[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-78598":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":20,"compositeScore":21,"rankGlobal":10,"rankLanguage":10,"license":22,"archived":23,"fork":23,"defaultBranch":24,"hasWiki":25,"hasPages":23,"topics":26,"createdAt":10,"pushedAt":10,"updatedAt":38,"readmeContent":39,"aiSummary":40,"trendingCount":16,"starSnapshotCount":16,"syncStatus":41,"lastSyncTime":42,"discoverSource":43},78598,"ghidra-mcp","bethington\u002Fghidra-mcp","bethington","Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.","",null,"Java",2385,26,7,6,0,85,236,330,255,106.29,"Apache License 2.0",false,"main",true,[27,28,29,30,31,32,33,34,35,36,37],"ai","binary-analysis","ghidra","ghidra-extension","java","mcp","mcp-server","model-context-protocol","python","reverse-engineering","static-analysis","2026-06-12 04:01:23","# Ghidra MCP Server\n\n[![Tests](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Factions\u002Fworkflow\u002Fstatus\u002Fbethington\u002Fghidra-mcp\u002Ftests.yml?branch=main&style=for-the-badge&label=Tests&logo=github-actions&logoColor=white)](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp\u002Factions\u002Fworkflows\u002Ftests.yml)\n[![Release](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fv\u002Frelease\u002Fbethington\u002Fghidra-mcp?style=for-the-badge&logo=github&logoColor=white&color=blue)](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp\u002Freleases\u002Flatest)\n[![License](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Flicense\u002Fbethington\u002Fghidra-mcp?style=for-the-badge&color=green)](LICENSE)\n[![GitHub Sponsors](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fsponsors\u002Fbethington?style=for-the-badge&logo=githubsponsors&logoColor=white&label=Sponsors&labelColor=ea4aaa&color=ea4aaa)](https:\u002F\u002Fgithub.com\u002Fsponsors\u002Fbethington)\n\n[![Python](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fpython-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776AB?style=for-the-badge&logo=python&logoColor=white)](https:\u002F\u002Fwww.python.org\u002F)\n[![Java](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FJava-21-ED8B00?style=for-the-badge&logo=openjdk&logoColor=white)](https:\u002F\u002Fopenjdk.org\u002Fprojects\u002Fjdk\u002F21\u002F)\n[![Ghidra](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FGhidra-12.1-brightgreen?style=for-the-badge&logoColor=white)](https:\u002F\u002Fghidra-sre.org\u002F)\n[![MCP](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FMCP-Model%20Context%20Protocol-6C5CE7?style=for-the-badge&logoColor=white)](https:\u002F\u002Fmodelcontextprotocol.io\u002F)\n\n[![Stars](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fstars\u002Fbethington\u002Fghidra-mcp?style=for-the-badge&logo=github&logoColor=white&color=yellow)](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp\u002Fstargazers)\n[![Last commit](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Flast-commit\u002Fbethington\u002Fghidra-mcp?style=for-the-badge&logo=git&logoColor=white)](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp\u002Fcommits\u002Fmain)\n[![Discussions](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fdiscussions-join-7B68EE?style=for-the-badge&logo=github&logoColor=white)](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp\u002Fdiscussions)\n[![Issues](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fissues\u002Fbethington\u002Fghidra-mcp?style=for-the-badge&logo=github&logoColor=white&color=orange)](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp\u002Fissues)\n[![OpenSSF Scorecard](https:\u002F\u002Fapi.securityscorecards.dev\u002Fprojects\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp\u002Fbadge)](https:\u002F\u002Fscorecard.dev\u002Fviewer\u002F?uri=github.com\u002Fbethington\u002Fghidra-mcp)\n\n> If you find this useful, please ⭐ star the repo — it helps others discover it!\n>\n> If Ghidra MCP saves you time, consider [sponsoring the project](https:\u002F\u002Fgithub.com\u002Fsponsors\u002Fbethington). One-time and recurring support both help fund compatibility updates, production hardening, docs, and new tooling.\n\nA production-ready Model Context Protocol (MCP) server that bridges Ghidra's powerful reverse engineering capabilities with modern AI tools and automation frameworks. **245 MCP tools**, battle-tested AI workflows, and the most comprehensive Ghidra-MCP integration available — now including P-code emulation, live debugger integration, and PCode-graph data flow analysis.\n\n## Why Ghidra MCP?\n\nMost Ghidra MCP implementations give you a handful of read-only tools and call it a day. This project is different — it was built by a reverse engineer who uses it daily on real binaries, not as a demo.\n\n- **245 MCP tools** — 3x more than any competing implementation. Not just read operations — full write access for renaming, typing, commenting, structure creation, script execution, P-code emulation, and live debugging.\n- **Battle-tested AI workflows** — Proven documentation workflows (V5) refined across hundreds of functions. Includes step-by-step prompts, Hungarian notation reference, batch processing guides, and orphaned code discovery.\n- **Production-grade reliability** — Atomic transactions, batch operations (93% API call reduction), configurable timeouts, and graceful error handling. No silent failures.\n- **Cross-binary documentation transfer** — SHA-256 function hash matching propagates documentation across binary versions automatically. Document once, apply everywhere.\n- **Full Ghidra Server integration** — Connect to shared Ghidra servers, manage repositories, version control, checkout\u002Fcheckin workflows, and multi-user collaboration.\n- **Headless and GUI modes** — Run with or without the Ghidra GUI. Docker-ready for CI\u002FCD pipelines and automated analysis at scale.\n- **Opinionated by design** — v5.0 moves naming conventions, type safety, and documentation standards into the tool layer. AI agents and human engineers produce consistent output without style guides in every prompt.\n\n## Convention Enforcement\n\nYou've been there: six months into a project you find `ProcessItem`, `process_items`, `handleItem`, and `ItemProc` in the same codebase — four functions doing the same thing, named by four different sessions or engineers with no shared contract. Fixing it takes longer than it should, and the problem will happen again.\n\nv5.0 moves conventions from \"things to remember\" into the tool layer, where they can actually be enforced.