poynt2005/ghidra-mcp-server repository overview

⁠Ghidra MCP Server

Turn Ghidra's headless decompiler into a searchable MCP service for AI-assisted reverse engineering. Upload a PE, ELF, or Mach-O binary, run a full static analysis, and let an MCP client navigate functions, decompiled code, strings, cross-references, call graphs, initialized memory, and a triage summary.

The server does not include an LLM and does not require an AI API key. It exposes analysis tools to whichever MCP client and model you choose.

⁠Highlights

• Ghidra 12.1.2 headless analysis with quick, standard, and deep profiles
• PE, ELF, and Mach-O input through HTTP upload or a read-only mounted directory
• Public PDB retrieval from the Microsoft Symbol Server for supported PE files
• Up-front decompilation with an on-disk SQLite/FTS5 index for fast queries
• Thirteen bounded MCP tools for jobs, triage, code navigation, data, and cleanup
• SHA-256 content addressing and per-profile analysis caching
• Untrusted-content fencing and response-size limits for model-facing output
• Optional bearer authentication and browser Origin validation
• A non-root container with dropped Linux capabilities and no sample execution

⁠Quick start

Create local persistence directories and start the container:

mkdir -p data samples
sudo chown -R 10001:10001 data

docker run -d \
  --name ghidra-mcp \
  --restart unless-stopped \
  -p 8080:8080 \
  --memory 10g \
  --memory-swap 10g \
  --pids-limit 2048 \
  --cap-drop ALL \
  --security-opt no-new-privileges:true \
  -v "$(pwd)/data:/data" \
  -v "$(pwd)/samples:/data/samples:ro" \
  <dockerhub-user>/ghidra-mcp-server:latest

The image runs as UID/GID 10001. Check readiness with:

curl http://localhost:8080/health

Configure a Streamable HTTP MCP client with:

{
  "mcpServers": {
    "ghidra": {
      "type": "http",
      "url": "http://localhost:8080/mcp"
    }
  }
}

Upload binaries with POST /upload as multipart form data in a field named file. Uploading does not automatically start analysis; call submit_analysis with the returned binary ID.

⁠MCP tools

• Jobs: submit_analysis, get_job_status, cancel_job, list_binaries
• Overview: get_triage_report
• Navigation: list_functions, get_function, search_code, list_strings, get_xrefs, get_callgraph
• Data: get_data
• Administration: delete_binary

Two prompt templates are included: reverse_engineer_binary and find_capability.

⁠Security warning

The default configuration listens on 0.0.0.0:8080 without authentication. Anyone who can reach the port can upload binaries, read cached analysis, and delete cached binaries. Use it only on a trusted network, or set AUTH_TOKEN and send Authorization: Bearer <token> with requests. Alternatively, publish only 127.0.0.1:8080:8080 and use an SSH tunnel.

This service performs static analysis and never intentionally executes an uploaded sample. Treat uploaded binaries and all decompiler output as hostile content regardless.

⁠Important environment variables

The defaults target a host with roughly 16 CPU cores and 14.5 GiB of RAM. Tune the memory and concurrency settings together for smaller systems.

⁠Persistent data and source

All state is stored below /data, including uploads, Ghidra projects, decompiled functions, indexes, logs, job metadata, and downloaded symbols. Source code, Compose deployment, full configuration details, and development instructions are in the poynt2005/ghidra-mcp-server GitHub repository.