Analyze a Go binary in Ghidra through Cursor

A developer used Cursor with GhidraMCP to map a stripped Go server and hunt for bugs in its routes and handlers.

Done with Cursor· Advanced· Mar 2026

What they did
Huli loaded a stripped Gin server into Ghidra with the GolangAnalyzerExtension, then linked GhidraMCP to Cursor so the agent could query the decompiler directly. After first asking it to identify the binary and its functions, they pushed it to rebuild the Go source and inspect it for security issues.
How it went
With Cursor’s composer 1.5, it recovered the route list, libraries, and general file layout, though a few route names were off. It found the path traversal issue, but it treated the SQL injection as already fixed and missed it. The same prompt on Opus 4.6 caught both bugs, though some routes were still mislabeled.
Tips
Model choice mattered a lot, so compare results from more than one run if the findings are important. Treat route names and vulnerability calls as leads to verify manually before relying on them.

Try it yourself with Cursor

Connect to Ghidra through MCP and inspect this Go binary at [path or file name]. First identify its main packages, routes, and handler functions from the decompiler output. Then reconstruct the likely source structure and check for security problems such as path traversal or SQL injection. Pause and ask me before making any change that would send, delete, submit, or otherwise alter data. Finish with a short report listing the routes, suspected bugs, and anything you are not fully sure about.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on blog.huli.tw ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.