\n\n| Tier | Behavior | Example |\n|------|----------|---------|\n| **Auto-fix** | Applied silently | `count` field on a `uint32` → auto-prefixed `dwCount` on save |\n| **Warn** | Change goes through, warning returned | `processData` → \"name should be PascalCase with a verb: `ProcessData`\" |\n| **Reject** | Change blocked with explanation | `undefined → undefined` type change → \"no-op rejected, type unchanged\" |\n\n**For AI agents**, this means consistent output across every session, every model, every run — without pasting a style guide into every prompt. The tool knows the rules; the model just needs to make the call.\n\n**For teams**, it eliminates the entire class of review comment that says \"that's not our naming convention.\" Convention arbitration stays in the tool, not in code review.\n\n**For solo work at scale**, `analyze_function_completeness` gives you a 0–100% score that measures honestly: structural deductions (unfixable compiler artifacts) are forgiven in your effective score, log-scaling prevents one bad category from burying everything else, and tiered plate comment quality means you know exactly what's missing and why.\n\n## 🌟 Features\n\n### Core MCP Integration\n- **Full MCP Compatibility** — Complete implementation of Model Context Protocol\n- **245 MCP Tools** — Comprehensive API surface covering every aspect of binary analysis\n- **Production-Ready Reliability** — Atomic transactions, batch operations, configurable timeouts\n- **Real-time Analysis** — Live integration with Ghidra's analysis engine\n\n> **Compatibility note:** MCP tool names are normalized for GitHub Copilot CLI\n> and CAPI validation. Exposed tool names use lowercase letters, digits,\n> underscores, and hyphens only; nested HTTP paths such as `\u002Fdebugger\u002Fstatus`\n> are advertised as names like `debugger_status_2` when needed to avoid\n> collisions with static bridge tools.\n\n### Binary Analysis Capabilities\n- **Function Analysis** — Decompilation, call graphs, cross-references, completeness scoring\n- **Data Flow Analysis** — PCode-graph value propagation (forward \u002F backward) from any variable or register\n- **Data Structure Discovery** — Struct\u002Funion\u002Fenum creation with field analysis and naming suggestions\n- **String Extraction** — Regex search, quality filtering, and string-anchored function discovery\n- **Import\u002FExport Analysis** — Symbol tables, external locations, ordinal import resolution\n- **Memory & Data Inspection** — Raw memory reads, byte pattern search, array boundary detection\n- **Cross-Binary Documentation** — Function hash matching and documentation propagation across versions\n\n### Dynamic Analysis (v5.4.0)\n- **P-code Emulation** — Run any function in isolation via Ghidra's `EmulatorHelper`; brute-force API hash resolution in milliseconds\n- **Live Debugger Integration** — 17 Java endpoints + 22 Python bridge tools over Ghidra's TraceRmi framework (dbgeng on Windows PE, gdb\u002Flldb otherwise): attach, step, breakpoints, registers, memory reads, non-breaking function tracing, ASLR-aware static↔dynamic address translation\n\n### AI-Powered Reverse Engineering Workflows\n- **Function Documentation Workflow V5** — 7-step process for complete function documentation with Hungarian notation, type auditing, and automated verification scoring\n- **Batch Documentation** — Parallel subagent dispatch for documenting multiple functions simultaneously\n- **Orphaned Code Discovery** — Automated scanner finds undiscovered functions in gaps between known code\n- **Data Type Investigation** — Systematic workflows for structure discovery and field analysis\n- **Cross-Version Matching** — Hash-based function matching across different binary versions\n\n### Development & Automation\n- **Ghidra Script Management** — Create, run, update, and delete Ghidra scripts entirely via MCP\n- **Multi-Program Support** — Switch between and compare multiple open programs\n- **Batch Operations** — Bulk renaming, commenting, typing, and label management (93% fewer API calls)\n- **Headless Server** — Full analysis without Ghidra GUI — Docker and CI\u002FCD ready\n- **Project & Version Control** — Create projects, manage files, Ghidra Server integration\n- **Analysis Control** — List, configure, and trigger Ghidra analyzers programmatically\n\n## 🚀 Quick Start\n\n### Prerequisites\n\n- **Java 21 LTS** (OpenJDK recommended)\n- **Apache Maven 3.9+**\n- **Ghidra 12.1** (or compatible version)\n- **Python 3.10+** with pip\n\n> Shared Ghidra Server users: Ghidra 12.1 clients require a Ghidra\n> Server at 12.1, 12.0.5, or a newer compatible version. Upgrade the\n> server before using this plugin from a 12.1 client.\n>\n> Ghidra 12.1 ships Jython as an optional extension. Java scripts work\n> by default, but `.py` scripts in `ghidra_scripts\u002F` require installing\n> the Jython extension from **File > Install Extensions** and restarting\n> Ghidra.\n\n### Installation\n\n> Recommended for all platforms: use `python -m tools.setup` directly.\n>\n> `ensure-prereqs` installs runtime Python requirements plus the Ghidra JARs needed in the local Maven repository.\n> `deploy` copies the build output, installs the user-profile extension, and patches Ghidra user config.\n\n1. **Clone the repository:**\n   ```bash\n   git clone https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp.git\n   cd ghidra-mcp\n   ```\n\n2. **Recommended: run environment preflight first:**\n   ```text\n   python -m tools.setup preflight --ghidra-path \"F:\\ghidra_12.1_PUBLIC\"\n   ```\n\n3. **Build and deploy to Ghidra:**\n   ```text\n   python -m tools.setup ensure-prereqs --ghidra-path \"F:\\ghidra_12.1_PUBLIC\"\n   python -m tools.setup build\n   python -m tools.setup deploy --ghidra-path \"F:\\ghidra_12.1_PUBLIC\"\n   ```\n\n   `deploy` saves\u002Fcloses an already-running matching Ghidra instance when\n   needed, installs the extension, starts Ghidra, waits for MCP health, and runs\n   schema smoke checks.\n\n4. **Optional strict\u002Fmanual mode** (advanced):\n   ```text\n   # Skip automatic prerequisite setup\n   python -m tools.setup build\n   python -m tools.setup deploy --ghidra-path \"F:\\ghidra_12.1_PUBLIC\"\n   ```\n\n5. **Show command help**:\n   ```text\n   python -m tools.setup --help\n   ```\n\n6. **Optional build-only mode** (advanced\u002Ftroubleshooting):\n   ```text\n   python -m tools.setup build\n   ```\n\n   Supported build path: `python -m tools.setup build` uses Maven under the hood and is the canonical workflow used by the repo tasks and docs.