Binary MCP Server

MCP server that gives AI assistants the ability to analyze binaries, debug processes, and inspect kernel state. Supports static analysis via Ghidra, user-mode debugging via x64dbg, kernel debugging via WinDbg, and .NET decompilation via ILSpyCmd.

Quick Start

Install

# Windows (as Administrator)
irm https://raw.githubusercontent.com/Sarks0/binary-mcp/main/install.ps1 | iex

# Linux / macOS
curl -sSL https://raw.githubusercontent.com/Sarks0/binary-mcp/main/install.py | python3 -

# Manual
git clone https://github.com/Sarks0/binary-mcp.git
cd binary-mcp && uv sync

Connect to Claude

claude mcp add binary-analysis -- uv --directory /path/to/binary-mcp run python -m src.server

Or add to your MCP config (Claude Code ~/.claude/settings.json or Claude Desktop config):

{
  "mcpServers": {
    "binary-analysis": {
      "command": "uv",
      "args": ["--directory", "/path/to/binary-mcp", "run", "python", "-m", "src.server"],
      "env": {"GHIDRA_HOME": "/path/to/ghidra"}
    }
  }
}

What You Can Do

Static Analysis - Analyze any binary without running it.

Analyze the binary at /path/to/malware.exe
Decompile the function at 0x401000
Find all suspicious API calls and crypto constants

Live Debugging - Control x64dbg from Claude.

Connect to x64dbg and set breakpoints on BCryptEncrypt
Trace execution until EAX contains a decrypted pointer
Find the OEP of this packed binary

Kernel Debugging - Inspect drivers and crash dumps.

Connect to the kernel debugger on port 50000
Show the dispatch table for \\Driver\\MyDriver
Analyze the crash dump at C:\Windows\MEMORY.DMP

.NET Analysis - Decompile managed assemblies.

Decompile the type MyNamespace.MyClass to C#

Capabilities (245 tools)

Static Analysis (Ghidra) - 35 tools

Analysis, decompilation, cross-references, memory maps, byte pattern search, function renaming, call graphs, API pattern detection (100+ Windows APIs), crypto constant identification, IOC extraction, and binary compatibility checking.

Dynamic Analysis (x64dbg) - 159 tools

Kernel Debugging (WinDbg) - 20 tools

Connection (KDNET, local kernel, crash dumps), execution control, breakpoints, register and memory inspection, driver object analysis, IOCTL decoding, process listing, and raw WinDbg command execution.

.NET Analysis (ILSpyCmd) - 7 tools

Type listing, C# decompilation, IL disassembly, type search, and full assembly decompilation.

PE Structure (pefile) - 1 tool

Comprehensive PE header, section, import, export, resource, debug, TLS, and Rich header analysis in a single fast call (<500ms). Three detail levels (basic/standard/full) with decoded characteristic flags, compiler attribution, and malware indicators.

Other - 23 tools

• Triage (3) - Quick file type detection, packer identification, entropy analysis

• Malware Analysis (4) - Behavior detection, threat chain identification, IOC extraction

• Control Flow (4) - CFG generation, cyclomatic complexity, loop detection, dead code

• Function Hashing (4) - Cross-binary function matching and similarity scoring

• VirusTotal (4) - Hash lookups, file submission, detection reports

• Session Management - Persistent analysis tracking across conversations

• Reporting (2) - Generate structured analysis reports

• YARA (2) - Rule scanning (optional yara-python dependency)

Supported Formats

Architecture

                    MCP Client (Claude Desktop / Claude Code)
                                    |
                            FastMCP Server (stdio)
                           /        |        \         \
                  Static Analysis  Dynamic    Kernel    .NET
                   /       \       Analysis  Debugging  Analysis
               Ghidra    Python   x64dbg     WinDbg/KD  ILSpyCmd
             (headless)  bytecode (HTTP)    (Pybag COM)
                                    |           |
                               C++ Plugin   DbgEng COM
                                    |           |
                              User Process  Kernel Target

Environment Variables

Development

uv run pytest              # Run tests
uv run pytest --cov=src    # With coverage
uv run ruff check src/     # Lint

Resources

• Installation Guide

• Contributing

• WinDbg/Kernel Debugging Guide

• x64dbg Architecture

• MCP Protocol

License

Apache 2.0 - See LICENSE for details.