ghidraMCP

ghidraMCP provides a protocol server that allows large language models (LLMs) to perform automated reverse engineering using Ghidra. It exposes core functionalities such as decompiling binaries, analyzing code, renaming methods and data, and listing classes, methods, imports, and exports. The system enhances reverse engineering workflows by enabling scriptable and autonomous analysis, suitable for security researchers, reverse engineers, and automated analysis pipelines. Set up involves installing Ghidra, the MCP SDK, and configuring the plugin within Ghidra. Users can then connect via supported MCP clients such as Claude Desktop, Cline, or 5ire for automated binary analysis, saving considerable manual effort and improving efficiency in understanding complex binaries.