{ "added_at": "2026-10-19", "additional_evidence_urls": [ "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/NOTICE", "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/LICENSE", "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/CHANGELOG.md", "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/pyproject.toml", "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/docs/TESTING.md", "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/docker/README.md", "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/.github/workflows/tests.yml", "https://github.com/bethington/ghidra-mcp/releases/tag/v7.0.0-rc.3", "https://github.com/bethington/ghidra-mcp/releases/tag/v6.0.0" ], "category": "agent-mcp", "description_en": "A Ghidra GUI plugin, standalone headless server and Python MCP bridge exposing a 209-tool catalog: decompilation, cross-references, renaming, typing, structures, comments and batch edits, plus P-code emulation, live debugging through Ghidra’s TraceRmi framework, shared Ghidra Server repository and version-control operations, and hash-based transfer of function documentation between binary versions. The bridge loads three tool groups on connect and lets the model search for and load the rest, while naming and type conventions are enforced in the tool layer. Its NOTICE says it began as a derivative of LaurieWired’s GhidraMCP in August 2025 and has since been substantially rewritten and extended.", "description_zh": "由 Ghidra 图形界面插件、独立无界面服务器和 Python MCP 桥接组成，提供含 209 个工具的目录：反编译、交叉引用、重命名、类型设定、结构体、注释与批量编辑，另有 P-code 模拟执行、经 Ghidra TraceRmi 框架的实时调试、共享 Ghidra Server 仓库与版本控制操作，以及基于哈希在不同版本二进制之间迁移函数文档。桥接在连接时只加载三组工具，其余由模型按需搜索并加载；命名与类型规范在工具层强制执行。其 NOTICE 说明，项目于 2025 年 8 月由 LaurieWired 的 GhidraMCP 衍生而来，此后已大幅重写和扩展。", "entry_url": "https://awesomerea.org/resources/ghidra-mcp-bethington/", "entry_url_zh": "https://awesomerea.org/zh/resources/ghidra-mcp-bethington/", "evidence_url": "https://github.com/bethington/ghidra-mcp/blob/cf8b12db27eb139b28b90eaa3488306da910d759/README.md", "group": "agents", "id": "ghidra-mcp-bethington", "json_url": "https://awesomerea.org/resources/ghidra-mcp-bethington/record.json", "kind": "integration", "markdown_url": "https://awesomerea.org/resources/ghidra-mcp-bethington/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/ghidra-mcp-bethington/index.md", "name": "Ghidra MCP Server (bethington)", "name_zh": "Ghidra MCP Server（bethington）", "record_type": "resource", "relationship": "independent-agent-integration", "requirements": [ "The reviewed pin is the default dev branch at bridge version 7.0.0 plus unreleased changes; the README calls tagged releases stable, release candidates and main beta, and dev experimental, with tools renamed and merged freely. At review the newest published build was the 7.0.0-rc.3 pre-release of 2026-10-14, which ships the extension zip and bridge wheel, and the newest stable release was v6.0.0 of 2026-07-25. The README says the GUI plugin serves 205 of the 209 tools and the headless server 190, with the debugger tools GUI-only.", "The extension loads only in the exact Ghidra version it was built for, Ghidra 