Ghidra MCP Bridge

English | 简体中文

Version: this branch targets Ghidra 12.0+ (PyGhidra). Ghidra 11.x users → ghidra-11-ghidrathon branch or the v1.0-ghidrathon tag.

A PyGhidra-based MCP (Model Context Protocol) Bridge that runs inside Ghidra 12.0+, exposing Ghidra's reverse engineering capabilities to AI agents.

Highlights

• 7 MCP tools — single entry, pattern-dispatched to 50+ APIs. No tool sprawl.

• Version control + AI/human collaboration — multiple AI agents and humans work on the same binary via Ghidra Server, with full version history.

• Multi-binary cross-analysis — spin up multiple clients against different binaries in one project. Ideal for VMP unpacking, DLL-EXE interaction tracing, and multi-module firmware.

• AI-friendly — install the skill and let Claude Code / Codex start the server, import binaries, configure MCP, and begin analysis.

Quick Start

Let AI do it ⭐ (recommended)

# Install the gmcp CLI
git clone https://github.com/Hao17/LiteGhidraMCP.git && cd LiteGhidraMCP
pip install -e .

# Install the skill into your analysis project (`-d` = your project dir, where AI will run)
cd /path/to/your/project
gmcp install -d . skill claude-code   # or: codex / cursor

Then tell your AI: "Help me analyze ~/Downloads/firmware.bin" — the skill teaches it the rest.

Docker

pip install -e .                                # installs the `gmcp` CLI
gmcp server up                                  # first run prompts admin registration
gmcp server repo create test                    # admin-owned: clients can't create repos
gmcp client start 1 --repo test --binary-file ~/firmware.bin
gmcp install mcp claude-code                    # or: claude-desktop / coco

gmcp client start prints the endpoints to use — copy them into your MCP client config:

✓ Client 1 started
  User:    u-a1b2c3d4e5f6 (ephemeral)
  Repo:    test
  Binary:  firmware.bin
  HTTP:    http://localhost:8803
  MCP SSE: http://localhost:8804/sse

GUI mode (no Docker)

Run the script directly inside Ghidra:

1. Launch with PyGhidra: <ghidra_install>/support/pyghidraRun

2. Install Bridge deps into the PyGhidra venv (not system Python):

   ~/Library/ghidra/ghidra_<VERSION>_PUBLIC/venv/bin/python3 -m pip install -r requirements.txt

3. In Ghidra → Script Manager → add this repo to script directories → run ghidra_mcp_server.py

If you see MCP proxy failed to start + ModuleNotFoundError: No module named 'mcp', step 2 hit the wrong Python.

Related MCP server: ghidraMCP

MCP Tools

For the underlying HTTP API (50+ routes), see CLAUDE.md.

Documentation

• docker/QUICKSTART.md — Docker deployment, multi-client, user/ACL management, troubleshooting

• skills/SKILL.md — the workflow doc that gmcp install skill writes into your project

• CLAUDE.md — full API reference, architecture, hot reload, contributing