GhidrAssistMCP MCP — 使用場景, 安裝 & 即時演示

為什麼要用

核心特性

35 MCP tools for binary analysis, function review, xrefs, renaming, and structure analysis
6 MCP resources: programs, functions, strings, imports, exports, segments
7 built-in prompts for common reverse engineering workflows
Multi-program and multi-window support with intelligent focus tracking
Result caching and async task management for large analyses

即時演示

實際使用效果

ghidrassistmcp.replay ▶ 就緒

0/0

安裝

選擇你的客戶端

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

開啟 Claude Desktop → Settings → Developer → Edit Config。儲存後重啟應用。

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

Cursor 使用與 Claude Desktop 相同的 mcpServers 格式。專案級設定優先於全域。

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

點擊 Cline 側欄中的 MCP Servers 圖示，然後選 "Edit Configuration"。

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "ghidrassistmcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  }
}

格式與 Claude Desktop 相同。重啟 Windsurf 生效。

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "ghidrassistmcp",
      "command": "TODO",
      "args": [
        "See README: https://github.com/symgraph/GhidrAssistMCP"
      ]
    }
  ]
}

Continue 使用伺服器物件陣列，而非映射。

~/.config/zed/settings.json

{
  "context_servers": {
    "ghidrassistmcp": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/symgraph/GhidrAssistMCP"
        ]
      }
    }
  }
}

加入 context_servers。Zed 儲存後熱重載。

claude mcp add ghidrassistmcp -- TODO 'See README: https://github.com/symgraph/GhidrAssistMCP'

一行命令搞定。用 claude mcp list 驗證，claude mcp remove 移除。

使用場景

實戰用法： GhidrAssistMCP

How to analyze an unknown binary with AI assistance in Ghidra

👤 Security researchers and malware analysts working in sandboxed environments ⏱ ~60 min advanced

何時使用： You have a binary to analyze and want AI to help understand its functionality.

前置條件

Ghidra 11.4+ with GhidrAssistMCP installed — Download release ZIP, install via File → Install Extensions
MCP client (e.g., Claude Desktop) — Configure to connect to GhidrAssistMCP's HTTP endpoint

步驟

Get binary overview

Get the binary info and list all imports. What libraries does this binary depend on and what do the imports suggest about its functionality?✓ 已複製

→ Binary metadata with categorized import analysis
Analyze key functions

Find functions that reference network-related strings. Decompile the most interesting one and explain what it does.✓ 已複製

→ Decompiled C code with annotated explanation
Rename and annotate

Based on our analysis, rename the functions we've identified with descriptive names and add comments explaining their purpose.✓ 已複製

→ Confirmation of renamed symbols

結果： A partially annotated binary with key functions identified, named, and documented.

注意事項

Large binaries with thousands of functions overwhelm the analysis — Start with imports and strings to identify interesting functions, then focus on those

搭配使用： filesystem

Solve a CTF binary reverse engineering challenge with Ghidra and AI

👤 CTF participants tackling reverse engineering challenges ⏱ ~45 min intermediate

何時使用： You have a CTF binary that needs to be reversed to find a flag.

前置條件

Ghidra with GhidrAssistMCP — Install the extension and load the challenge binary

步驟

Find the main logic

Search for functions that reference 'flag', 'correct', 'wrong', or 'password'. Decompile the most relevant one.✓ 已複製

→ Decompiled function with validation logic
Trace the check

Follow the xrefs from the validation function. What data does it compare against and what transformation is applied to the input?✓ 已複製

→ Detailed analysis of the check algorithm with data references

結果： Understanding of the validation logic sufficient to derive the flag.

注意事項

Obfuscated binaries resist straightforward decompilation — Use get_basic_blocks to understand control flow, then analyze blocks individually

組合

與其他 MCP 搭配，撬動十倍槓桿

ghidrassistmcp + filesystem

Export analysis results and annotated code to files for reporting

Export the decompiled code and our annotations for the network functions to a report file.✓ 已複製

工具

此 MCP 暴露的能力

工具	輸入參數	何時呼叫
get_binary_info	none	Get metadata about the loaded binary
get_functions	offset?: int, limit?: int	List functions in the binary
analyze_function	address: str	Decompile and analyze a specific function
search_strings	pattern: str	Search for strings in the binary
xrefs	address: str, action: str	Find cross-references to/from an address
rename_symbol	old_name: str, new_name: str	Rename a function or variable
get_imports	none	List all imported functions
get_basic_blocks	function_address: str	Get control flow blocks for a function

成本與限制

運行它的成本

API 配額: N/A — fully local
每次呼叫 Token 數: 200–2000 tokens (decompilation results can be large)
費用: Free — both Ghidra and GhidrAssistMCP are free
提示: Use search_functions_by_name and search_strings to narrow targets before decompiling.

安全

權限、密鑰、影響範圍

憑證儲存： N/A

資料出站： Local only — Ghidra analysis stays on your machine

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
Only analyze binaries you have legal right to reverse engineer.

故障排查

常見錯誤與修復

Plugin not showing in Ghidra

Ensure you installed the extension ZIP via File → Install Extensions, then restarted Ghidra. Enable via File → Configure → Configure Plugins.

驗證： Search for 'GhidrAssistMCP' in the plugin configuration dialog

MCP client can't connect

Check the GhidrAssistMCP port in the plugin settings. Ensure no firewall blocks the connection.

驗證： Check the Ghidra console for MCP server startup messages

Decompilation fails for a function

Some functions (especially obfuscated ones) may fail to decompile. Try disassembly instead, or fix the function boundaries with define_func.

驗證： Use get_code as a fallback

替代方案

GhidrAssistMCP 對比其他方案

替代方案	何時用它替代	權衡
reverse-engineering-assistant	You want a tool-driven approach optimized for LLM interaction with focus on context management	Fewer tools but designed to reduce LLM hallucinations
ida-pro-mcp	You prefer IDA Pro over Ghidra for binary analysis	IDA Pro is commercial ($) but has broader format support and faster analysis

GhidrAssistMCP

為什麼要用

核心特性

即時演示

實際使用效果

安裝

選擇你的客戶端

使用場景

實戰用法： GhidrAssistMCP

How to analyze an unknown binary with AI assistance in Ghidra

前置條件

步驟

注意事項

Solve a CTF binary reverse engineering challenge with Ghidra and AI

前置條件

步驟

注意事項

組合

與其他 MCP 搭配，撬動十倍槓桿

工具

此 MCP 暴露的能力

成本與限制

運行它的成本

安全

權限、密鑰、影響範圍

故障排查

常見錯誤與修復

替代方案

GhidrAssistMCP 對比其他方案

更多

資源