# Ghidra Headless MCP > Headless-only MCP server that drives Ghidra through PyGhidra and is meant to share a container with the agent rather than attach to a Ghidra GUI. Its 212 tools in 34 groups cover program and project lifecycle, disassembly, decompilation and P-code, patching and memory edits, symbols, references, types and structure layouts, search and graph extraction, with raw Python, Java-API and script access for anything else. Programs open read-only by default, edits run in transactions with undo and redo, a fake backend lets development and CI run without Ghidra, and a ghidra_cli client exposes the same tools to shells and agents without MCP. - Type: Integration - Targets: Binary - Category: Independent MCP integrations - Relationship: Independent agent integration - Sources reviewed: 2026-10-20 - Added to the catalog: 2026-11-02 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/ghidra-headless-mcp/index.md) ## Requirements & limits - The reviewed main commit (2026-09-16) reports version 0.1.0, with no tags or releases; the changelog keeps all changes under Unreleased, and RELEASING.md says source releases go to GitHub only, not PyPI, and that no public release tag should be created until a license is chosen. Install from a checkout with pip. The README says the code, tests and documentation are entirely vibe coded. - Python 3.11+ with pyghidra 3.0.2+ and a local Ghidra installation given through GHIDRA_INSTALL_DIR or --ghidra-install-dir; the README names no minimum Ghidra release. MCP runs over stdio or TCP, with setup examples for Claude Code, Codex and generic MCP hosts and a sample Kali-based Dockerfile that installs Ghidra beside the agent. Debugger, Version Tracking, FID, BSim and emulator workflows are listed as not exposed. - ghidra.eval, ghidra.call and ghidra.script run arbitrary Python, Java and scripts inside the Ghidra runtime, and both transports are unauthenticated; the TCP server binds 127.0.0.1, and the README limits use to trusted, containerized environments. Read-only sessions protect program state but do not sandbox filesystem or process access. - The repository bundles a stripped AArch64 GNU coreutils ls executable in samples/ as the feature fuzzer’s default target, and a small compiled hello test fixture with its C source. The README says CI also runs live Ghidra tests and a wheel check, but the reviewed workflow runs only Ruff and the non-live pytest suite on the fake backend. - GitHub detects GPL-2.0 from the LICENSE file added in the initial commit, while the README and RELEASING.md still treat the license as unchosen and pyproject.toml declares none. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. ## More in Agents and MCP - [Binary Ninja Headless MCP](https://awesomerea.org/resources/binary-ninja-headless-mcp/index.md) · Integration - [IDA-Skill](https://awesomerea.org/resources/ida-skill-malware-analysis/index.md) · Integration - [BinAssist](https://awesomerea.org/resources/binassist/index.md) · Integration - [Reversecore MCP](https://awesomerea.org/resources/reversecore-mcp/index.md) · Integration - [AutoProber](https://awesomerea.org/resources/autoprober/index.md) · Integration - [ToCode](https://awesomerea.org/resources/tocode/index.md) · Integration ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.