"Using Ghidra for Reverse Engineering and Decompiling Software" matching MCP servers:

Exposes 18 typed tools that drive real static-analysis engines (Ghidra, apktool, WABT, TShark, evmole, Rizin) over a single MCP endpoint to decompile binaries, audit APKs, scan EVM contracts, inspect WebAssembly, firmware, SQLite, and pcap data. Every call returns signed, verifiable evidence with an evidence_id, provider identity, SHA-256 artifact digest, and explicit limitations for security research, malware analysis, forensics, and CTF work.

Enables decompilation and reverse engineering of Java JAR files through multi-engine decompilation, candidate evaluation, Maven project structuring, AST-based deobfuscation, and bytecode comparison.

Model Context Protocol server for Ghidra reverse engineering. 179 tools for decompilation, symbol management, cross-references, and binary analysis.

A Python MCP server that decompiles Android APK/XAPK/JAR/AAR files and extracts HTTP APIs used by the app.

Enables AI assistants to perform headless reverse engineering of retro game ROMs using Ghidra, with automated platform detection and triage.

Enables MCP clients to execute Python snippets and interact with Ghidra through its PyGhidra scripting environment via a local Java plugin.

A sandboxed MCP tool for reverse engineering that provides a unified interface to various reverse engineering tools with security restrictions.

Enables AI agents and automation to perform Ghidra reverse-engineering tasks through MCP, including decompilation, live debugging, P-code emulation, data-flow analysis, and headless script execution, with specialized AArch64-aware emulation.

A headless Ghidra server that enables AI agents to perform deep reverse-engineering tasks such as disassembly, decompilation, and patching via the Model Context Protocol. It supports extensive automation of analysis workflows in sandboxed environments through a catalog of over 200 specialized tools.

Enables AI assistants to import binaries into Ghidra, trigger analysis, browse functions, symbols, strings, and imports, and read decompiled C code and disassembly via MCP tools.

Enables MCP clients to inspect and automate a running binary-analysis session, with tools for program, memory, function, and listing operations.

MCP server that enables AI coding assistants to audit repositories against engineering rules, generating self-contained HTML reports with citations and optional GitHub issue filing.

A self-evolving JavaScript reverse engineering workflow MCP server that automates deobfuscation through evolutionary algorithms, integrating MemOS, GitNexus, and Stagehand.

Chrome browser JS reverse engineering MCP tool for CTF/Web security, enabling dynamic analysis and restoration of login encryption logic.

Enables importing and auto-analyzing binaries with Ghidra's headless analyzer, then listing, decompiling, disassembling, cross-referencing, searching, and annotating them — individually or across a whole project — without requiring a running GUI or bridge plugin.

A JavaScript reverse engineering MCP server that enables AI coding assistants to debug and analyze JavaScript code in web pages.

Enables reverse engineering of binaries (ELF/.so, PE, Mach-O) in-process without a GUI, exposing tools to load and analyze files, list functions, strings, imports, exports and cross-references, decompile to C, view disassembly, and rename functions, variables, labels and comments that persist across restarts. It pairs with a sibling jadx server to move from an Android app to its native libraries.

Helps LLMs write correct Ghidra scripts by providing API call-flows extracted from Ghidra's source code.

Exposes Ghidra headless binary analysis capabilities via the Model Context Protocol, enabling AI assistants to decompile, analyze, and emulate binaries with 32 tools and multi-binary support.

Enables AI coding assistants to debug and analyze JavaScript code in web pages through breakpoint debugging, function hooking, network analysis, and runtime inspection of scripts including minified code.