{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/FEATURE_SUPPORT.md",
    "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/CHANGELOG.md",
    "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/RELEASING.md",
    "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/pyproject.toml",
    "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/.github/workflows/ci.yml",
    "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/LICENSE",
    "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/ghidra_headless_mcp/_version.py",
    "https://github.com/mrphrazer/ghidra-headless-mcp/tree/307b461cdbbedfbafb3771333f21875b745f940e/samples",
    "https://github.com/mrphrazer/ghidra-headless-mcp/tree/307b461cdbbedfbafb3771333f21875b745f940e/tests/fixtures"
  ],
  "category": "agent-mcp",
  "description_en": "Headless-only MCP server that drives Ghidra through PyGhidra and is meant to share a container with the agent rather than attach to a Ghidra GUI. Its 212 tools in 34 groups cover program and project lifecycle, disassembly, decompilation and P-code, patching and memory edits, symbols, references, types and structure layouts, search and graph extraction, with raw Python, Java-API and script access for anything else. Programs open read-only by default, edits run in transactions with undo and redo, a fake backend lets development and CI run without Ghidra, and a ghidra_cli client exposes the same tools to shells and agents without MCP.",
  "description_zh": "仅以无界面方式运行的 MCP 服务器，通过 PyGhidra 驱动 Ghidra，设计为与智能体运行在同一容器中，而不是连接 Ghidra 图形界面。其 34 组共 212 个工具涵盖程序与项目生命周期、反汇编、反编译与 P-code、补丁与内存修改、符号、引用、类型与结构布局、搜索和图提取，其他需求可通过直接执行 Python、调用 Java API 或运行脚本完成。程序默认以只读方式打开，修改在支持撤销与重做的事务中进行；伪后端让开发和 CI 无需安装 Ghidra 即可运行，ghidra_cli 客户端则把同一套工具提供给不使用 MCP 的命令行和智能体。",
  "entry_url": "https://awesomerea.org/resources/ghidra-headless-mcp/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ghidra-headless-mcp/",
  "evidence_url": "https://github.com/mrphrazer/ghidra-headless-mcp/blob/307b461cdbbedfbafb3771333f21875b745f940e/README.md",
  "group": "agents",
  "id": "ghidra-headless-mcp",
  "json_url": "https://awesomerea.org/resources/ghidra-headless-mcp/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/ghidra-headless-mcp/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ghidra-headless-mcp/index.md",
  "name": "Ghidra Headless MCP",
  "name_zh": "Ghidra Headless MCP",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "The reviewed main commit (2026-09-16) reports version 0.1.0, with no tags or releases; the changelog keeps all changes under Unreleased, and RELEASING.md says source releases go to GitHub only, not PyPI, and that no public release tag should be created until a license is chosen. Install from a checkout with pip. The README says the code, tests and documentation are entirely vibe coded.",
    "Python 3.11+ with pyghidra 3.0.2+ and a local Ghidra installation given through GHIDRA_INSTALL_DIR or --ghidra-install-dir; the README names no minimum Ghidra release. MCP runs over stdio or TCP, with setup examples for Claude Code, Codex and generic MCP hosts and a sample Kali-based Dockerfile that installs Ghidra beside the agent. Debugger, Version Tracking, FID, BSim and emulator workflows are listed as not exposed.",
    "ghidra.eval, ghidra.call and ghidra.script run arbitrary Python, Java and scripts inside the Ghidra runtime, and both transports are unauthenticated; the TCP server binds 127.0.0.1, and the README limits use to trusted, containerized environments. Read-only sessions protect program state but do not sandbox filesystem or process access.",
    "The repository bundles a stripped AArch64 GNU coreutils ls executable in samples/ as the feature fuzzer’s default target, and a small compiled hello test fixture with its C source. The README says CI also runs live Ghidra tests and a wheel check, but the reviewed workflow runs only Ruff and the non-live pytest suite on the fake backend.",
    "GitHub detects GPL-2.0 from the LICENSE file added in the initial commit, while the README and RELEASING.md still treat the license as unchosen and pyproject.toml declares none."
  ],
  "requirements_zh": [
    "所审阅的 main 提交（2026-09-16）标为 0.1.0 版，没有标签或发行版；更新日志把所有改动都列在 Unreleased 下，RELEASING.md 称源码发行版只发布到 GitHub、不发布到 PyPI，并要求在选定许可证之前不要创建公开发行标签。需从检出的源码用 pip 安装。README 称代码、测试和文档全部是“vibe coding”写成的。",
    "需要 Python 3.11+、pyghidra 3.0.2+，以及通过 GHIDRA_INSTALL_DIR 或 --ghidra-install-dir 指定的本地 Ghidra 安装；README 未注明最低 Ghidra 版本。MCP 可经 stdio 或 TCP 运行，README 给出了 Claude Code、Codex 和通用 MCP 主机的配置示例，以及一个在智能体旁安装 Ghidra 的 Kali 基础 Dockerfile 示例。调试器、Version Tracking、FID、BSim 和模拟器相关工作流被列为尚未提供。",
    "ghidra.eval、ghidra.call 和 ghidra.script 会在 Ghidra 运行时中执行任意 Python、Java 代码和脚本，两种传输方式均无身份验证；TCP 服务器只绑定 127.0.0.1，README 要求仅在受信任的容器化环境中使用。只读会话可保护程序状态，但不会隔离文件系统或进程访问。",
    "仓库在 samples/ 中附带一个已剥离符号的 AArch64 GNU coreutils ls 可执行文件，作为功能模糊测试器的默认目标，另有一个小型已编译的 hello 测试样本及其 C 源码。README 称 CI 还会运行真实 Ghidra 测试和 wheel 检查，但所审阅的工作流只运行 Ruff 和基于伪后端的非真实环境 pytest 测试。",
    "GitHub 依据初始提交中加入的 LICENSE 文件识别为 GPL-2.0，而 README 和 RELEASING.md 仍视许可证为尚未选定，pyproject.toml 也未声明许可证。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mrphrazer/ghidra-headless-mcp",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}