\n\n   ```bash\n   # Manual Maven build (requires Ghidra deps already installed in local .m2)\n   mvn clean package assembly:single -DskipTests\n   ```\n\n   ```bash\n   # Secondary\u002Fmanual Gradle build path only (not used by tools.setup or VS Code tasks)\n   GHIDRA_INSTALL_DIR=\u002Fpath\u002Fto\u002Fghidra gradle buildExtension\n   ```\n\n### Installation (Linux — Ubuntu\u002FDebian)\n\n1. **Clone the repository:**\n   ```bash\n   git clone https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp.git\n   cd ghidra-mcp\n   ```\n\n2. **Install system prerequisites** (if not already installed):\n   ```bash\n   sudo apt update && sudo apt install -y openjdk-21-jdk maven python3 python3-pip curl jq unzip\n   ```\n\n3. **Run environment preflight:**\n   ```bash\n   python -m tools.setup preflight --ghidra-path ~\u002Fghidra_12.1_PUBLIC\n   ```\n\n4. **Build and deploy to Ghidra (single command):**\n   ```bash\n   python -m tools.setup ensure-prereqs --ghidra-path ~\u002Fghidra_12.1_PUBLIC\n   python -m tools.setup build\n   python -m tools.setup deploy --ghidra-path ~\u002Fghidra_12.1_PUBLIC\n   ```\n\n   This will:\n   - Install Ghidra JAR dependencies into your local `~\u002F.m2\u002Frepository`\n   - Build `GhidraMCP-\u003Cversion>.zip` with Maven\n   - Extract the extension to `~\u002F.config\u002Fghidra\u002Fghidra_\u003Cversion>_PUBLIC\u002FExtensions\u002F`\n   - Update `preferences` with `LastExtensionImportDirectory`\n   - Install Python requirements\n\n5. **Optional: setup only Maven dependencies:**\n   ```bash\n   python -m tools.setup install-ghidra-deps --ghidra-path ~\u002Fghidra_12.1_PUBLIC\n   ```\n\n6. **Show command help:**\n   ```bash\n   python -m tools.setup --help\n   ```\n\n> **Linux paths:** The extension is installed to `$HOME\u002F.config\u002Fghidra\u002Fghidra_\u003Cversion>_PUBLIC\u002FExtensions\u002FGhidraMCP\u002F`.\n> Ghidra config files are in `$HOME\u002F.config\u002Fghidra\u002Fghidra_\u003Cversion>_PUBLIC\u002F`.\n\n### Installation (macOS — Homebrew)\n\n1. **Install prerequisites:**\n   ```bash\n   brew install openjdk@21 maven python ghidra\n   ```\n\n2. **Clone the repository:**\n   ```bash\n   git clone https:\u002F\u002Fgithub.com\u002Fbethington\u002Fghidra-mcp.git\n   cd ghidra-mcp\n   ```\n\n3. **Install Ghidra JARs into local Maven:**\n   ```bash\n    python -m tools.setup install-ghidra-deps \\\n       --ghidra-path \u002Fopt\u002Fhomebrew\u002Fopt\u002Fghidra\u002Flibexec\n   ```\n\n4. **Build and deploy:**\n   ```bash\n    python -m tools.setup ensure-prereqs \\\n       --ghidra-path \u002Fopt\u002Fhomebrew\u002Fopt\u002Fghidra\u002Flibexec\n    python -m tools.setup build\n    python -m tools.setup deploy \\\n       --ghidra-path \u002Fopt\u002Fhomebrew\u002Fopt\u002Fghidra\u002Flibexec\n   ```\n   The extension is installed to `~\u002FLibrary\u002Fghidra\u002Fghidra_12.1_PUBLIC\u002FExtensions\u002FGhidraMCP\u002F`.\n\n   > **Note:** `--ghidra-version` is required when using the Homebrew path because the path contains no version string.\n\n5. **Start Ghidra and enable the plugin:**\n   ```bash\n   \u002Fopt\u002Fhomebrew\u002Fopt\u002Fghidra\u002Flibexec\u002FghidraRun\n   ```\n   In the main project window: **Tools > GhidraMCP > Start MCP Server**\n\n6. **Configure Cursor\u002FClaude MCP** (`~\u002F.cursor\u002Fmcp.json`):\n   ```json\n   {\n     \"mcpServers\": {\n       \"ghidra\": {\n         \"command\": \"uv\",\n         \"args\": [\"run\", \"--script\", \"\u002Fpath\u002Fto\u002Fghidra-mcp\u002Fbridge_mcp_ghidra.py\"]\n       }\n     }\n   }\n   ```\n\n### Installation (Arch Linux — AUR)\n\n[@Pandoriaantje](https:\u002F\u002Fgithub.com\u002FPandoriaantje) maintains community AUR packages:\n\n- [`ghidra-mcp-git`](https:\u002F\u002Faur.archlinux.org\u002Fpackages\u002Fghidra-mcp-git) — tracks `main`\n- [`ghidra-mcp`](https:\u002F\u002Faur.archlinux.org\u002Fpackages\u002Fghidra-mcp) — tracks tagged releases\n\nInstall with your AUR helper of choice, e.g.:\n\n```bash\nyay -S ghidra-mcp        # or ghidra-mcp-git\n```\n\n### Basic Usage\n\n#### Option 1: Stdio Transport (Recommended for AI tools)\n```bash\npython bridge_mcp_ghidra.py\n```\n\n#### Option 2: Streamable HTTP Transport (Recommended for web\u002FHTTP clients)\n```bash\npython bridge_mcp_ghidra.py --transport streamable-http --mcp-host 127.0.0.1 --mcp-port 8081\n```\n\nMCP client config for the HTTP transport (add to your client's MCP config file):\n```json\n{\n  \"mcpServers\": {\n    \"ghidra-mcp-http\": {\n      \"url\": \"http:\u002F\u002F127.0.0.1:8081\u002Fmcp\"\n    }\n  }\n}\n```\n\n#### Option 3: SSE Transport (Deprecated — use streamable-http instead)\n```bash\npython bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081\n```\n\n#### Bridge advanced flags\n\n| Flag | Default | Description |\n|------|---------|-------------|\n| `--transport` | `stdio` | `stdio` (AI tools), `streamable-http` (web clients), `sse` (deprecated) |\n| `--mcp-host` | `127.0.0.1` | Bind host for HTTP transports |\n| `--mcp-port` | — | Port for HTTP transports |\n| `--lazy` | off | Load only the default tool groups on connect. Faster startup, but MCP clients that don't support `tools\u002Flist_changed` will see an incomplete tool list. Not recommended for Claude Code. |\n| `--no-lazy` | (default) | Load all tool groups immediately on connect. Required for most AI clients. |\n| `--default-groups` | `listing,function,program` | Comma-separated groups loaded on connect when `--lazy` is set. |\n\n#### Optional: Start the standalone debugger server\n```bash\npython -m pip install -r requirements-debugger.txt\npython -m debugger\n```\n\nThe debugger server listens on `http:\u002F\u002F127.0.0.1:8099\u002F` by default and is\nrequired for the `debugger_*` proxy tools exposed by the MCP bridge.\n\nDebugger server flags:\n\n| Flag | Default | Description |\n|------|---------|-------------|\n| `--port` | `8099` | HTTP server port |\n| `--host` | `127.0.0.1` | Bind address (`0.0.0.0` to expose on LAN) |\n| `--exports-dir` | — | Path to a `dll_exports\u002F` directory for ordinal-to-name resolution |\n| `--log-level` | `INFO` | `DEBUG`, `INFO`, `WARNING`, or `ERROR` |\n\nSet `GHIDRA_DEBUGGER_URL` in `.env` if you change the default port or host so the bridge can find it.\n\n#### In Ghidra\n1. Start Ghidra and open a **CodeBrowser** window\n2. In **CodeBrowser**, enable the plugin via **File > Configure > Configure All Plugins > GhidraMCP**\n3. Optional: configure custom port via **CodeBrowser > Edit > Tool Options > GhidraMCP HTTP Server**\n4. Start the server via **Tools > GhidraMCP > Start MCP Server**\n5. The server runs on `http:\u002F\u002F127.0.0.1:8089\u002F` by default\n\n#### Verify It's Working\n```bash\n# Quick health check\ncurl http:\u002F\u002F127.0.0.1:8089\u002Fcheck_connection\n# Expected: \"Connected: GhidraMCP plugin running with program '\u003Cname>'\"\n\n# Get version info\ncurl http:\u002F\u002F127.0.0.1:8089\u002Fget_version\n```\n\n## Support This Project\n\nIf Ghidra MCP saves you engineering or reverse-engineering time, consider [sponsoring the project](https:\u002F\u002Fgithub.com\u002Fsponsors\u002Fbethington).\n\n- One-time sponsorship helps fund fixes, compatibility updates, and release work.\n- Recurring sponsorship helps keep maintenance, docs, and production hardening moving.