MCGhidra

Multi-instance Ghidra with a REST API and MCP server for decompilation, analysis, and binary manipulation.

What is MCGhidra?

MCGhidra connects Ghidra to the Model Context Protocol (MCP), turning Ghidra’s analysis engine into a set of tools that any MCP client can use. It consists of two parts: a Ghidra plugin that exposes a HATEOAS REST API from within Ghidra’s JVM, and a Python MCP server that translates those endpoints into MCP tools.

The result is that an MCP client can decompile functions, read memory, rename symbols, navigate cross-references, and manage Docker-based Ghidra instances — all through standard tool calls.

HATEOAS REST API

The Ghidra plugin serves a discoverable API with hypermedia links. Clients navigate resources by following links rather than hardcoding endpoint paths.

Multi-Instance

Run multiple Ghidra sessions in parallel, each analyzing a different binary. The MCP server tracks instances and routes requests to the right one.

Docker Support

Automatic container provisioning with port pooling. Pass a binary path and MCGhidra handles image building, container startup, and health polling.

Raw Firmware

Specify processor architecture, base address, and loader type for raw firmware binaries. Supports targets like ARM7TDMI, MIPS, x86, and anything Ghidra recognizes.

Quick Install

# Install the MCP server
pip install mcghidra

# Or use uvx for isolated execution
uvx mcghidra

The Ghidra plugin JAR ships inside the Python package and is automatically deployed to running Ghidra instances or Docker containers.

Architecture

MCP Client (Claude, etc.)
    │
    ▼
MCGhidra MCP Server (Python, FastMCP)
    │
    ▼
Ghidra Plugin REST API (Java, runs inside Ghidra's JVM)
    │
    ▼
Ghidra Analysis Engine

Each layer is independently useful. The REST API works without MCP. The MCP server works without Docker. Docker support is optional for automated container management.