Ghidra

Bridges Ghidra reverse engineering platform with language models through a Java plugin HTTP server and Python MCP translator, enabling function decompilation, disassembly, symbol management, cross-reference analysis, string extraction, and program modification for AI-assisted binary analysis workflows.

GhidraMCP by LaurieWired bridges the Ghidra reverse engineering platform with AI assistants through a dual-component architecture: a Java plugin that runs an embedded HTTP server within Ghidra (configurable port, defaults to 8080) and a Python MCP server that translates between the HTTP API and MCP protocol. The implementation exposes core Ghidra functionality including function decompilation, disassembly, symbol management, cross-reference analysis, string extraction, and program modification capabilities like renaming functions/variables and setting prototypes. Built for Ghidra 11.3.2 with Maven packaging and GitHub Actions CI/CD, it supports multiple MCP clients (Claude Desktop, Cline, 5ire) through both stdio and SSE transports, enabling AI-assisted reverse engineering workflows where language models can autonomously analyze binaries, understand program structure, and suggest meaningful names and annotations based on code patterns and context.