# x64dbg-MCP Server

> Native x64dbg plugin, written in Zig for both x32dbg and x64dbg, that serves an MCP endpoint over streamable HTTP and SSE from inside the debugger. Agents can load or attach to a process, set software, hardware, memory and conditional breakpoints, step and trace, read registers, call stacks, threads, memory maps, imports, strings and cross-references, and run arbitrary x64dbg commands. A bundled SKILL.md guide tells agents to confirm the debugger state before every action.

- Type: Integration
- Targets: Binary
- Category: Independent MCP integrations
- Relationship: Independent agent integration
- Sources reviewed: 2026-10-18
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/duty1g/x64dbg-mcp-server>
- Primary source: <https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/README.md>
- Catalog page: <https://awesomerea.org/resources/x64dbg-mcp-server/>
- Record JSON: <https://awesomerea.org/resources/x64dbg-mcp-server/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/x64dbg-mcp-server/index.md)

## Requirements & limits

- Windows with x64dbg; the plugin loads into x32dbg or x64dbg and resolves the debugger API at runtime. Install by copying the x32 and x64 plugin folders from the v1.6 release zip (2026-10-12) or a dist/ build into the x64dbg root; building needs Zig 0.16-dev or later and can cross-compile from Linux, macOS or WSL. The server starts automatically with the debugger.
- Ports are 9094 for x64 and 9095 for x32. The README lists 0.0.0.0 as the default bind address, but the reviewed configuration code has defaulted to 127.0.0.1 since v1.2; the plugin's config dialog changes the address, port and token and saves them to mcp_config.json beside the x64dbg executable. A bearer token generated on first run is required on every request, and traffic is unencrypted HTTP, so the README warns against exposing the server to untrusted networks.
- Many tools change the target or debugger state: memory writes and patches, instruction assembly, register writes, memory allocation, thread suspension, breakpoint commands and arbitrary debugger commands. DumpMemory and DumpModule write files to disk, and OEP detection and module dumping are aimed at packed executables.
- MIT. The README limits use to authorized reverse engineering, malware analysis, security research and education.

## Primary sources

1. <https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/README.md>
2. <https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/SKILL.md>
3. <https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/src/core/config.zig>
4. <https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/src/core/mcp_server.zig>
5. <https://github.com/duty1g/x64dbg-mcp-server/blob/18be30ab417a371fd441de68d7252d2bc1830f11/LICENSE>
6. <https://github.com/duty1g/x64dbg-mcp-server/releases/tag/v1.6>

## More in Agents and MCP

- [mcp-windbg](https://awesomerea.org/resources/mcp-windbg/index.md) · Integration
- [Wireshark MCP](https://awesomerea.org/resources/wireshark-mcp/index.md) · Integration
- [BINNY](https://awesomerea.org/resources/binny-agent-harness/index.md) · Integration
- [decomp.wtf](https://awesomerea.org/resources/decomp-wtf-agent-decompilation/index.md) · Integration
- [Claude Intercept](https://awesomerea.org/resources/claude-intercept-traffic-capture/index.md) · Integration
- [Ghidra MCP Server (bethington)](https://awesomerea.org/resources/ghidra-mcp-bethington/index.md) · Integration

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.