GhidraMCP: Open-Source Project That Lets AI LLMs Autonomously Operate Ghidra for Reverse Engineering 148

What is GhidraMCP?

GhidraMCP is an open-source project that enables AI large language models (such as Claude) to autonomously operate Ghidra for reverse engineering through the MCP protocol. It exposes Ghidra's core functionalities to MCP clients, supporting decompilation, binary file analysis, automatic renaming of methods and data, as well as listing methods, classes, imports, and export tables.

GhidraMCP Features

• Decompilation & Analysis: Supports decompiling and analyzing binary files in Ghidra, generating highly readable pseudocode.

• Automated Renaming: Automatically annotates method names, class structures, and data variables based on semantic analysis, improving code readability.

• Structured Information Extraction: Batch exports metadata such as function lists, class definitions, and import/export tables of programs.

• Multi-Client Compatibility: Supports all MCP protocol-compliant clients, such as Claude Desktop and 5ire.

GhidraMCP Use Cases

• Malware Analysis: Automatically identifies suspicious API call chains in samples, generates annotated decompilation reports, and improves analysis efficiency.

• Firmware Vulnerability Discovery: Combined with multi-model scheduling capabilities, extracts function tables, identifies potential vulnerability points, and generates verification scripts.

• Software Reverse Engineering: Assists in understanding the logic structure of complex software, reducing the difficulty of reverse engineering.

Technical Architecture

• MCP Protocol: Acts as a "translator", defining the standard interaction format between AI and tools, supporting command delivery and result return.

• Python Script Bridging: The bridge_mcp_ghidra.py script parses AI instructions and calls the Ghidra plugin through Socket communication.

• Ghidra Plugin: GhidraMCPPlugin monitors commands and invokes Ghidra's Java API to perform decompilation, symbolic analysis, and other operations.

How to Use GhidraMCP

1. Install the Ghidra Plugin:

• Download the latest version of the GhidraMCP release package.

• Launch Ghidra, select File -> Install Extensions, and import the downloaded ZIP file.

• Restart Ghidra to ensure the plugin is enabled.

2. Configure the MCP Client:

• Claude Desktop: Edit the configuration file claude_desktop_config.json and add the GhidraMCP service configuration.

• 5ire: Set the tool configuration in the client, specifying the Tool Key, Name, and Command.

3. Run and Use:

• After launching the client, you can interact with the AI through natural language to invoke Ghidra's functionalities for reverse analysis.

GhidraMCP GitHub:https://github.com/LaurieWired/GhidraMCP