Skip to content
Kitbay
Submit
MCP server

GhidraMCP

Runs locallyApache-2.0Updated on Oct 22, 2026150GitHub starsCan change dataNo API key needed

This GhidraMCP, from GitHub user 13bm, is a Ghidra extension whose Java plugin opens a TCP socket inside Ghidra and starts a bundled Go bridge; the MCP client runs that bridge as a local stdio server.

InstallRepository Checked on Nov 12, 2026

What it does

This GhidraMCP, from GitHub user 13bm, is a Ghidra extension whose Java plugin opens a TCP socket inside Ghidra and starts a bundled Go bridge; the MCP client runs that bridge as a local stdio server. A settings dialog can write the Claude Desktop config or copy a config for other clients. About 70 tools cover querying a program, renaming and annotating, structure management, malware triage and IoT or firmware checks, asynchronous decompilation and routing between several Ghidra windows. It binds to localhost by default, with an optional API key for remote setups. Prebuilt bridges exist for Linux, Windows and macOS. It needs Ghidra 12.0.3 or later and Java 21, and states no affiliation with the NSA.

Capabilities

  • Decompile functions, including asynchronously for large ones
  • Rename symbols and annotate code
  • Create and manage structures
  • Triage malware and check embedded firmware
  • Work across several Ghidra windows at once

Other MCP servers and skills for Ghidra