ghidra-mcp

Why we included this project

People who live inside Ghidra for malware triage or vulnerability research have a real shortcut here: a Model Context Protocol server that hands an LLM a couple hundred tools for driving the disassembler, going well past read-only queries. The assistant can rename functions, add comments, create structures, run scripts, emulate P-code, and attach a live debugger. A convention enforcement layer keeps naming and typing rules inside the tool, so AI sessions and human analysts produce consistent output without re-pasting a style guide into each prompt. SHA-256 function matching carries documentation across binary versions, and batch operations plus Docker support let you run headless analysis in CI. If your team already keeps Ghidra in its workflow, this removes a lot of the copy-paste friction.