GhidrAssist MCP Server

A powerful Ghidra extension that provides an MCP (Model Context Protocol) server, enabling AI assistants and other tools to interact with Ghidra's reverse engineering capabilities through a…

Local server

What is the GhidrAssist MCP Server?

GhidrAssist is an MCP project maintained in the symgraph/ghidrassistmcp repository. The maintainer describes its purpose as “A powerful Ghidra extension that provides an MCP (Model Context Protocol) server, enabling AI assistants and other tools to interact with Ghidra's reverse engineering capabilities…”. Read the project documentation for the complete scope.

Source

Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

ToolWhat it does
get_binary_infoGet basic program information (name, architecture, compiler, etc.)
list_binariesList all open programs across all CodeBrowser windows, including Project Path values for unambiguous program_name targeting
open_programList/open project programs in CodeBrowser, with optional analysis prompt suppression and analysis-after-open task submission
close_programClose an open CodeBrowser program; changed programs require save=true or ignore_changes=true
import_fileImport a host file into the current Ghidra project and optionally open it (disabled by default)
project_filesaction: list|delete
scriptsaction: list|get|create|delete|run
assemble_codeAssemble instruction text at an address and optionally patch it into program memory
patch_bytesPatch raw bytes in program memory at a given address
export_programExport the current program to disk (binary or original_file) (disabled by default)
analysis_optionsaction: list|set|reset|save_preset|apply_preset|list_presets|delete_preset
analyze_programRun Auto Analysis on the current program or all open programs; supports full re-analysis, pending-changes analysis, address ranges, and option overrides
analysis_controlaction: status|cancel
get_functionsList functions with optional pattern filtering and pagination
search_functions_by_nameFind functions by name pattern
get_function_statisticsComprehensive statistics for all functions
analyze_functionGet detailed function information (signature, variables, etc.)
get_current_functionGet function at current cursor position
get_function_stack_layoutGet stack frame layout with variable offsets
get_basic_blocksGet basic block information for a function
create_functionCreate/define a function at an address, optionally clearing existing data/code first
disassemble_atDisassemble code at an address, optionally clearing existing data/code in the range first
get_importsList imported functions/symbols
get_exportsList exported functions/symbols
get_stringsList string references with optional filtering
search_stringsSearch strings by pattern
get_segmentsList memory segments
get_namespacesList namespaces in the program
get_relocationsList relocation entries
get_entry_pointsList all binary entry points
get_data_varsList data definitions in the program
get_data_atGet hexdump/data at a specific address
create_data_varDefine data variables at addresses
get_current_addressGet current cursor address
formatdecompiler, disassembly, pcode
rawboolean
ActionDescription
listList all bookmarks
get_infoGet detailed data type information and structure definitions
addressFind all references to/from a specific address
functionFind all cross-references for a function
include_callsInclude callers/callees (replaces separate call graph tool)
createCreate a new structure from C definition or empty
modifyModify an existing structure with new C definition
mergeMerge (overlay) fields from a C definition onto an existing structure without deleting existing fields
set_fieldSet/insert a single field at a specific offset without needing a full C struct (use field_name to name it)
name_gapConvert undefined bytes at an offset/length into a named byte[]-like field (useful for “naming gaps”; uses field_name)
auto_createAutomatically create structure from variable usage patterns
rename_fieldRename a field within a structure
field_xrefsFind cross-references to a specific struct field
target_typefunction, data, variable
getGet comment at an address
setSet a new bookmark
removeRemove a bookmark
renameRename a local variable or a global/data symbol using scope
set_typeSet data type for a local variable
set_prototypeSet function signature/prototype
deleteDelete a data type by name (optionally scoped by category)
search_bytesSearch for byte patterns in memory
get_task_statusCheck status and retrieve results of async tasks
cancel_taskCancel a running async task
list_tasksList all pending/running/completed tasks
get_codeformat: decompiler|disassembly|pcode
classesaction: list|get_info
structaction: create|modify|merge|set_field|name_gap|auto_create|rename_field|field_xrefs
rename_symboltarget_type: function|data|variable
commentsaction: get|set|list|remove
variablesaction: list|rename|set_type|set_prototype with scope: auto|local|global for rename
typesaction: list|get|set|create_struct|create_enum|create_typedef|delete
bookmarksaction: list|set|remove
xrefsaddress|function with include_calls parameter
isReadOnly): Indicates if tool modifies program state
isLongRunning): Triggers async execution with task management
isCacheable): Enables result caching for repeated queries
isDestructive): Marks potentially dangerous operations
isIdempotent): Indicates if repeated calls produce same result