Skip to main content
Glama
Sarks0

Binary MCP Server

by Sarks0
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Binary MCP Server

CI Python 3.12+ License

An MCP server for reverse engineering. It hands an AI assistant 147 tools for static analysis, live debugging, kernel debugging and .NET decompilation, so the whole workflow happens in one place instead of across four GUIs.

Engine

What it covers

Platform

Ghidra (headless)

Analysis, decompilation, xrefs, call graphs

Linux, macOS, Windows

x64dbg

Live user-mode debugging

Windows

WinDbg / KD

Kernel debugging and crash dumps

Windows

ILSpyCmd

.NET assemblies to C# and IL

Linux, macOS, Windows

pefile and built-ins

PE structure, triage, carving, hashing

Linux, macOS, Windows

Requires Python 3.12+ and Java 21+ for Ghidra. Both debuggers are Windows only; everything else runs anywhere.

Architecture

One server process per connected client. The assistant talks MCP over stdio; each engine runs behind its own boundary, and the sample itself is only ever read.

Related MCP server: x64dbg MCP Server

Quick Start

git clone https://github.com/Sarks0/binary-mcp.git
cd binary-mcp
python3 install.py          # Windows: .\install.ps1  (as Administrator)

The installer fetches Ghidra, x64dbg and the Windows debuggers. For dependencies only, run uv sync instead. To install without cloning, or to check a download before you run it, see INSTALL.md.

Then connect it:

claude mcp add binary-analysis -- uv --directory /path/to/binary-mcp run python -m src.server

Config-file examples for Claude Code and Claude Desktop are in config/. Once connected, ask the assistant to run diagnose_setup: it reports which engines it found and which are missing.

Usage

Ask for what you want in plain language.

Analyze the binary at /path/to/malware.exe
Decompile the function at 0x401000 and find its callers
Connect to x64dbg and break on BCryptEncrypt
Find the OEP of this packed binary
Analyze the crash dump at C:\Windows\MEMORY.DMP
Decompile the type MyNamespace.MyClass to C#

Safety

This is a malware-analysis tool. Analyze samples in an isolated VM, on a host you can revert.

No tool can execute a sample, samples are never uploaded anywhere, file access is confined to a quarantine allow-list by default, and raw debugger commands are gated by fail-closed allowlists. The security model states each of those precisely and points at the code that enforces it.

Documentation

Development

uv sync --extra dev
uv run pytest
uv run ruff check src/ tests/

make help lists the rest. See CONTRIBUTING.md to add a tool.

License

Apache 2.0. See LICENSE.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityActive
ResponsivenessSlow

Resources

Related MCP Connectors

Related MCP Servers

  • X64Dbg MCP Server

    bbgouzi123
    F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI-assisted reverse engineering and debugging through x64dbg integration. Provides 40+ tools for breakpoint management, memory operations, register manipulation, code analysis, process control, and advanced debugging features.
    22
    -

  • x64dbg MCP Server

    ouonet
    A
    license
    A
    quality
    D
    maintenance
    Enables AI assistants to perform reverse engineering and debugging of Windows executables through x64dbg, with tools for loading executables, controlling execution, analyzing memory and security, and generating reports.
    39
    74 npm
    6
    MIT

  • z-x64dbg-mcp

    Zekiog
    A
    license
    Not graded
    quality
    F
    maintenance
    Enables AI-driven reverse engineering with x64dbg via 71+ MCP tools for breakpoints, memory, disassembly, tracing, debug control, PE analysis, and anti-anti-debugging, supporting HTTP, SSE, and stdio transports.
    2
    MIT