Skip to content
agentusehub

Reverse-engineer binaries in Ghidra

An MCP server exposing 110 Ghidra tools for AI-assisted reverse engineering.

Time saved
Not reported
Setup time
Not reported
Running cost
Not reported
Cost range
Not reported

Use case overview

An MCP server exposing 110 Ghidra tools for AI-assisted reverse engineering.

Reported experience

  1. What they did

    A Ghidra plugin starts an HTTP server on localhost, and a Python bridge exposes it to MCP clients such as Claude or Cursor. The agent decompiles functions, follows call graphs and cross-references, and renames, retypes and comments in batches. A person builds and deploys the plugin and enables it in CodeBrowser.

  2. How it went

    The README now lists 253 tools, not 110. It claims 93% fewer API calls from batching, and says it was refined over hundreds of documented functions. It gives no benchmark of results.

  3. Worth knowing

    Lazy tool loading is on by default because Gemini rejects the full tool list. Script-running endpoints are off unless you set GHIDRA_MCP_ALLOW_SCRIPTS, and the server has no authentication on localhost.

Example prompts

Try with Claude Code
Connect to the Ghidra MCP server I have set up and open the binary at [path to binary]. Identify its main functions, rename them based on what they do, and list any suspicious behavior such as network calls or file writes. Finish with a short written summary of what the program does and the functions that support that conclusion.
Content & Creative

Turn AI newsletters into a daily podcast

An agent runs overnight, collects the author's AI newsletter subscriptions and produces a daily podcast to listen to on walks.

Other or custom