12.1.4 at this pin, and needs Java 21; the bridge needs Python 3.10+, with uv recommended. Source builds use Maven 3.9+ or the committed Gradle wrapper, with install guides for Windows, Ubuntu/Debian, macOS and Arch Linux; Python Ghidra scripts need Ghidra’s optional Jython extension, and shared-server work needs a Ghidra Server version compatible with the 12.1 client. Clients connect over stdio or streamable HTTP, and a Docker Compose stack runs the headless server and bridge as two containers.", "Users analyse programs imported into their own Ghidra project; the repository ships only two generated PE test fixtures for its regression tiers. Write tools change the project, and script execution, which runs arbitrary Java inside Ghidra, stays off unless GHIDRA_MCP_ALLOW_SCRIPTS is set. The HTTP server binds 127.0.0.1 without authentication by default and refuses a non-loopback bind without GHIDRA_MCP_AUTH_TOKEN, which the Docker stack always requires; GHIDRA_MCP_FILE_ROOT confines file-path endpoints to one directory.", "CI builds the extension with Maven against a downloaded Ghidra, runs offline and real-Ghidra Java tests and Python unit and fake-server tests on Linux, and runs Python unit tests on Windows. docs/TESTING.md describes opt-in live tiers that import the fixtures into a running Ghidra and exercise endpoints and a debugger launch, and says the debugger tier is only partly restored. Sub-second responses, 93% fewer API calls through batching and workflows refined across hundreds of functions are the author’s claims.", "Apache-2.0; NOTICE credits the original LaurieWired GhidraMCP code, whose copyright remains for any surviving portions. Ghidra, MCP clients, model services and analysed programs keep their own terms." ], "requirements_zh": [ "所审阅的固定版本位于默认的 dev 分支，对应桥接包版本 7.0.0 及其后未发布的改动；README 将带标签的发布版视为稳定版，候选版与 main 分支视为测试版，dev 分支则属实验性质，工具会被随意改名与合并。审阅时最新发布的构建是 2026 年 10 月 14 日的 7.0.0-rc.3 预发布版，附带扩展压缩包和桥接 wheel；最新稳定版是 2026 年 7 月 25 日的 v6.0.0。README 称 209 个工具中，图形界面插件提供 205 个，无界面服务器提供 190 个，调试器工具仅限图形界面。", "扩展只能在构建时对应的那个 Ghidra 版本中加载，此固定版本对应 Ghidra 12.1.4，并需要 Java 21；桥接需要 Python 3.10+，建议使用 uv。从源码构建需 Maven 3.9+ 或仓库自带的 Gradle wrapper，并提供 Windows、Ubuntu／Debian、macOS 和 Arch Linux 的安装说明；Python 编写的 Ghidra 脚本需安装 Ghidra 可选的 Jython 扩展，使用共享服务器时需要与 12.1 客户端兼容的 Ghidra Server 版本。客户端可通过 stdio 或 streamable HTTP 连接，另有 Docker Compose 配置把无界面服务器与桥接分别运行在两个容器中。", "分析对象是使用者导入自己 Ghidra 项目中的程序；仓库只附带两个为回归测试生成的 PE 测试样本。写入类工具会修改项目，而脚本执行会在 Ghidra 内运行任意 Java 代码，除非设置 GHIDRA_MCP_ALLOW_SCRIPTS，否则默认关闭。HTTP 服务默认绑定 127.0.0.1 且不做认证；未设置 GHIDRA_MCP_AUTH_TOKEN 时拒绝绑定非回环地址，Docker 部署则始终要求该令牌；GHIDRA_MCP_FILE_ROOT 可把涉及文件路径的接口限制在一个目录内。", "CI 在 Linux 上针对下载的 Ghidra 用 Maven 构建扩展，运行离线与真实 Ghidra 的 Java 测试，以及 Python 单元测试和模拟服务器测试，并在 Windows 上运行 Python 单元测试。docs/TESTING.md 介绍了需手动启用的实机测试层级，会把测试样本导入运行中的 Ghidra，检查各接口并启动一次调试会话，同时说明调试器层级只部分恢复。亚秒级响应、批量操作减少 93% 的 API 调用、工作流经数百个函数打磨等均为作者说法。", "采用 Apache-2.0 许可；NOTICE 注明原始代码来自 LaurieWired 的 GhidraMCP，其仍保留的部分版权归原作者。Ghidra、MCP 客户端、模型服务及被分析的程序仍受各自条款约束。" ], "targets": [ "binary" ], "url": "https://github.com/bethington/ghidra-mcp", "verification": "source-reviewed", "verified_at": "2026-10-19" }