GhidraMCP is LaurieWired's MCP server for Ghidra — it doesn't replace the decompiler, it hands it to whatever LLM you point at it. A four-layer chain — LLM → MCP → Ghidra plugin → Ghidra — lets the model list methods, decompile a function, rename garbage symbols, and walk cross-references through plain English instead of clicking through the GUI. 9.7k GitHub stars and counting; it ships as a Ghidra extension plus a small Python bridge script (bridge_mcp_ghidra.py) talking to Ghidra on localhost:8080.
What people are actually doing with it in 2026
- Patching old binaries for fun. A Quesma write-up wired Claude to Ghidra to give the Atari 8-bit game River Raid unlimited lives. Claude fingerprinted the hardware platform from register addresses, found the canonical 6502 lives-decrement pattern, and pinpointed the one-byte patch (
DEY→NOP). It also confidently misidentified the game as Centipede along the way — a useful reminder that "confident" and "correct" are different axes with these tools. - Malware and binary triage. Analysts are using the same pipeline to decompile Golang HTTP-server binaries and other unfamiliar malware samples, letting the model handle the tedious first pass — renaming, import listing, behavior summarization — before a human looks at anything (workflow write-up).
- CTF solving. Reversers are asking it "what's the password check in this function" instead of stepping through assembly by hand, compressing binary-reversing challenges from hours to minutes.
- It's now a training curriculum, not just a hack. REcon 2026 runs a course on "Agentic RE" built around two paths: an RE path (GhidraMCP + semantic search to explain unfamiliar binaries) and a VR path (Semgrep + CodeQL + LLM cross-checks to triage and validate real vulnerabilities).
- Hacker News has been tracking it since GhidraMCP first shipped — see the original launch thread and the "now AI can reverse malware" discussion, plus ongoing threads where operators report using it to reverse binaries with zero prior RE background.
Why operators are pairing it with local, uncensored models
This is the part that changed in 2026. Anthropic's own safeguards page now admits that "legitimate defensive security work and vulnerability research may end up getting flagged" by its cyber-content filters — and it's not theoretical. Security researchers have reported Claude Code rejecting exploit-development sessions mid-conversation as "violative cyber content," sometimes forcing a full session restart over a benign follow-up question (piunikaweb report). Researcher Tim Becker's response has become the community's talking point: "Real threat actors rely on self-hosted models anyway. No sophisticated attacker would waste a zero-day exploit by querying Anthropic's public API to generate it." The people actually getting blocked are overwhelmingly defenders, not attackers.
So the RE community routed around it. GhidraMCP is model-agnostic — anything speaking MCP works — and a small ecosystem now exists specifically to run it against local, unrestricted models instead of a hosted API:
For a solo dev or small security team, that's the actual win: privacy (a malware sample never leaves your network), cost (no per-token API bill for a long triage session), and no mid-analysis refusals on work that's legitimately defensive. The tradeoff is you also lose the vendor's abuse monitoring and audit trail — worth weighing if this is for anything beyond your own lab.
The other direction: pointing AI at your own code, continuously
The same pattern that makes GhidraMCP useful for reversing someone else's binary works in reverse — pointed at your own build, on a loop, before you ship it. The clearest large-scale proof of concept in 2026 isn't GhidraMCP, it's Google: a Gemini-based agent harness scanning the full Chrome codebase (not just fuzzer-reachable paths) fixed 1,072 vulnerabilities across two Chrome releases — more than the previous 23 milestones combined — and caught a sandbox-escape bug that had been sitting in the code for 13 years.
For a smaller dev, the practical version is: compile your binary, point GhidraMCP plus a local model at it the same way you'd point it at unknown malware, and let it hunt for the same classes of bug an attacker would look for — before an attacker does. It's not Chrome-scale, but the tooling underneath is the same idea running one repo down.