\n- Company support helps prioritize long-term reliability for the bridge, headless server, debugger integration, and workflow tooling.\n\n## 🔒 Security\n\nGhidraMCP is designed for **localhost-only development**. The default configuration — HTTP server bound to `127.0.0.1`, no authentication — is safe on a trusted single-user workstation and matches pre-v5.4.1 behavior.\n\n**If you expose the server beyond loopback, configure these three environment variables first.** The server refuses to start on a non-loopback bind without a token.\n\n| Env var | Effect |\n|---|---|\n| `GHIDRA_MCP_AUTH_TOKEN` | When set, every HTTP request must carry `Authorization: Bearer \u003Ctoken>`. Timing-safe comparison. `\u002Fmcp\u002Fhealth`, `\u002Fhealth`, `\u002Fcheck_connection` are exempt. |\n| `GHIDRA_MCP_ALLOW_SCRIPTS` | Set to `1`, `true`, or `yes` to enable `\u002Frun_script_inline` and `\u002Frun_ghidra_script`. **Off by default as of v5.4.1** — these endpoints execute arbitrary Java against the Ghidra process. |\n| `GHIDRA_MCP_FILE_ROOT` | When set to a directory path, filesystem-path endpoints (`\u002Fimport_file`, `\u002Fopen_project`, `\u002Fdelete_file`, etc.) canonicalize the input and require it to fall under this root. Prevents path-traversal. |\n\nName-quality enforcement is separate from security. By default,\n`rename_function_by_address` and global write endpoints reject names that fail\nthe built-in quality gates, and struct field writes apply the built-in field\nprefix convention. Disable the built-in convention layer with **Edit > Tool\nOptions > GhidraMCP HTTP Server > Strict Naming Enforcement**. The same Tool\nOptions checkbox covers `rename_data`, `rename_global_variable`,\n`set_global`, the `apply_data_type` prefix\u002Ftype guard, and struct-field\nHungarian prefix auto-fixes in `create_struct`, `add_struct_field`, and\n`modify_struct_field`. The setting is read when the MCP server starts or\nrestarts. Function\u002Fglobal convention warnings are still returned when\nenforcement is disabled.\n\n### Example: exposing to a private LAN with auth\n\n```bash\nexport GHIDRA_MCP_AUTH_TOKEN=$(openssl rand -hex 32)\nexport GHIDRA_MCP_ALLOW_SCRIPTS=1     # only if your workflow needs it\nexport GHIDRA_MCP_FILE_ROOT=\u002Fsrv\u002Fghidra\u002Finputs\n\njava -jar GhidraMCPHeadless.jar --bind 0.0.0.0 --port 8089\n```\n\n### Ghidra Server authentication\n\nWhen connecting to a shared Ghidra Server, GhidraMCP can suppress the password dialog automatically. It resolves credentials in this order (first non-empty value wins):\n\nCompatibility note: Ghidra 12.1 clients require Ghidra Server 12.1,\n12.0.5, or a newer compatible server. Older shared servers are not safe\ntargets for a 12.1 client upgrade.\n\n1. `GHIDRA_SERVER_PASSWORD` environment variable (or `.env` file in the Ghidra install directory or `~`)\n2. `~\u002F.ghidra-cred` — single-line password file in your home directory\n3. `\u003Cghidra-install-dir>\u002F.ghidra-cred`\n\nUsername resolves similarly: `GHIDRA_SERVER_USER` env var → `user.name` system property.\n\nIf no password is found, Ghidra shows its normal GUI prompt. Set these in `.env` (see `.env.template` for the full block) to enable silent auth.\n\n### Migration from v5.4.0 → v5.4.1\n\n- **Script endpoints now default-off.** If you relied on `\u002Frun_script_inline` or `\u002Frun_ghidra_script`, export `GHIDRA_MCP_ALLOW_SCRIPTS=1`. This is a deliberate breaking change; the prior default was unsafe.\n- **Localhost-only deployments need no changes.** Auth, bind refusal, and path-root checks are all opt-in.\n\n## ❓ Troubleshooting\n\n### \"GhidraMCP\" menu not appearing in Tools\n\n**Cause:** Plugin not enabled or installed incorrectly.\n\n**Solution:**\n1. Verify extension is installed: **File > Install Extensions** — GhidraMCP should be listed\n2. Enable the plugin: **File > Configure > Configure All Plugins > GhidraMCP** (check the box)\n3. **Restart Ghidra** after installation\u002Fenabling\n\n### Server not responding \u002F Connection refused\n\n**Cause:** Server not started or wrong port.\n\n**Solution:**\n1. Ensure you started the server: **Tools > GhidraMCP > Start MCP Server**\n2. Check configured port: **Edit > Tool Options > GhidraMCP HTTP Server**\n3. Check if port is in use:\n   ```bash\n   # Linux\u002FmacOS\n   lsof -i :8089\n   # Windows\n   netstat -ano | findstr :8089\n   ```\n4. Look for errors in Ghidra console: **Window > Console**\n\n### `python -m debugger` fails with `ModuleNotFoundError` for `pybag` or `comtypes`\n\n**Cause:** The standalone debugger server uses optional Windows-only Python\ndependencies that are not installed by the base requirements file.\n\n**Solution:**\n```text\npython -m pip install -r requirements-debugger.txt\npython -m debugger\n```\n\nIf you have both a global Python and a project venv, make sure you install\ninto and run from the same interpreter.\n\n### 500 Internal Server Errors\n\n**Cause:** Server-side exception, often due to missing program data.\n\n**Solution:**\n1. Ensure a binary is loaded in CodeBrowser\n2. Run auto-analysis first: **Analysis > Auto Analyze**\n3. Check Ghidra console (**Window > Console**) for Java exceptions\n4. Some operations require fully analyzed binaries\n\n### 404 Not Found Errors\n\n**Cause:** Endpoint doesn't exist or wrong URL.\n\n**Solution:**\n1. Verify endpoint exists: `curl http:\u002F\u002F127.0.0.1:8089\u002Fget_version`\n2. Check for typos in endpoint name\n3. Ensure you're using correct HTTP method (GET vs POST)\n\n### Python Ghidra scripts fail with \"No script provider found\"\n\n**Cause:** In Ghidra 12.1, Jython support is no longer enabled by\ndefault. `.py` scripts need the bundled Jython extension; Python 3\nscripts should use PyGhidra instead of the Ghidra Script Manager.\n\n**Solution:**\n1. In the Ghidra Front End, open **File > Install Extensions**.\n2. Check **Jython**, restart Ghidra, then refresh Script Manager.\n3. For new automation, prefer Java Ghidra scripts or PyGhidra.\n\n### Extension not appearing in Install Extensions\n\n**Cause:** JAR file in wrong location.\n\n**Solution:**\n1. Manual install location: `~\u002F.ghidra\u002Fghidra_12.1_PUBLIC\u002FExtensions\u002FGhidraMCP\u002Flib\u002FGhidraMCP.jar`\n2. Or use: **File > Install Extensions > Add** and select the ZIP file\n3. Ensure JAR\u002FZIP was built for your Ghidra version\n\n### Build fails with \"Ghidra dependencies not found\"\n\n**Cause:** Ghidra JARs not installed in local Maven repository.