Integration
GhidraGPT
Ghidra extension that sends one function’s decompiled C to a hosted or local language model the user selects and streams the answer into a GhidraGPT console. Its three actions, offered in the Decompiler and Listing context menus, explain the function; rewrite it by writing recovered function, parameter and variable names, types, the prototype and inline comments back into the program; or audit it for likely security issues. Every action uses only the current function’s decompiler output, and the README calls audit findings leads to verify rather than sound static analysis.
- Targets
- Binary
- Category
- Independent agent workflows
- Relationship
- Independent agent integration
- Sources reviewed
Requirements & limits
- The reviewed main commit is the v1.4.0 release of 2026-07-22, which attaches GhidraGPT-1.4.0.zip. extension.properties declares Ghidra 12.1.2, and the README requires Ghidra 12.1.x, noting that the extension declares compatibility with the Ghidra version it is built against. Building from source needs JDK 21+, Maven and GHIDRA_INSTALL_DIR pointing at a local Ghidra; the zip is then added through Ghidra’s Install Extensions dialog.
- Each request sends the function name and its decompiled code, prefixed with instruction addresses for Rewrite together with a list of its variables, to the configured provider: OpenAI, Anthropic, Google Gemini, Cohere, Mistral AI, DeepSeek, Grok, OpenRouter, a local Ollama model or any OpenAI-compatible endpoint. Hosted providers need the user’s own API key, which the README says is stored in config.properties in a .ghidragpt folder under the user’s home directory with XOR obfuscation that is not encryption; every provider except Ollama needs network access.
- Rewrite applies the parsed names, types, prototype and comments in Ghidra transactions without a separate confirmation step. The README states that there is no interprocedural or whole-program analysis, so callers, callees and data flow outside the function are not given to the model.
- CI downloads Ghidra 12.1.2, sets up JDK 21 and runs Maven unit tests for configuration handling, prompt building and parsing of model responses and rewrite edits; these do not exercise the Ghidra interface or model output.
- Apache-2.0 license; the README names Mohamed Benchikh as author. Ghidra and each model provider keep their own licences and terms.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- extension.properties GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- pom.xml GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- src/main/java/ghidragpt/ui/Provider.java GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- src/main/java/ghidragpt/service/FunctionRewrite.java GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- src/main/java/ghidragpt/utils/PromptBuilder.java GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- src/main/java/ghidragpt/config/ConfigurationManager.java GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- .github/workflows/tests.yml GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- LICENSE GitHub · weirdmachine64/GhidraGPT · Revision 364e3f5
- https://github.com/weirdmachine64/GhidraGPT/releases/tag/v1.4.0
More in Agents and MCP
- GhidrAssist · Integration
- Rikugan · Integration
- bn · Integration
- IDA Pro MCP Server (fdrechsler) · Integration
- Ghidra Headless MCP · Integration
- Binary Ninja Headless MCP · Integration