GhidrAssistMCP MCP — 사용 사례, 설치 & 라이브 데모

왜 쓰나요

핵심 기능

35 MCP tools for binary analysis, function review, xrefs, renaming, and structure analysis
6 MCP resources: programs, functions, strings, imports, exports, segments
7 built-in prompts for common reverse engineering workflows
Multi-program and multi-window support with intelligent focus tracking
Result caching and async task management for large analyses

라이브 데모

실제 사용 모습

ghidrassistmcp.replay ▶ 준비됨

0/0

설치

클라이언트 선택

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

Claude Desktop → Settings → Developer → Edit Config 열기. 저장 후 앱 재시작.

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

Cursor는 Claude Desktop과 동일한 mcpServers 스키마 사용. 프로젝트 설정이 전역보다 우선.

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

Cline 사이드바의 MCP Servers 아이콘 클릭 후 "Edit Configuration" 선택.

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

Claude Desktop과 같은 형식. Windsurf 재시작 후 적용.

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "ghidrassistmcp",
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  ]
}

Continue는 맵이 아닌 서버 오브젝트 배열 사용.

~/.config/zed/settings.json

{
  "context_servers": {
    "ghidrassistmcp": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/symgraph/GhidrAssistMCP"
        ]
      }
    }
  }
}

context_servers에 추가. 저장 시 Zed가 핫 리로드.

claude mcp add ghidrassistmcp -- TODO 'See README: https://github.com/symgraph/GhidrAssistMCP'

한 줄 명령. claude mcp list로 확인, claude mcp remove로 제거.

사용 사례

실전 활용법: GhidrAssistMCP

How to analyze an unknown binary with AI assistance in Ghidra

👤 Security researchers and malware analysts working in sandboxed environments ⏱ ~60 min advanced

언제 쓸까: You have a binary to analyze and want AI to help understand its functionality.

사전 조건

Ghidra 11.4+ with GhidrAssistMCP installed — Download release ZIP, install via File → Install Extensions
MCP client (e.g., Claude Desktop) — Configure to connect to GhidrAssistMCP's HTTP endpoint

흐름

Get binary overview

Get the binary info and list all imports. What libraries does this binary depend on and what do the imports suggest about its functionality?✓ 복사됨

→ Binary metadata with categorized import analysis
Analyze key functions

Find functions that reference network-related strings. Decompile the most interesting one and explain what it does.✓ 복사됨

→ Decompiled C code with annotated explanation
Rename and annotate

Based on our analysis, rename the functions we've identified with descriptive names and add comments explaining their purpose.✓ 복사됨

→ Confirmation of renamed symbols

결과: A partially annotated binary with key functions identified, named, and documented.

함정

Large binaries with thousands of functions overwhelm the analysis — Start with imports and strings to identify interesting functions, then focus on those

함께 쓰기: filesystem

Solve a CTF binary reverse engineering challenge with Ghidra and AI

👤 CTF participants tackling reverse engineering challenges ⏱ ~45 min intermediate

언제 쓸까: You have a CTF binary that needs to be reversed to find a flag.

사전 조건

Ghidra with GhidrAssistMCP — Install the extension and load the challenge binary

흐름

Find the main logic

Search for functions that reference 'flag', 'correct', 'wrong', or 'password'. Decompile the most relevant one.✓ 복사됨

→ Decompiled function with validation logic
Trace the check

Follow the xrefs from the validation function. What data does it compare against and what transformation is applied to the input?✓ 복사됨

→ Detailed analysis of the check algorithm with data references

결과: Understanding of the validation logic sufficient to derive the flag.

함정

Obfuscated binaries resist straightforward decompilation — Use get_basic_blocks to understand control flow, then analyze blocks individually

조합

다른 MCP와 조합해 10배 효율

ghidrassistmcp + filesystem

Export analysis results and annotated code to files for reporting

Export the decompiled code and our annotations for the network functions to a report file.✓ 복사됨

도구

이 MCP가 노출하는 것

도구	입력	언제 호출
get_binary_info	none	Get metadata about the loaded binary
get_functions	offset?: int, limit?: int	List functions in the binary
analyze_function	address: str	Decompile and analyze a specific function
search_strings	pattern: str	Search for strings in the binary
xrefs	address: str, action: str	Find cross-references to/from an address
rename_symbol	old_name: str, new_name: str	Rename a function or variable
get_imports	none	List all imported functions
get_basic_blocks	function_address: str	Get control flow blocks for a function

비용 및 제한

운영 비용

API 쿼터: N/A — fully local
호출당 토큰: 200–2000 tokens (decompilation results can be large)
금액: Free — both Ghidra and GhidrAssistMCP are free
팁: Use search_functions_by_name and search_strings to narrow targets before decompiling.

보안

권한, 시크릿, 파급범위

자격 증명 저장: N/A

데이터 외부 송신: Local only — Ghidra analysis stays on your machine

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
Only analyze binaries you have legal right to reverse engineer.

문제 해결

자주 발생하는 오류와 해결

Plugin not showing in Ghidra

Ensure you installed the extension ZIP via File → Install Extensions, then restarted Ghidra. Enable via File → Configure → Configure Plugins.

확인: Search for 'GhidrAssistMCP' in the plugin configuration dialog

MCP client can't connect

Check the GhidrAssistMCP port in the plugin settings. Ensure no firewall blocks the connection.

확인: Check the Ghidra console for MCP server startup messages

Decompilation fails for a function

Some functions (especially obfuscated ones) may fail to decompile. Try disassembly instead, or fix the function boundaries with define_func.

확인: Use get_code as a fallback

대안

GhidrAssistMCP 다른 것과 비교

대안	언제 쓰나	단점/장점
reverse-engineering-assistant	You want a tool-driven approach optimized for LLM interaction with focus on context management	Fewer tools but designed to reduce LLM hallucinations
ida-pro-mcp	You prefer IDA Pro over Ghidra for binary analysis	IDA Pro is commercial ($) but has broader format support and faster analysis

GhidrAssistMCP

왜 쓰나요

핵심 기능

라이브 데모

실제 사용 모습

설치

클라이언트 선택

사용 사례

실전 활용법: GhidrAssistMCP

How to analyze an unknown binary with AI assistance in Ghidra

사전 조건

흐름

함정

Solve a CTF binary reverse engineering challenge with Ghidra and AI

사전 조건

흐름

함정

조합

다른 MCP와 조합해 10배 효율

도구

이 MCP가 노출하는 것

비용 및 제한

운영 비용

보안

권한, 시크릿, 파급범위

문제 해결

자주 발생하는 오류와 해결

대안

GhidrAssistMCP 다른 것과 비교

더 보기

리소스