GhidraMCP (Reverse Engineering)
MCP server for NSA's Ghidra reverse engineering framework. AI-powered binary analysis, decompilation, and cross-reference navigation.
- Analyze binary files with AI-assisted decompilation
- Navigate cross-references and function calls in compiled code
- Identify potential vulnerabilities in compiled software
5.4K+ stars. AI-assisted reverse engineering for security teams. Multiple enhanced forks with 100-194 tools.
Security researchers and malware analysts who want AI-assisted binary analysis and vulnerability research.
https://github.com/LaurieWired/GhidraMCP
By LaurieWired
How to Get It
Trust Signals Reviewed
Data & Access
Community Pulse Active
Discussed on Hacker News, Reddit
- MCP server for Ghidra — Hacker News · 356 pts
- Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering — Hacker News · 298 pts
- Debugger Ghidra Class — Hacker News · 199 pts
23 mentions across 2 sources
Reviewer notes
Reviewed review. These are observations, not a security certification.
Open source. Requires Ghidra installation.
2026-05-10: Practical use case is cutting down the time a skilled analyst spends on the mechanical parts of RE work—renaming symbols, tracing cross-references, mapping call graphs—by letting an LLM handle navigation and summarization while you focus on the interesting logic. The honest tradeoff: decompilation quality is still Ghidra's ceiling, and on heavily optimized or obfuscated binaries that ceiling is low; AI-generated summaries can look confident while missing the one context-specific behavior that actually matters. Best treated as a force-multiplier for analysts who already know what they're looking for, not a shortcut around that knowledge. The active fork ecosystem (some variants ship 100+ tools) means you should evaluate which fork matches your architecture coverage before committing.
How to evaluate tools before deploying →
Data shown here comes from public APIs and automated scanning. Reviewer notes reflect one person's experience. This is not a security certification or legal recommendation. Always evaluate tools according to your own organization's policies.