x64dbg-mcp-server

Why we included this project

Hand-disassembling a suspicious binary and stepping through its traps is slow, repetitive work, and this plugin points an LLM at it. It runs as a native Model Context Protocol plugin for x64dbg that exposes the debugger's operations over HTTP, so an assistant like Claude Code can set breakpoints, step through code, read memory, dump registers, scan for byte patterns, extract strings, and inspect the PEB or SEH chain without you typing each one. Analysts who live inside x64dbg get to hand the scripted triage steps to an agent and keep their own attention on what the results mean. The Zig build keeps things light with a single drop-in plugin binary and no runtime dependencies, which suits a sandbox or analysis VM. It is a practical way to bring LLM help into the debugger rather than only in an IDE or terminal.