Your LLM now decompiles binaries while you get coffee

What it does It’s a Ghidra plugin plus a Python MCP bridge. The plugin spins up an HTTP server inside your running Ghidra instance, and the bridge (bridge_mcp_ghidra.py) exposes that to MCP clients like Claude Desktop, Cline, or 5ire. The model can then decompile functions, list methods, classes, imports, and exports, and rename methods and data on its own.

The interesting bit The rename capability is the quiet headline: an LLM that reads decompiled code and applies meaningful names back into the project turns the most tedious part of reverse engineering — labeling FUN_00401000 forever — into a background task. It’s a human-in-the-loop workflow where the loop is mostly model.

Key highlights

• Ghidra plugin + Python MCP server, Apache 2.0, from LaurieWired
• Decompilation, method/class/import/export listing, and automatic renaming exposed as MCP tools
• Works with any MCP client in theory; Claude Desktop, Cline, and 5ire setups are documented
• Server host and port are configurable, defaulting to localhost:8080
• Buildable from source with Maven against your local Ghidra jars

Caveats

• Requires a running Ghidra instance with the plugin enabled — it drives Ghidra, it doesn’t replace it
• The README doesn’t enumerate the full tool list or discuss safety limits on autonomous renaming, so expect some trial and error

Verdict Reverse engineers and security researchers who already live in Ghidra should try this immediately. If you never open a disassembler, this is a fascinating demo of MCP’s reach rather than a tool you need.