Use Ghidra tools to map a binary faster

An MCP bridge let an agent decompile code, trace relationships, and rename symbols inside Ghidra from Claude or Cursor.

Done with Custom agent· Advanced

What they did
A developer installed a Ghidra plugin that launches a local HTTP server, then connected it to MCP through a small Python bridge. After enabling the plugin in CodeBrowser, the agent could inspect functions, follow callers and references, and apply grouped renames, type fixes, and comments.
How it went
The project’s README says it expanded from 110 tools to 253. It also reports 93% fewer API calls thanks to batching, but it does not include a benchmark showing analysis accuracy or speed.
Tips
Keep lazy tool loading enabled if your client struggles with large tool sets. Leave script execution disabled unless you intentionally turn on GHIDRA_MCP_ALLOW_SCRIPTS, and remember the server has no authentication even though it only listens on localhost.

Try it yourself with Claude Code

Connect to my Ghidra MCP server, open the binary at [path to binary], and inspect it in a way that helps me understand what it does. Find the main routines, trace their callers and references, rename functions and variables to clearer labels, and add brief comments where useful. Flag any signs of network activity, file access, or other suspicious behavior. Before you make any irreversible change, such as submitting edits or running a script that modifies files, pause and ask for my approval. Then give me a short plain-language summary of the program and the evidence you used.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on github.com ↗

1 more report of this

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.