\n\n**Solution:**\n```text\n# Windows (recommended)\npython -m tools.setup install-ghidra-deps --ghidra-path \"C:\\ghidra_12.1_PUBLIC\"\n```\n\n## 📊 Production Performance\n\n- **MCP Tools**: 245 tools fully implemented\n- **Speed**: Sub-second response for most operations\n- **Efficiency**: 93% reduction in API calls via batch operations\n- **Reliability**: Atomic transactions with all-or-nothing semantics\n- **AI Workflows**: Proven documentation prompts refined across hundreds of real functions\n- **Deployment**: Automated version-aware deployment script\n\n## 🛠️ API Reference\n\n### Core Operations\n- `check_connection` - Verify MCP connectivity\n- `get_metadata` - Program metadata and info\n- `get_version` - Server version information\n- `get_function_count` - Return total function count for a program\n- `get_entry_points` - Binary entry points discovery\n- `get_current_address` - Get cursor address (GUI only)\n- `get_current_function` - Get function at cursor (GUI only)\n- `get_current_selection` - Get current selection context (address + function)\n- `read_memory` - Read raw bytes from memory\n- `save_program` - Save the current program\n- `exit_ghidra` - Save and exit Ghidra gracefully\n\n### Function Analysis\n- `list_functions` - List all functions (paginated)\n- `list_functions_enhanced` - List with isThunk\u002FisExternal flags\n- `list_classes` - List namespace\u002Fclass names (paginated)\n- `search_functions_enhanced` - Advanced function search with filters\n- `decompile_function` - Decompile function to C pseudocode\n- `force_decompile` - Force fresh decompilation (bypass cache)\n- `batch_decompile` - Batch decompile multiple functions\n- `get_function_callers` - Get function callers\n- `get_function_callees` - Get function callees\n- `get_function_call_graph` - Function relationship graph\n- `get_full_call_graph` - Complete call graph for program\n- `get_function_signature` - Get function prototype string\n- `get_function_hash` - SHA-256 hash of normalized function opcodes\n- `get_bulk_function_hashes` - Paginated bulk hashing with filter\n- `get_function_jump_targets` - Get jump target addresses from disassembly\n- `get_function_metrics` - Get complexity metrics for a function\n- `get_function_xrefs` - Get function cross-references\n- `analyze_function_full` - Comprehensive function analysis\n- `analyze_function_completeness` - Documentation completeness score\n- `batch_analyze_completeness` - Batch completeness analysis for multiple functions\n- `find_similar_functions_across_programs` - Cross-program similarity matching\n- `bulk_fuzzy_match_functions` - Bulk fuzzy match across all functions\n- `diff_functions` - Diff two functions side by side\n- `validate_function_prototype` - Validate a function prototype string\n- `can_rename_at_address` - Check if address can be renamed\n- `delete_function` - Delete function at address\n\n### Memory & Data\n- `list_segments` - Memory segments and layout\n- `list_data_items` - List defined data labels and values (paginated)\n- `list_data_items_by_xrefs` - Data items sorted by xref count\n- `get_function_by_address` - Function at address\n- `disassemble_function` - Disassembly listing\n- `disassemble_bytes` - Raw byte disassembly\n- `get_xrefs_to` - Cross-references to address\n- `get_xrefs_from` - Cross-references from address\n- `get_bulk_xrefs` - Bulk cross-reference lookup\n- `analyze_data_region` - Analyze memory region structure\n- `inspect_memory_content` - View raw memory content\n- `detect_array_bounds` - Detect array boundaries\n- `search_byte_patterns` - Search for byte patterns\n- `create_memory_block` - Create a new memory block\n\n### Cross-Binary Documentation\n- `get_function_documentation` - Export complete function documentation\n- `apply_function_documentation` - Import documentation to target function\n- `compare_programs_documentation` - Compare documentation between programs\n- `build_function_hash_index` - Build persistent JSON index\n- `lookup_function_by_hash` - Find matching functions in index\n- `propagate_documentation` - Apply docs to all matching instances\n\n### Data Types & Structures\n- `list_data_types` - Available data types\n- `search_data_types` - Search for data types\n- `get_data_type_size` - Get byte size of a data type\n- `get_valid_data_types` - Get list of valid Ghidra builtin types\n- `get_struct_layout` - Get detailed field layout of a structure\n- `validate_data_type` - Validate data type syntax\n- `validate_data_type_exists` - Check if a data type exists\n- `create_struct` - Create custom structure\n- `add_struct_field` - Add field to structure\n- `modify_struct_field` - Modify existing field\n- `remove_struct_field` - Remove field from structure\n- `create_enum` - Create enumeration\n- `get_enum_values` - Get enumeration values\n- `create_array_type` - Create array data type\n- `create_typedef` - Create typedef alias\n- `create_union` - Create union data type\n- `create_pointer_type` - Create pointer data type\n- `clone_data_type` - Clone a data type with a new name\n- `apply_data_type` - Apply type to address\n- `delete_data_type` - Delete a data type\n- `consolidate_duplicate_types` - Merge duplicate types\n- `suggest_field_names` - AI-assisted field name suggestions for a structure\n- `create_data_type_category` - Create a category folder in the type manager\n- `move_data_type_to_category` - Move a type to a different category\n- `list_data_type_categories` - List all data type categories\n- `import_data_types` - Import types from a GDT\u002Fheader file\n\n### Symbols & Labels\n- `list_imports` - Imported symbols and libraries\n- `list_exports` - Exported symbols and functions\n- `list_external_locations` - External location references\n- `get_external_location` - Specific external location detail\n- `list_strings` - Extracted strings with analysis\n- `search_memory_strings` - Search strings by regex\u002Fsubstring pattern\n- `list_namespaces` - Available namespaces\n- `list_globals` - Global variables\n- `create_label` - Create label at address\n- `batch_create_labels` - Bulk label creation\n- `delete_label` - Delete label at address\n- `batch_delete_labels` - Bulk label deletion\n- `rename_label` - Rename existing label\n- `rename_or_label` - Rename or create label\n\n### Renaming & Documentation\n- `rename_function` - Rename function by name\n- `rename_function_by_address` - Rename function by address\n- `rename_data` - Rename data item\n- `rename_variables` - Rename function variables\n- `rename_global_variable` - Rename global variable\n- `rename_external_location` - Rename external reference\n- `batch_rename_function_components` - Bulk renaming\n- `set_decompiler_comment` - Set decompiler comment\n- `set_disassembly_comment` - Set disassembly comment\n- `set_plate_comment` - Set function plate comment\n- `get_plate_comment` - Get function plate comment\n- `batch_set_comments` - Bulk comment setting\n- `clear_function_comments` - Clear all comments for a function\n- `list_bookmarks` - List all bookmarks\n- `set_bookmark` - Create or update a bookmark\n- `delete_bookmark` - Delete a bookmark\n\n### Type System\n- `set_function_prototype` - Set function signature\n- `set_local_variable_type` - Set