Your debugger just grew an HTTP API

What it does

This is a native plugin for x64dbg written in Zig. It embeds an HTTP server inside the debugger and exposes 71 tools over the Model Context Protocol, letting any MCP-compatible AI assistant drive the debugger: load binaries, set breakpoints, dump registers, scan memory, and disassemble functions. It runs entirely within x64dbg’s address space, resolving the debugger’s own API at runtime, so there is no external process or runtime framework to manage.

The interesting bit

The plugin resolves Windows-specific debugger APIs at runtime from x64bridge.dll and x64dbg.dll instead of linking against them statically. That means a single Zig codebase cross-compiles to both x32 and x64 from any host OS, yet still talks directly to the debugger guts. It essentially turns a GUI-centric Windows debugger into a headless, AI-controllable engine without touching .NET or Python.

Key highlights

• 71 MCP tools covering breakpoints, memory reads, register dumps, PE analysis, pattern scanning, and tracing
• 22 debugger event callbacks including exceptions, DLL loads, and thread creation
• Dual transport: Streamable HTTP plus legacy SSE, with mandatory Bearer token auth
• Single Zig codebase cross-compiles x32 and x64 plugins from Linux, macOS, or Windows
• Runs inside x64dbg’s process with direct SDK access — no polling, no external runtime

Verdict

Worth a look if you want an AI assistant to shoulder the tedium of stepping through malware or unpacking binaries. Skip it if you do your reversing strictly by hand and consider the GUI sacred.