Top 200 ReposEXPLORER
Browse agents, categories and pages
Back to results
Planned, not doneThe source describes an intention, not a finished result.

Let an agent decompile and annotate a binary in Ghidra through GhidraMCP

GhidraMCP exposes Ghidra's decompiler and renaming tools over MCP, so an agent such as Claude Code can list functions, read decompiled code and propose clearer names.

Try the promptRead the original (opens in a new tab)

The problem

How it works

GhidraMCP is an Apache-2.0 MCP server shipped as a Ghidra extension plus a Python client. After installing the extension and enabling the plugin, an MCP client launches the ghidra-mcp command, which talks to Ghidra's local HTTP server. The agent can then decompile functions, list methods, classes, imports and exports, and rename functions and data. A headless mode through PyGhidra is also documented.

Results and limitations

The README documents setup and tools only and reports no case results. Its client configuration examples cover VS Code and Claude Code.

Before you try it

Analyse only software you own or are permitted to reverse engineer; many licences forbid it. Handle unknown binaries in a virtual machine even though static analysis in Ghidra does not need to run them. Names an agent proposes are hypotheses, so back up the Ghidra project and review renames before applying them. The current README targets Ghidra 12.1.4 and Python 3.10 or later. Results depend on your setup and were not independently reproduced by Top 200 Repos.

Tools and repositories

Tools
Ghidra 12.1.4 · GhidraMCP extension and Python client · An MCP client such as Claude Code
Prerequisites
Ghidra with the GhidraMCP extension enabled, uv or Python 3.10 or later, and permission to analyse the target.

Try it yourself: Map a binary before renaming anything

Fill the fields to adapt the prompt. Empty fields stay as visible [placeholders].

Preview
Using the GhidraMCP tools on [Program open in Ghidra], which is already open in Ghidra, list its imports and exports, then find the functions most likely responsible for [Behaviour to locate]. For each candidate, decompile it and give a short explanation, the evidence that supports your reading (strings, calls or constants) and a proposed new name. Do not rename anything yet: show a table of current name, proposed name and confidence, and apply only the rows I approve. Never execute the binary.

Confirm you have the right to analyse the program before starting.

Related videos

About NationalSecurityAgency/ghidra

Independent creators. Listing a video implies no endorsement, sponsorship or partnership.

Sources

  1. LaurieWired/GhidraMCP README (opens in a new tab)

    Project documentation · github.com · Undated · Source checked 11 Nov 2026, 22:04 UTC

    What this source supports
    • MCP server that exposes core Ghidra functions to LLM clients
    • Decompiles binaries, renames methods and data, and lists methods, classes, imports and exports
    • Installs as a Ghidra extension, with MCP clients launching the ghidra-mcp command
    • Configuration examples for VS Code and Claude Code
    • Optional headless mode with PyGhidra
    • Apache-2.0 licence
Report a problem

Reported by source

Audit kernel code for use-after-free bugs with a reasoning model

Sean Heelan benchmarked OpenAI o3 on a known ksmbd bug, then ran it across the SMB handlers, where it surfaced a new Linux kernel vulnerability, CVE-2025-37899.

sean.heelan.io · 22 May 2025
Reported by source

Hunt for variants of fixed bugs with an LLM agent, as Google's Big Sleep did in SQLite

Google's Big Sleep agent started from recent SQLite fixes, looked for related unfixed bugs and found an exploitable stack buffer underflow before it reached an official release.

projectzero.google · 1 Nov 2024
Reported by source

Answer technical questions by letting async agents run experiments

Simon Willison sends research questions to cloud coding agents such as Claude Code for web and Codex Cloud, which write and run experiments in a dedicated repo and open a PR.

simonwillison.net · 6 Nov 2025anthropics/claude-code, openai/codex
Planned, not done

Build a formula-driven Excel model with the Claude xlsx skill

Install Anthropic's xlsx skill in Claude Code so the agent writes live formulas, recalculates the workbook with LibreOffice and checks it for formula errors.

github.comanthropics/skills, anthropics/claude-code
Reported by source

Build an on-call investigation agent from your own alert history

Goutham Veeramachaneni connected Claude Code to Grafana's gcx CLI, his code and runbooks, then trained its skill on two weeks of past pages for his services.

gouthamve.dev · 21 Apr 2026anthropics/claude-code