variable type\n- `set_parameter_type` - Set parameter type\n- `batch_set_variable_types` - Bulk type setting\n- `set_variable_storage` - Control variable storage location\n- `set_function_no_return` - Mark function as non-returning\n- `clear_instruction_flow_override` - Clear flow override on instruction\n- `list_calling_conventions` - Available calling conventions\n- `get_function_variables` - Get all function variables\n- `get_function_labels` - Get labels in function\n\n### Ghidra Script Management\n- `list_scripts` - List available scripts\n- `list_ghidra_scripts` - List custom Ghidra scripts\n- `save_ghidra_script` - Save new script\n- `get_ghidra_script` - Get script contents\n- `run_ghidra_script` - Execute Ghidra script by name\n- `run_script_inline` - Execute inline script code\n- `update_ghidra_script` - Update existing script\n- `delete_ghidra_script` - Delete script\n\n### Multi-Program Support\n- `list_open_programs` - List all open programs\n- `get_current_program_info` - Current program details\n- `switch_program` - Switch active program\n- `list_project_files` - List project files\n- `open_program` - Open program from project\n\n### Project Lifecycle\n- `create_project` - Create a new Ghidra project\n- `open_project` - Open an existing project\n- `close_project` - Close the current project\n- `delete_project` - Delete a project\n- `list_projects` - List Ghidra projects in a directory\n\n### Project Organization\n- `create_folder` - Create a folder in the project tree\n- `move_file` - Move a domain file to another folder\n- `move_folder` - Move a folder to another location\n- `delete_file` - Delete a domain file from the project\n\n### Analysis Tools\n- `find_next_undefined_function` - Find undefined functions\n- `find_undocumented_by_string` - Find functions by string reference\n- `find_undocumented_functions_by_strings` - Find undocumented functions by string references\n- `get_assembly_context` - Get assembly context\n- `analyze_struct_field_usage` - Analyze structure field access\n- `get_field_access_context` - Get field access patterns\n- `create_function` - Create function at address\n- `analyze_control_flow` - Cyclomatic complexity and loop detection\n- `analyze_call_graph` - Build function call graph\n- `analyze_api_call_chains` - Detect API call threat patterns\n- `detect_malware_behaviors` - Detect malware behavior categories\n- `find_anti_analysis_techniques` - Find anti-analysis techniques\n- `find_dead_code` - Detect unreachable code\n- `extract_iocs_with_context` - Extract IOCs from strings\n- `apply_data_classification` - Apply data classification to addresses\n\n### Analysis Control\n- `list_analyzers` - List all available Ghidra analyzers\n- `configure_analyzer` - Enable\u002Fdisable or configure an analyzer\n- `run_analysis` - Trigger Ghidra auto-analysis programmatically\n\n### Server Connection (Ghidra Server)\n- `connect_server` - Connect to a Ghidra Server\n- `disconnect_server` - Disconnect from Ghidra Server\n- `server_status` - Check server connection status\n- `list_repositories` - List repositories on the server\n- `create_repository` - Create a new repository\n- `list_repository_files` - List files in a server repository folder\n- `get_repository_file` - Get metadata for a file in a server repository\n\n### Version Control\n- `checkout_file` - Check out a file from version control\n- `checkin_file` - Check in a file with a comment\n- `undo_checkout` - Undo a checkout without committing\n- `add_to_version_control` - Add a file to version control\n\n### Version History\n- `get_version_history` - Get full version history for a file\n- `get_checkouts` - Get active checkout status\n\n### Admin\n- `terminate_checkout` - Forcibly terminate a user's checkout\n- `list_server_users` - List all users on the Ghidra Server\n- `set_user_permissions` - Set a user's repository access level\n\nSee [CHANGELOG.md](CHANGELOG.md) for version history.\n\n## 🏗️ Architecture\n\n```\n┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐\n│   AI\u002FAutomation │◄──►│   MCP Bridge    │◄──►│  Ghidra Plugin  │\n│     Tools       │    │ (bridge_mcp_    │    │ (GhidraMCP.jar) │\n│  (Claude, etc.) │    │  ghidra.py)     │    │                 │\n└─────────────────┘    └─────────────────┘    └─────────────────┘\n        │                       │                       │\n   MCP Protocol            HTTP REST              Ghidra API\n   (stdio\u002FSSE)          (localhost:8089)      (Program, Listing)\n```\n\n### Components\n\n- **bridge_mcp_ghidra.py** — Python MCP server that translates MCP protocol to HTTP calls (225 catalog entries)\n- **GhidraMCP.jar** — Ghidra plugin that exposes analysis capabilities via HTTP (175 GUI endpoints)\n- **GhidraMCPHeadlessServer** — Standalone headless server — 183 endpoints, no GUI required\n- **ghidra_scripts\u002F** — Collection of automation scripts for common tasks\n\n## 🔧 Development\n\n### Building from Source\n```bash\n# Recommended: direct Python-first workflow\npython -m tools.setup ensure-prereqs --ghidra-path \"C:\\ghidra_12.1_PUBLIC\"\npython -m tools.setup build\npython -m tools.setup deploy --ghidra-path \"C:\\ghidra_12.1_PUBLIC\"\n\n# Version bump (updates all maintained version references atomically)\npython -m tools.setup bump-version --new X.Y.Z\n```\n\nThe authoritative build system today is Maven. `tools.setup`, the VS Code tasks, and the documented deploy flow all build through `pom.xml` and write artifacts to `target\u002F`. `build.gradle` remains in the repo as a manual fallback for direct Ghidra\u002FGradle users, but it is not the primary path.\n\n### Command Reference\n\n| Command | What it does |\n|---------|-------------|\n| `ensure-prereqs` | Install Python deps + Ghidra Maven JARs in one shot. Start here on a new machine. |\n| `preflight` | Validate Python, build tool, Ghidra path, and JAR availability without making changes. Add `--strict` to also check network reachability. |\n| `build` | Build the plugin JAR and extension ZIP via Maven (or Gradle when `TOOLS_SETUP_BACKEND=gradle`). |\n| `deploy` | Copy the built extension into the Ghidra profile and patch `FrontEndTool.xml` for auto-activation. |\n| `start-ghidra` | Launch the configured Ghidra installation. |\n| `clean` | Remove Maven\u002FGradle build outputs (`target\u002F`, `build\u002F`). |\n| `clean-all` | Remove build outputs plus local cache artifacts (`.m2` Ghidra JARs, etc.). |\n| `install-ghidra-deps` | Install only the Ghidra JARs into `~\u002F.m2`. Useful when the build environment changes. |\n| `install-python-deps` | Install only the Python requirements files. |\n| `run-tests` | Run the Java offline test suite (no live Ghidra needed). |\n| `verify-version` | Check that version strings are consistent across `pom.xml`, `CHANGELOG.md`, and `README.md`. |\n| `bump-version --new X.Y.Z` | Atomically update all version references. Pass `--tag` to create a git tag. |\n\nCommon flags accepted by most commands:\n\n| Flag | Description |\n|------|-------------|\n| `--ghidra-path PATH` | Ghidra installation directory. Defaults to `GHIDRA_PATH` from `.env`. |\n| `--dry-run` | Print actions without executing them. |\n| `--force` | Reinstall Ghidra JARs even if already present (`install-ghidra-deps`, `ensure-prereqs`). |\n| `--with-debugger` | Force-install debugger Python requirements (Windows only). |\n| `--use-debugger-toggle` | Read `INSTALL_DEBUGGER_DEPS` from `.env` to decide whether to install debugger deps. |\n| `--test TIER` | (`deploy` only) Opt into live deploy regression tiers such as `release` or `debugger-live`. |\n| `--strict` | (`preflight` only) Also check network reachability for Maven Central and PyPI. |\n\nDeploy test tiers are opt-in because benchmark tiers can import\u002Freset\n`Benchmark.dll` and `BenchmarkDebug.exe` in the active Ghidra project. Use\n`--test release` before cutting releases, or set\n`GHIDRA_MCP_DEPLOY_TESTS=release` in a local `.env` when you want every deploy\non your machine to run the live benchmark regression. See\n[Testing and Release Regression](docs\u002FTESTING.md).\n\n```text\n# Standard first-time setup and deploy\npython -m tools.setup ensure-prereqs --ghidra-path \"C:\\ghidra_12.1_PUBLIC\"\npython -m tools.setup build\npython -m tools.setup deploy --ghidra-path \"C:\\ghidra_12.1_PUBLIC\"\n\n# Preflight check before deploying\npython -m tools.setup preflight --strict --ghidra-path \"C:\\ghidra_12.1_PUBLIC\"\n\n# Version bump and tag\npython -m tools.setup bump-version --new X.Y.Z --tag\n\n# Run offline Java tests\npython -m tools.setup run-tests\n\n# Show full help\npython -m tools.setup --help\n```\n\n### Project Structure\n```\nghidra-mcp\u002F\n├── bridge_mcp_ghidra.py     # MCP server (Python, 225 catalog entries)\n├── src\u002Fmain\u002Fjava\u002F           # Ghidra plugin + headless server (Java)\n│   └── com\u002Fxebyte\u002F\n│       ├── GhidraMCPPlugin.java         # GUI plugin (196 endpoints)\n│       ├── headless\u002F                    # Headless server (183 endpoints)\n│       └── core\u002F                        # Shared service layer (12 services)\n├── debugger\u002F                # Optional standalone debugger server (port 8099)\n├── ghidra_scripts\u002F          # Automation scripts for batch workflows\n├── tests\u002F                   # Python unit tests + endpoint catalog\n│   ├── unit\u002F               # Catalog consistency, schema, tool function tests\n│   └── endpoints.json      # Endpoint specification (225 entries)\n├── docs\u002F                    # Documentation\n│   ├── prompts\u002F            # AI workflow prompts (V5 documentation workflows)\n│   ├── releases\u002F           # Version release notes\n│   └── project-management\u002F # Contributor planning docs (Gradle migration, etc.)\n├── tools\u002Fsetup\u002F             # Build and deployment CLI (python -m tools.setup)\n├── fun-doc\u002F                 # Internal RE curation tool — not part of the MCP plugin\n│                            #   Priority-queue worker, LLM scoring, web dashboard.\n│                            #   See fun-doc\u002FREADME.md for details.\n└── .github\u002Fworkflows\u002F      # CI\u002FCD pipelines\n```\n\n### Library Dependencies\n\nGhidra JARs must be installed into your local Maven repository (`~\u002F.m2\u002Frepository`) before compilation.\nThis is a one-time setup per machine, and again when your Ghidra version changes.\n`-Deploy` now installs these automatically by default.\n\nThe tool enforces version consistency between:\n- `pom.xml` (`ghidra.version`)\n- `--ghidra-path` version segment (e.g., `ghidra_12.1_PUBLIC`)\n\nIf these do not match, deployment fails fast with a clear error.\n\n### Troubleshooting: Version Mismatch\n\nIf you see a version mismatch error, align both values:\n1. `pom.xml` → `ghidra.version`\n2. `--ghidra-path` version segment (`ghidra_X.Y.Z_PUBLIC`)\n\nThen rerun:\n\n```text\npython -m tools.setup preflight --ghidra-path \"C:\\ghidra_12.1_PUBLIC\"\n```\n\n```text\n# Windows\npython -m tools.setup install-ghidra-deps --ghidra-path \"C:\\path\\to\\ghidra_12.1_PUBLIC\"\n```\n\n**Required Libraries (14 JARs, ~37MB):**\n\n| Library | Source Path | Purpose |\n|---------|------------|---------|\n| **Base.jar** | `Features\u002FBase\u002Flib\u002F` | Core Ghidra functionality |\n| **Decompiler.jar** | `Features\u002FDecompiler\u002Flib\u002F` | Decompilation engine |\n| **PDB.jar** | `Features\u002FPDB\u002Flib\u002F` | Microsoft PDB symbol support |\n| **FunctionID.jar** | `Features\u002FFunctionID\u002Flib\u002F` | Function identification |\n| **SoftwareModeling.jar** | `Framework\u002FSoftwareModeling\u002Flib\u002F` | Program model API |\n| **Project.jar** | `Framework\u002FProject\u002Flib\u002F` | Project management |\n| **Docking.jar** | `Framework\u002FDocking\u002Flib\u002F` | UI docking framework |\n| **Generic.jar** | `Framework\u002FGeneric\u002Flib\u002F` | Generic utilities |\n| **Utility.jar** | `Framework\u002FUtility\u002Flib\u002F` | Core utilities |\n| **Gui.jar** | `Framework\u002FGui\u002Flib\u002F` | GUI components |\n| **FileSystem.jar** | `Framework\u002FFileSystem\u002Flib\u002F` | File system support |\n| **Graph.jar** | `Framework\u002FGraph\u002Flib\u002F` | Graph\u002Fcall graph analysis |\n| **DB.jar** | `Framework\u002FDB\u002Flib\u002F` | Database operations |\n| **Emulation.jar** | `Framework\u002FEmulation\u002Flib\u002F` | P-code emulation |\n\n> **Note**: Libraries are NOT included in the repository (see `.gitignore`). You must install them from your Ghidra installation before building.\n\n> **Automation entry point**:\n> - `python -m tools.setup` is the supported setup\u002Fbuild\u002Fdeploy\u002Fversioning interface\n> - use `ensure-prereqs`, `build`, `deploy`, `preflight`, `clean-all`, and `bump-version` directly\n> - these commands currently use Maven as the canonical Java build backend\n\n### Development Features\n- **Automated Deployment**: Version-aware deployment script\n- **Batch Operations**: Reduces API calls by 93%\n- **Atomic Transactions**: All-or-nothing semantics\n- **Comprehensive Logging**: Debug and trace capabilities\n\n## 📚 Documentation\n\n### Core Documentation\n- [Documentation Index](docs\u002FREADME.md) - Complete documentation navigation\n- [Project Structure](docs\u002FPROJECT_STRUCTURE.md) - Project organization guide\n- [Testing and Release Regression](docs\u002FTESTING.md) - Local tests, CI, live Ghidra regression, and release gates\n- [Naming Conventions](docs\u002FNAMING_CONVENTIONS.md) - Code naming standards\n- [Hungarian Notation](docs\u002FHUNGARIAN_NOTATION.md) - Variable naming guide\n\n### AI Workflow Prompts\n- [Function