Hosting

Local MCP process connected to a Ghidra extension; optional local Streamable HTTP MCP mode

Transport

stdio by default; optional Streamable HTTP

Endpoint

Local process; no hosted endpoint documented

Authentication

The current README does not document a required authentication flow for the default localhost setup. Keep the Ghidra bridge bound to localhost unless a separately secured remote deployment is configured.

Requirements

• Ghidra 12.1.4 as specified by the current repository README.
• uv/uvx; the alternative pip installation requires Python 3.10 or later.
• The Ghidra extension must be installed and enabled in the active Ghidra instance.

Setup steps

1. Download the latest GhidraMCP release ZIP from https://github.com/LaurieWired/GhidraMCP/releases.
2. In Ghidra, choose File ? Install Extensions ? +, select the release ZIP, restart Ghidra, then enable GhidraMCPPlugin under File ? Configure ? Developer.
3. Open a project and program in Ghidra. The plugin's Ghidra HTTP bridge defaults to http://127.0.0.1:8080/; configure its port in Edit ? Tool Options ? GhidraMCP HTTP Server if needed.
4. Configure the MCP client with command `uvx` and args [`--from`, `git+https://github.com/LaurieWired/GhidraMCP`, `ghidra-mcp`, `--ghidra-server`, `http://127.0.0.1:8080/`].
5. Reconnect and inspect tools/list. For an HTTP MCP client, start the documented server on 127.0.0.1:8081 with `--transport streamable-http` and connect to http://127.0.0.1:8081/mcp.

Crawl4AI checked four publisher/repository pages and the current official server.py implementation. Recorded every registered @mcp.tool identifier in that source, including two GUI-context tools registered only when GUI context is available; the implementation source is the authoritative version-specific roster.

• decompile_function

  Decompile a function by name.

  01
• decompile_function_by_address

  Decompile the function at or containing an address.

  02
• disassemble_function

  Disassemble instructions in a function body.

  03
• get_current_address

  GUI-only: get the address selected in the Ghidra listing.

  04
• get_current_function

  GUI-only: get the function containing the selected Ghidra address.

  05
• get_function_by_address

  Get the function at or containing an address.

  06
• get_function_calls

  Return a function-level caller/callee graph.

  07
• get_function_xrefs

  List references to a function entry point by name or address.

  08
• get_program_info

  Identify the target program, architecture, address range, entry points, size, and hashes.

  09
• get_xrefs_from

  List references from an instruction or data address.

  10
• get_xrefs_to

  List references to an address.

  11
• list_classes

  List class namespaces.

  12
• list_data_items

  List defined data with address, label, type, and value.

  13
• list_exports

  List exported symbols and entry points.

  14
• list_functions

  List functions with names and entry addresses; supports filtering and pagination.

  15
• list_imports

  List imported symbols and libraries.

  16
• list_methods

  Deprecated alias that lists function names only.

  17
• list_namespaces

  List non-global namespaces.

  18
• list_segments

  List memory blocks, address ranges, sizes, and permissions.

  19
• list_strings

  List defined strings with addresses; supports filtering and pagination.

  20
• read_memory

  Read up to 4096 bytes of program memory.

  21
• rename_data

  Rename a label or existing symbol at an address.

  22
• rename_function

  Rename a function by its current name.

  23
• rename_function_by_address

  Rename a function by address.

  24
• rename_variable

  Rename a local variable or parameter.

  25
• search_functions_by_name

  Search for functions by case-insensitive name substring.

  26
• set_decompiler_comment

  Set or clear a decompiler pre-comment at an address.

  27
• set_disassembly_comment

  Set or clear a disassembly end-of-line comment.

  28
• set_function_prototype

  Set a function signature from a C prototype.

  29
• set_local_variable_type

  Set a decompiler variable data type.

  30

• Requires a compatible Ghidra 12.1.4 installation and the extension enabled in an active Ghidra session, unless using the separately documented headless path.
• The repository is community maintained and is not an official National Security Agency/Ghidra MCP integration.
• Repository `images/` contains setup screenshots rather than a suitable standalone logo. The accepted logo is the verified repository owner avatar (fallback tier D), not a Ghidra product logo.
• No MCP initialize, tools/list, or representative tool call was performed for this catalog entry.

• Community maintainer README

  Current repository README documents Ghidra 12.1.4, extension install and enable steps, uvx stdio client command, default localhost bridge, optional Streamable HTTP transport, and reverse-engineering capabilities.

• Verified repository-owner profile (logo fallback tier D)

  GitHub profile identifies the owner of the GhidraMCP repository. The API-provided 460x460 profile image was downloaded, decoded as JPEG, converted to a local PNG, and visually reviewed; the repository's own images were setup screenshots, not a standalone logo.

• Official Ghidra product repository

  Used to distinguish the integrated product publisher from this separately maintained community MCP project; this record does not claim NSA or official Ghidra ownership.

• official documentation

  Maintainer-published TOOLS.md calls itself the complete reference for 70 GhidraMCP tools and groups them by query, mutation, advanced analysis, malware, IoT, utility, instances, structures and async decompilation.

Documentation checked 2026-10-29T00:00:00Z. Connection has not been runtime tested.