LaurieWired/GhidraMCP
GhidraMCP
GhidraMCP is a Model Context Protocol server that exposes Ghidra binary analysis and decompilation functions to external intelligence models. It acts as a bridge that connects the Ghidra reverse engineering suite to external tools through a standardized communication protocol, facilitating automated reverse engineering and software auditing.
The project enables the extraction of decompiled code and program structural data to populate the context windows of language models. It features a binary symbol management tool capable of dynamic symbol resolution, allowing method and data names to be updated in real time based on feedback from an external model to improve the readability of disassembled code.
The system covers broad binary analysis capabilities, including program component mapping and structure navigation to identify methods, classes, and imports. It also provides utilities for automated symbol renaming and the extraction of detailed binary code analysis.
Features
- MCP Servers - Implements a Model Context Protocol server that exposes Ghidra binary analysis tools to LLMs.
- LLM Tooling Integrations - Implements a connector allowing language models to access binary decompilation tools.
- Model Context Protocol Servers - Implements a Model Context Protocol server to expose Ghidra's binary analysis functions to LLMs.
- Tool-Use Integrations - Provides a bridge connecting binary analysis capabilities to AI models for functional task execution via tool-use.
- Reverse Engineering - Applies AI to decompile and analyze binary files by bridging decompilation tools with a context protocol.
- Automation Interfaces - Provides an interface for extracting decompiled code and program symbols to facilitate automated AI analysis.
- Binary Analysis - Extracts decompiled code and detailed analysis data from binaries to support automated reverse engineering.
- Reverse Engineering Tools - Exposes standardized interfaces for analyzing the internal logic and structure of compiled applications.
- Symbol Recovery Tools - Provides capabilities to automatically rename methods and data elements in binaries to improve disassembly readability based on model feedback.
- External Tool Integrations - Links external intelligence models to Ghidra's analysis and decompilation capabilities for software auditing.
- Plugin Communication Bridges - Acts as a communication bridge between the Ghidra suite and external tools using a standardized protocol.
- Context Extraction - Extracts decompiled C code and structural data to populate the context windows of language models.
- Structural Code Navigation - Provides utilities for listing and navigating methods and classes to determine a binary's organizational layout.
- Symbol Name Suggestions - Uses AI-driven analysis to update method and data element names for increased clarity of disassembled code.
- Binary Symbol Management - Provides a tool for mapping program components and automatically renaming methods and data elements.
- Binary Component Mapping - Identifies methods, classes, imports, and exports to visualize the internal structure of a binary.
- Program Logic Recovery - Recovers semantic meaning by automatically renaming methods and data elements in stripped binaries.
- Dynamic Name Resolution - Updates binary method and data names in real time based on feedback from an external intelligence model.
- Security Tools - Autonomous reverse engineering tool using model context protocol.
