GhidraMCP

GhidraMCP bridges Ghidra's reverse engineering toolkit with Claude and other AI assistants, exposing 70 native functions for binary analysis. You get decompilation, symbol manipulation, cross-reference tracking, and scripting automation without leaving your chat interface. It's a proper integration, not a wrapper that shells out commands. I'd reach for this when triaging malware samples or working through CTF binaries where you want to iterate quickly. Ask Claude to decompile a function, rename symbols based on context, or trace data flow across a binary. The assistant can chain Ghidra operations together in ways that would normally require writing headless scripts. During a recent CTF, I used it to automate symbol renaming across a stripped ELF binary by describing patterns in plain English. Claude called the right Ghidra functions, and I reviewed the changes in the GUI. The quirks are real. You need Ghidra installed and configured first, which means Java dependencies and a non-trivial setup if you're new to the tool. The MCP server runs as a Ghidra extension, so it's tightly coupled to Ghidra's lifecycle. If Ghidra crashes, the server goes with it. Documentation assumes you already know Ghidra's terminology. If you don't know what a ProgramDB or a HighFunction is, you'll spend time learning Ghidra itself before this becomes useful. Performance depends on binary size. Large firmware images or packed executables can make operations sluggish, and the AI assistant won't always know when to batch requests efficiently. You'll occasionally hit timeouts on complex decompilations. This is for people who already live in Ghidra and want to augment their workflow with AI assistance. If you're a security researcher doing regular binary analysis, it's worth the setup friction. If you reverse binaries once a quarter or prefer other tools like Binary Ninja, the overhead isn't justified. Hobbyists doing CTFs will find it useful once past the initial hurdles, but expect to read Ghidra docs alongside MCP docs.