Ghidra in Claude Code

Use Ghidra as an MCP tool in Claude Code, enabling AI-assisted reverse engineering directly from the CLI.

Claude gets access to the GhidraMCP v6.0.0 tool surface — decompile, rename, document, create structs, trace call graphs, detect malware — running headlessly. The release ships 272 tools across GUI and headless; a headless server like this one registers ~214 of them (GUI-only tools such as launch_codebrowser are not available), plus 8 instance-management tools.

How It Works

Claude Code CLI
    |
    |-- starts launch_ghidra_mcp.py as MCP server
            |
            |-- launches Ghidra headless server (Java, port 8089)
            |-- waits for the port, then execs the bridge on stdio
                    |
                    |-- python -m bridge_mcp_ghidra  (installed from the wheel)
                    |-- auto-connects to 127.0.0.1:8089
                    |-- fetches /mcp/schema, registers every tool dynamically
                    |-- translates MCP tool calls <-> Ghidra HTTP API

Prerequisites

• JDK 21+ — Required by Ghidra 12.x (Adoptium Temurin)
• Ghidra 12.x — Download. v6.0.0 targets 12.1.2; it also runs headless against 12.0.3 (verified).
• Python 3.10+ — For the MCP bridge
• Claude Code — Install

Installation

1. Install JDK and Ghidra

# Example — adjust paths for your system
export JAVA_HOME=/opt/jdk-21
export GHIDRA_HOME=/opt/ghidra_12.1.2_PUBLIC

2. Install GhidraMCP v6.0.0

The bridge is now a Python wheel, not a loose script — this changed in v6.0.0.

mkdir -p ~/ghidra-mcp && cd ~/ghidra-mcp

# Download release artifacts
BASE=https://github.com/bethington/ghidra-mcp/releases/download/v6.0.0
curl -fsSL -O $BASE/GhidraMCP-6.0.0.zip
curl -fsSL -O $BASE/ghidra_mcp_bridge-6.0.0-py3-none-any.whl

# Install the Python bridge (ships its own dependencies)
uv tool install ./ghidra_mcp_bridge-6.0.0-py3-none-any.whl
# or: pip install ./ghidra_mcp_bridge-6.0.0-py3-none-any.whl

# Install the Ghidra extension
unzip -qo GhidraMCP-6.0.0.zip -d $GHIDRA_HOME/Extensions/Ghidra/

The extension ZIP contains a GhidraMCP/ directory, so it unzips into Extensions/Ghidra/ — the launcher expects the JAR at $GHIDRA_HOME/Extensions/Ghidra/GhidraMCP/lib/GhidraMCP-6.0.0.jar.

Verify the bridge installed:

python3 -c "import bridge_mcp_ghidra; print('ok')"

3. Clone this repo (launcher + config)

git clone https://github.com/coffeegrind123/ghidra-in-claude-code.git
cd ghidra-in-claude-code
chmod +x launch_ghidra_mcp.py

4. Configure Claude Code

claude mcp add ghidra -s user -- python3 /path/to/launch_ghidra_mcp.py

Or edit ~/.claude.json directly:

{
  "mcpServers": {
    "ghidra": {
      "command": "python3",
      "args": ["/path/to/launch_ghidra_mcp.py"],
      "env": {
        "GHIDRA_HOME": "/opt/ghidra_12.1.2_PUBLIC",
        "JAVA_HOME": "/opt/jdk-21"
      }
    }
  }
}

Environment Variables

Variable	Default	Description
JAVA_HOME	Auto-detected	JDK 21+ installation
GHIDRA_HOME	Auto-detected	Ghidra installation directory
GHIDRA_MCP_PORT	8089	Port for the headless server
GHIDRA_MCP_URL	http://127.0.0.1:$GHIDRA_MCP_PORT	Instance the bridge connects to. The launcher sets this so the bridge attaches to the server it just started instead of scanning 8089..8104.
GHIDRA_MCP_DIR	Script directory	Directory to check for a legacy v5 bridge_mcp_ghidra.py
GHIDRA_MCP_AUTH_TOKEN	unset	Bearer token. Only needed for browser or non-loopback clients — see Security below.

Usage

Loading a binary

Binaries are loaded via the headless server's HTTP API (not an MCP tool):

curl -s -X POST http://127.0.0.1:8089/load_program -d "file=/absolute/path/to/binary.exe"

Or ask Claude: "Load /tmp/malware.dll into Ghidra and analyze it"

Example session

$ claude

You: Load /tmp/RegMaster.dll and document all exported functions

Claude: [loads binary, runs analysis, documents using V5 protocol]
  - list_exports → finds Meta_Query, Meta_Attach, GetEntityAPI2
  - decompile_function → reverse engineers each export
  - rename_function → PascalCase names with collision checking
  - set_function_prototype → typed prototypes
  - batch_set_comments → plate + inline comments
  - set_plate_comment → summary with server-side quality gate

Security (new in v6.0.0)

v6.0.0 added an anti-CSRF / DNS-rebinding guard, and it is the reason for the major version bump. The HTTP servers now reject requests whose Origin is cross-site or whose Host is non-loopback, returning 403.

This setup is unaffected. The MCP bridge sends a loopback Host and no Origin, so it is explicitly exempt. You only need GHIDRA_MCP_AUTH_TOKEN if you want a browser-based client, or to bind a non-loopback address — setting the token disables the guard and becomes the access control in its place.

Other v6.0.0 hardening worth knowing about: request bodies are capped at 64 MiB on every transport, delete_file / create_folder now honor GHIDRA_MCP_PROJECT_FOLDER containment, script execution is gated on GHIDRA_MCP_ALLOW_SCRIPTS at the sink, and the headless filesystem endpoints honor GHIDRA_MCP_FILE_ROOT.

What Changed (v5.12.0 → v6.0.0)

• The bridge is a wheel. bridge_mcp_ghidra.py is gone; install ghidra_mcp_bridge-6.0.0-py3-none-any.whl and run bridge-mcp-ghidra or python -m bridge_mcp_ghidra. This repo no longer vendors a bridge script.
• 272 tools (up from 245), still auto-registered from /mcp/schema at startup.
• Breaking: the CSRF/rebinding guard described above.
• clear_flow_and_repair and program-storage tools added; provider resilience and UDS transport auth improvements.

Earlier: v4.2.0 → v5.12.0

Change	Before	After
batch_rename_variables	Old name	Renamed to rename_variables
add_struct_field	insertAtOffset	replaceAtOffset (overlays undefined bytes)
set_local_variable_type	Accepted no-ops	Rejects undefined→undefined
Struct field names	Pass-through	Auto-prefixed with Hungarian notation

Heads-up: v7.0.0 will break call sites

v7.0.0 is unreleased but already on dev, and it is a hard break with no compatibility aliases:

• 272 → 251 tools. Redundant tools fold into "one-or-many" survivors — e.g. set_plate_comment / set_decompiler_comment / set_disassembly_comment all become set_comment(address, comment, type=...), and every batch_* variant merges into its singular form with a bulk argument.
• Every tool returns JSON. Endpoints that answered in prose now return records, so anything parsing output as English breaks — including list_functions, decompile_function, and get_current_program_info.

Pin v6.0.0 until you are ready to migrate. See the upstream CHANGELOG and MIGRATION_7.0.0_TOOL_CONSOLIDATION.md.

License

Scripts in this repo are MIT licensed. Ghidra is Apache 2.0. GhidraMCP — see bethington/ghidra-mcp.