Use case registry

Security, Science & Hardware

Reverse-engineer binaries in Ghidra

An MCP server exposing 110 Ghidra tools for AI-assisted reverse engineering.

What they did

A Ghidra plugin starts an HTTP server on localhost, and a Python bridge exposes it to MCP clients such as Claude or Cursor. The agent decompiles functions, follows call graphs and cross-references, and renames, retypes and comments in batches. A person builds and deploys the plugin and enables it in CodeBrowser.

How it went

The README now lists 253 tools, not 110. It claims 93% fewer API calls from batching, and says it was refined over hundreds of documented functions. It gives no benchmark of results.

Worth knowing

Lazy tool loading is on by default because Gemini rejects the full tool list. Script-running endpoints are off unless you set GHIDRA_MCP_ALLOW_SCRIPTS, and the server has no authentication on localhost.

Labels

ScopeBusinessAn MCP server exposing 110 Ghidra tools for AI-assisted reverse engineering.

For whomUnclear

What the agent doesAnalysis and reportsThe agent decompiles functions, follows call graphs and cross-references, and renames, retypes and comments in batches.

How autonomous the agent isUnclear

Agent or ordinary appAgent productThe agent decompiles functions, follows call graphs and cross-references, and renames, retypes and comments in batches.

Already a company's productUnclear

What kind of materialunverifiedUnclear

The “Material” label failed its quality check and is not used for selection.

Details

Agents: custom-built or unnamed agent
Source: Hacker News
Source date: Feb 4, 2026
Accounts: 3
In registry since: Oct 12, 2026

Original source ↗