without the Ghidra window, and GhidraMCP by LaurieWired, the best-known one, which started as a plugin for the open Ghidra window and now also runs headless. Both are Apache-2.0 and need Ghidra 12.1.4 and Java 21. We gave Claude Code the same stripped macOS binary that asks for a password and ran each server headless. Both found the password, tidepool-41, without running the program: pyghidra-mcp in 7 turns, 32 seconds and $0.16 at API prices, GhidraMCP in 8 turns, 25 seconds and $0.18. The work was in setup: on macOS, Ghidra's release has no decompiler for Apple's chips until you build it, and pyghidra-mcp downloads a 167 MB search model on first run.

list_project_binaries → /crackme-5f9f35, analysis_complete: true, code_indexed: true
search_strings({ query: "" })      → usage: %s <password>, Access granted, Access denied, …
list_exports                       → entry @ 1000004b0
decompile_function({ name_or_address: "entry", include_callees: true })
read_bytes({ address: "1000005c7", size: 11 }) → "2e323c3c2e3033317f6761"

if (sVar3 == 0xb) {
  lVar5 = 0;
  do {
    uVar1 = (uint)(byte)pcVar6[lVar5] ^ (uint)lVar5 & 0xff ^ (uint)(byte)(&DAT_1000005c7)[lVar5];
    bVar2 = lVar5 != 10;
    lVar5 = lVar5 + 1;
  } while (uVar1 == 0x5a && bVar2);
  if (uVar1 == 0x5a) { _puts("Access granted"); return 0; }
}

get_program_info → Mac OS X Mach-O, AARCH64:LE:64:AppleSilicon, 4 functions (3 external)
list_functions   → entry, _fprintf, _puts, _strlen
decompile_function_by_address({ address: "0x1000004b0" })
disassemble_function({ address: "0x1000004b0" })
  1000004fc  cmp  w10,#0x5a
             ccmp x8,#0xa,#0x4,eq
read_memory({ address: "0x1000005c7", length: 16 }) → 2e 32 3c 3c 2e 30 33 31 7f 67 61 00 …
Answer: tidepool-41

FAQ

Repository

1. github.comgithub.com/clearbluejar/pyghidra-mcp ↗