Rizin MCP Server

Rizin MCP Server is a server that integrates the Rizin reverse engineering tool, RzGhidra decompiler (pdg), and Mandiant capa behavioral capability identification with MCP (Model Context Protocol).

It empowers Large Language Models (such as Claude, GPT-4, Llama 3) to automatically open binary files, identify behavioral labels (MITRE ATT&CK / MBC), automatically extract program feature addresses, and directly perform C pseudocode decompilation and analysis.

Repository Structure

rizin-mcp/
├── src/
│   └── rizin_mcp/
│       ├── __init__.py
│       ├── server.py          # Core logic for the MCP Server
│       ├── rz_extractor.py    # Efficient Rizin feature extractor (RizinFeatureExtractor)
│       └── client_proxy.py    # Client proxy for multi-turn tool-calling tests
├── docker/                    # Docker deployment configuration (Dockerfile, compose)
├── tests/                     # Unit tests and validation scripts
├── .gitignore                 # Git ignore configuration
├── LICENSE                    # MIT License
├── README.md                  # Project documentation
└── pyproject.toml             # Project configuration and dependency management (uv / pip)

Related MCP server: GhidraMCP

Quick Start

1. Installation and Preparation

Use uv for fast environment setup and dependency installation:

git clone https://github.com/kd992102/rizin-mcp.git
cd rizin-mcp
uv sync

2. Start MCP Server

You can start the MCP Server directly via the package CLI or as a module:

uv run python -m rizin_mcp.server

Testing and Integration

A. Testing with Anthropic's Official Web UI (MCP Inspector)

npx @modelcontextprotocol/inspector uv run python -m rizin_mcp.server

After executing, open http://localhost:6274 in your browser to test, view analysis logs, and inspect C decompiled code on the web interface.

B. Integrating with Claude Desktop

Add the following to %APPDATA%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "rizin-analyzer": {
      "command": "uv",
      "args": [
        "--directory",
        "C:\\path\\to\\rizin-mcp",
        "run",
        "python",
        "-m",
        "rizin_mcp.server"
      ]
    }
  }
}

C. Deployment using Docker (Headless Mode)

This project supports encapsulating the server in a Docker container for execution:

docker compose -f docker/docker-compose.yml up -d

Provided MCP Tools

Acknowledgments

This project relies heavily on the excellent work of the open-source community. We would like to express our gratitude to the following projects:

• Mandiant capa: For their powerful automated malware capability detection engine and comprehensive capa-rules.

• Rizin: For providing an extremely fast and robust binary analysis framework.

• rz-ghidra: For bringing the formidable Ghidra decompiler to the Rizin ecosystem.

License

This project is licensed under the MIT License.