What it is
GhidraMCP, by security researcher LaurieWired, connects MCP clients to Ghidra, the open-source reverse engineering suite released by the NSA. A Ghidra extension exposes Ghidra's analysis over a local HTTP server, and a Python MCP server passes that to the model. With about 11,500 GitHub stars it is the most-starred Ghidra MCP project.
The server exposes 30 tools in our reading of the source. They list functions, classes, imports, exports, strings and segments, decompile or disassemble functions, follow cross-references and read memory, and write back to the project by renaming functions, data and variables, setting prototypes and types, and adding comments.
Version 2.0, released on 10 October 2026, targets Ghidra 12.1.4, removes the separate Python bridge script and adds a headless mode that imports and analyses a binary with PyGhidra and no Ghidra window. Ghidra 12.2 was released on 22 October 2026, and no matching GhidraMCP build had been published by then. Install the extension from the release zip, then run the server with uvx from the Git repository.
Install
uvx --from git+https://github.com/LaurieWired/GhidraMCP ghidra-mcp --ghidra-server http://127.0.0.1:8080/Our review
Reverse engineering suits an assistant well: much of the work is reading decompiled functions, guessing what they do and renaming things so the next function makes sense. GhidraMCP gives the model exactly those moves, and the rename, type and comment tools mean its conclusions are saved into the Ghidra project rather than lost in a chat log.
The project had a long quiet spell, with no commits between June 2025 and 10 October 2026 while forks grew. Version 2.0 rebuilt it for Ghidra 12.1.4, made the Python side installable with uvx and added a headless mode for batch triage or CI. Version pinning is the catch. The extension is built for one Ghidra release, and Ghidra 12.2 shipped on 22 October, twelve days after GhidraMCP 2.0, so anyone upgrading Ghidra waits for a rebuild or compiles the extension with Gradle.
The main alternative, bethington/ghidra-mcp (about 5,900 stars), released 7.0.0 on 21 October 2026 with 209 tools, including script execution, P-code emulation and live debugging. It does far more, but script execution means the model can run arbitrary code inside Ghidra, and 209 tool definitions take a large slice of context on every request. GhidraMCP stops at reading and annotating, a defensible line for malware work.
Version 2.0's backend binds to the loopback address and rejects requests whose Host header is not localhost, which blocks DNS-rebinding tricks from a browser. There is still no authentication, so any local process can drive it, and the optional Streamable HTTP mode should stay on 127.0.0.1 as the README shows. The larger exposure is data: decompiled code goes to whichever model provider the client uses, and strings pulled from a malware sample are attacker-written text in the model's context. A long-open issue (#27) also reports decompiler output that differs from the Ghidra UI.
Where it earns its place
A malware analyst at a 10-person incident response firm
Triage a new sample and get named functions and comments into the Ghidra project
With the sample open, the model lists imports and strings, decompiles suspicious functions, follows cross-references and renames as it goes. The tools are free; the real cost is tokens and the question of sending client binaries to a cloud model, which many IR contracts restrict.
A product security engineer checking firmware builds in CI
Batch-analyse each new firmware image without a GUI
Headless mode imports and analyses each binary with PyGhidra (Python 3.10 to 3.13, GHIDRA_INSTALL_DIR pointing at Ghidra 12.1.4), then an agent queries functions and exports. Pin Ghidra to 12.1.4 in the image until a 12.2 build ships.
A university student working through reverse engineering exercises
Get plain explanations of what a crackme's functions do
Pair Claude Desktop or Claude Code with the GUI plugin, ask for explanations of decompiled functions and let the model propose names. Free apart from the model; check its renames against the Ghidra UI, since plugin output has been reported to differ.
Before you commit
- Setup
- Install Ghidra 12.1.4, add the release zip through File > Install Extensions and enable the plugin, then point the client at uvx --from git+https://github.com/LaurieWired/GhidraMCP ghidra-mcp --ghidra-server http://127.0.0.1:8080/. The README shows Claude Desktop and Claude Code configs.
- Integrations
- 30 tools: 22 that read (program info, functions, classes, namespaces, segments, imports, exports, strings, data, decompile, disassemble, cross-references, read_memory) and 8 that write to the project (renames, prototypes, local variable types, decompiler and disassembly comments). No script execution or debugger.
- Data and privacy
- The plugin backend binds to 127.0.0.1 and checks the Host header but has no authentication. Decompiled code and strings go to the client's model provider, and strings from hostile binaries are untrusted input. No security advisories are published.
- Cost at scale
- Free under Apache 2.0, as is Ghidra. The cost is model usage: decompiling dozens of functions per binary adds up in tokens, and a local model is the route for binaries that cannot leave the network.
- Limits
- Built for Ghidra 12.1.4 while 12.2 is current. The repository has 94 open issues and pull requests, many about installation and version mismatches, and issue #27 reports decompiler output differing from the UI. Headless mode needs Python 3.10 to 3.13.
What's good
- Decompile, cross-reference and annotate from one client
- Renames, types and comments are saved into the Ghidra project
- Headless PyGhidra mode for analysis without the GUI
- 30 tools and no script runner
What's not
- Each release is tied to one Ghidra version; 12.2 not yet supported
- Went 16 months without commits before 2.0
- No authentication on the local HTTP server
- Far fewer features than the bethington fork
Best for
Malware analysts and reverse engineers who want an assistant to triage and annotate binaries in Ghidra.
Alternatives
GhidraMCP: common questions
- Is GhidraMCP worth it?
- GhidraMCP gives a model the reverse engineer's core moves and saves its conclusions into the project, with 30 tools where its biggest fork ships 209. We rate it 4.1 out of 5.
- How much does GhidraMCP cost?
- Free and open source (Apache 2.0). Ghidra itself is free.
- What are the downsides of GhidraMCP?
- Each release is tied to one Ghidra version; 12.2 not yet supported; went 16 months without commits before 2.0; no authentication on the local HTTP server; far fewer features than the bethington fork.
- Who is GhidraMCP best for?
- Malware analysts and reverse engineers who want an assistant to triage and annotate binaries in Ghidra.
- How much does GhidraMCP cost for a team or in production?
- Free under Apache 2.0, as is Ghidra. The cost is model usage: decompiling dozens of functions per binary adds up in tokens, and a local model is the route for binaries that cannot leave the network.
- Is GhidraMCP safe for company data?
- The plugin backend binds to 127.0.0.1 and checks the Host header but has no authentication. Decompiled code and strings go to the client's model provider, and strings from hostile binaries are untrusted input. No security advisories are published.
- What are the best GhidraMCP alternatives?
- The closest alternatives we have reviewed are Filesystem (reference server) and GitHub MCP Server.
Answers checked Oct 22, 2026.
Make GhidraMCP? Show this rating on your site
