GhidraMCP

Use it when

• You are reverse engineering a binary in Ghidra for security research or malware analysis and want an LLM to decompile, analyze, and rename functions autonomously instead of pasting decompiler output into a chat window.
• You want your MCP client (Claude Desktop, Cline, 5ire) to list methods, classes, imports, and exports of a loaded binary and drive Ghidra analysis through tool calls.

What it solves

Not the fit when

• For authorized security research, malware analysis, and CTF work; not for compromising software you lack permission to analyze.
• Requires a running Ghidra instance with the binary loaded; not a standalone disassembler.
• Bridge requires Python 3 and the MCP SDK.
• source code review of readable codebases
• document ocr or pdf parsing
• web scraping
• running the llm itself

Install

Download the release ZIP from https://github.com/LaurieWired/GhidraMCP/releases, then in Ghidra choose File -> Install Extensions -> +, select GhidraMCP-1-2.zip, restart Ghidra, and enable GhidraMCPPlugin under File -> Configure -> Developer.

Invoke

Add to claude_desktop_config.json an mcpServers entry running 'python /path/to/bridge_mcp_ghidra.py --ghidra-server http://127.0.0.1:8080/', then ask the LLM to decompile, list, or rename functions in the binary open in Ghidra. For Cline, run the bridge with --transport sse and add it as a remote server.

Alternatives

No reviewed alternatives recorded yet.