GhidraMCP (Reverse Engineering)
5.4K+ stars. AI-assisted reverse engineering for security teams. Multiple enhanced forks with 100-194 tools.
MCP server for NSA's Ghidra reverse engineering framework. AI-powered binary analysis, decompilation, and cross-reference navigation.
- Analyze binary files with AI-assisted decompilation
- Navigate cross-references and function calls in compiled code
- Identify potential vulnerabilities in compiled software
5.4K+ stars. AI-assisted reverse engineering for security teams. Multiple enhanced forks with 100-194 tools.
Security researchers and malware analysts who want AI-assisted binary analysis and vulnerability research.
https://github.com/LaurieWired/GhidraMCP
By LaurieWired
How to Get It
python /ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py --ghidra-server http://127.0.0.1:8080/ (register as MCP server command after installing the GhidraMCP plugin ZIP in Ghidra via File > Install Extensions)
Tip: Paste this into a Claude Code conversation. Verify command matches your Claude Code version.
Once it’s connected, paste this into Claude:
Help me analyze binary files with AI-assisted decompilation
Trust Signals Reviewed
Data & Access
Community Pulse Active
Discussed on Hacker News, Reddit
- MCP server for Ghidra — Hacker News · 356 pts
- Show HN: Ghidra MCP Server – 110 tools for AI-assisted reverse engineering — Hacker News · 298 pts
- Debugger Ghidra Class — Hacker News · 199 pts
3 mentions across 1 sources
Reviewer notes
Reviewed review. These are observations, not a security certification.
catalog_hygiene stale-eval refresh: Scored from trust signals (evidence-eval-v1): 9,440 GitHub stars; 10 contributors; last commit 382d ago; license Apache-2.0.
2026-05-10: Practical use case is cutting down the time a skilled analyst spends on the mechanical parts of RE work—renaming symbols, tracing cross-references, mapping call graphs—by letting an LLM handle navigation and summarization while you focus on the interesting logic. The honest tradeoff: decompilation quality is still Ghidra's ceiling, and on heavily optimized or obfuscated binaries that ceiling is low; AI-generated summaries can look confident while missing the one context-specific behavior that actually matters. Best treated as a force-multiplier for analysts who already know what they're looking for, not a shortcut around that knowledge. The active fork ecosystem (some variants ship 100+ tools) means you should evaluate which fork matches your architecture coverage before committing.
Things to check
- Accuracy depends heavily on Ghidra's decompilation quality, which varies by architecture and optimization level. AI analysis can miss context-specific vulnerabilities that require domain expertise; intended as accelerant, not replacement for skilled analysts.
How to evaluate tools before deploying →
Data shown here comes from public APIs and automated scanning. Reviewer notes reflect one person's experience. This is not a security certification or legal recommendation. Always evaluate tools according to your own organization's policies.
Evaluation
catalog_hygiene stale-eval refresh: Scored from trust signals (evidence-eval-v1): 9,440 GitHub stars; 10 contributors; last commit 382d ago; license Apache-2.0.