Documentation V5](docs\u002Fprompts\u002FFUNCTION_DOC_WORKFLOW_V5.md) — Primary workflow: 7-step process with Hungarian notation, type auditing, and verification scoring\n- [Batch Documentation V5](docs\u002Fprompts\u002FFUNCTION_DOC_WORKFLOW_V5_BATCH.md) — Parallel subagent dispatch for multi-function processing\n- [Orphaned Code Discovery](docs\u002Fprompts\u002FORPHANED_CODE_DISCOVERY_WORKFLOW.md) — Automated scanner for undiscovered functions\n- [Data Type Investigation](docs\u002Fprompts\u002FDATA_TYPE_INVESTIGATION_WORKFLOW.md) — Systematic structure discovery\n- [Cross-Version Matching](docs\u002Fprompts\u002FCROSS_VERSION_MATCHING_COMPREHENSIVE.md) — Hash-based function matching\n- [Quick Start Prompt](docs\u002Fprompts\u002FQUICK_START_PROMPT.md) — Simplified beginner workflow\n- [All Prompts](docs\u002Fprompts\u002FREADME.md) — Complete prompt index\n\n### Release History\n- [Complete Changelog](CHANGELOG.md) - All version release notes\n- [Release Notes](docs\u002Freleases\u002F) - Detailed release documentation\n\n## 🐳 Headless Server (Docker)\n\nGhidraMCP includes a headless server mode for automated analysis without the Ghidra GUI.\n\n### Quick Start with Docker\n\n```bash\n# Build and run\ndocker-compose up -d ghidra-mcp\n\n# Test connection\ncurl http:\u002F\u002Flocalhost:8089\u002Fcheck_connection\n# Connection OK - GhidraMCP Headless Server v5.12.0\n```\n\n### Headless API Workflow\n\n```bash\n# 1. Load a binary\ncurl -X POST -d \"file=\u002Fdata\u002Fprogram.exe\" http:\u002F\u002Flocalhost:8089\u002Fload_program\n\n# 2. Run auto-analysis (identifies functions, strings, data types)\ncurl -X POST http:\u002F\u002Flocalhost:8089\u002Frun_analysis\n\n# 3. List discovered functions\ncurl \"http:\u002F\u002Flocalhost:8089\u002Flist_functions?limit=20\"\n\n# 4. Decompile a function\ncurl \"http:\u002F\u002Flocalhost:8089\u002Fdecompile_function?address=0x401000\"\n\n# 5. Get metadata\ncurl http:\u002F\u002Flocalhost:8089\u002Fget_metadata\n```\n\n### Key Headless Endpoints\n\n| Endpoint | Method | Description |\n|----------|--------|-------------|\n| `\u002Fload_program` | POST | Load binary file for analysis |\n| `\u002Frun_analysis` | POST | Run Ghidra auto-analysis |\n| `\u002Flist_functions` | GET | List all discovered functions |\n| `\u002Flist_exports` | GET | List exported symbols |\n| `\u002Flist_imports` | GET | List imported symbols |\n| `\u002Fdecompile_function` | GET | Decompile function to C code |\n| `\u002Fcreate_function` | POST | Create function at address |\n| `\u002Fget_metadata` | GET | Get program metadata |\n| `\u002Fcreate_project` | POST | Create a Ghidra project |\n| `\u002Flist_analyzers` | GET | List available analyzers |\n| `\u002Fserver\u002Fstatus` | GET | Check Ghidra Server connection |\n\n### Configuration\n\nEnvironment variables for Docker:\n- `GHIDRA_MCP_PORT` - Server port (default: 8089)\n- `GHIDRA_MCP_BIND_ADDRESS` - Bind address (default: 0.0.0.0 in Docker)\n- `JAVA_OPTS` - JVM options (default: -Xmx4g -XX:+UseG1GC)\n\n## 🤝 Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for detailed contribution guidelines.\n\n### Quick Start\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature\u002Famazing-feature`)\n3. Build and test your changes (`mvn clean package assembly:single -DskipTests` or `GHIDRA_INSTALL_DIR=\u002Fpath\u002Fto\u002Fghidra gradle buildExtension`)\n4. Update documentation as needed\n5. Commit your changes (`git commit -m 'Add amazing feature'`)\n6. Push to the branch (`git push origin feature\u002Famazing-feature`)\n7. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🏆 Production Status\n\n| Metric | Value |\n|--------|-------|\n| **Version** | 5.12.0 |\n| **MCP Tools** | 245 fully implemented |\n| **GUI Endpoints** | 196 (GhidraMCPPlugin) |\n| **Headless Endpoints** | 195 (GhidraMCPHeadlessServer) |\n| **Compilation** | ✅ 100% success |\n| **Batch Efficiency** | 93% API call reduction |\n| **AI Workflows** | 7 proven documentation workflows |\n| **Ghidra Scripts** | Automation scripts included |\n| **Documentation** | Comprehensive with AI prompts |\n\nSee [CHANGELOG.md](CHANGELOG.md) for version history and release notes.\n\n\n## 🙏 Acknowledgments\n\nThis project was originally derived from [LaurieWired\u002FGhidraMCP](https:\u002F\u002Fgithub.com\u002FLaurieWired\u002FGhidraMCP) in August 2025 and has since been substantially rewritten and extended. We acknowledge LaurieWired's original work as the starting point. See [NOTICE](NOTICE) for license attribution.\n\n## 👥 Contributors\n\nThis project has benefited from the work of dedicated contributors:\n\n### Core Contributors\n\n**[@heeen](https:\u002F\u002Fgithub.com\u002Fheeen)** — Significant contributions including:\n- Fuzzy function matching and structured diff for cross-binary comparison (#13)\n- Script execution improvements and bug fixes (#12)\n- New API endpoints: `save_program`, `exit_ghidra`, `delete_function`, `create_memory_block`, `run_script_inline` (#11)\n- Architectural vision: annotation-driven design, UDS transport, Python bridge optimization proposals\n\n**[@huehuehuehueing](https:\u002F\u002Fgithub.com\u002Fhuehuehuehueing)** — Significant contributions including:\n- Address-space prefix support — added `\u003Cspace>:\u003Chex>` syntax (e.g., `mem:1000`, `code:ff00`) to address parsing across the entire endpoint surface, unlocking multi-space targets like embedded firmware (#84, closes #65)\n- Optional `program` parameter + required-param schema fixes — made `program` optional on every endpoint with a sane currentProgram fallback, and fixed several required-vs-optional schema bugs the catalog had inherited (#92)\n- Seeded #44 (data-type \u002F enum tools) — the issue that motivated the v5.0 enum + struct enforcement layer\n\n\n- **Ghidra Team** - For the incredible reverse engineering platform\n- **Model Context Protocol** - For the standardized AI integration framework\n- **Contributors** - For testing, feedback, and improvements\n\n---\n\n## 🔗 Related Projects\n\n- [re-universe](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fre-universe) — Ghidra BSim PostgreSQL platform for large-scale binary similarity analysis. Pairs perfectly with GhidraMCP for AI-driven reverse engineering workflows.\n- [cheat-engine-server-python](https:\u002F\u002Fgithub.com\u002Fbethington\u002Fcheat-engine-server-python) — MCP server for dynamic memory analysis and debugging.\n\n---\n\n**Ready for production deployment with enterprise-grade reliability and comprehensive binary analysis capabilities.**\n","Ghidra MCP Server 是一个集成了200多种MCP工具的服务器，旨在通过AI技术增强逆向工程能力。该项目提供了一个图形用户界面插件和无头服务器模式，支持按需加载工具、执行规范检查、批量操作以及与Ghidra服务器的集成，并且可以使用Docker进行部署。其核心功能包括P-code仿真、实时调试器集成及PCode-graph数据流分析等，能够显著提升二进制文件静态分析效率。适用于需要高效自动化处理复杂软件逆向工程任务的场景，如安全研究、漏洞挖掘等领域。",2,"2026-06-11 03:56:56","high_star"]