GhidrAssistMCP

Why we included this project

GhidrAssistMCP runs a Model Context Protocol server directly inside Ghidra, letting an LLM client query the disassembler's data and drive analysis without switching tools. It ships with roughly four dozen tools that read program info, functions, strings, imports, exports, and segments, plus pre-built prompts for common reverse engineering tasks. The implementation handles real-world setups well: multiple open programs and CodeBrowser windows work at once with automatic focus tracking, repeated queries are cached, and long operations run asynchronously so the UI stays responsive. It also runs headless through analyzeHeadless, which makes it useful for scripted analysis pipelines, not just interactive sessions. If you build AI-assisted malware analysis or binary auditing tooling, the standardized MCP interface is straightforward to wire into your own client.