Binary Mcp

Binary MCP Server

[](https://github.com/sarks0/binary-mcp/actions) [](https://www.python.org/downloads/) [](https://opensource.org/licenses/Apache-2.0)

MCP server that gives AI assistants the ability to analyze binaries, debug processes, and inspect kernel state. Supports static analysis via Ghidra, user-mode debugging via x64dbg, kernel debugging via WinDbg, and .NET decompilation via ILSpyCmd.

Quick Start

Install

# Windows (as Administrator)
irm https://raw.githubusercontent.com/Sarks0/binary-mcp/main/install.ps1 | iex

# Linux / macOS
curl -sSL https://raw.githubusercontent.com/Sarks0/binary-mcp/main/install.py | python3 -

# Manual
git clone https://github.com/Sarks0/binary-mcp.git
cd binary-mcp && uv sync

Connect to Claude

claude mcp add binary-analysis -- uv --directory /path/to/binary-mcp run python -m src.server

Or add to your MCP config (Claude Code ~/.claude/settings.json or Claude Desktop config):

{
  "mcpServers": {
    "binary-analysis": {
      "command": "uv",
      "args": ["--directory", "/path/to/binary-mcp", "run", "python", "-m", "src.server"],
      "env": {"GHIDRA_HOME": "/path/to/ghidra"}
    }
  }
}

What You Can Do

Static Analysis - Analyze any binary without running it.

Analyze the binary at /path/to/malware.exe
Decompile the function at 0x401000
Find all suspicious API calls and crypto constants

Live Debugging - Control x64dbg from Claude.

Connect to x64dbg and set breakpoints on BCryptEncrypt
Trace execution until EAX contains a decrypted pointer
Find the OEP of this packed binary

Kernel Debugging - Inspect drivers and crash dumps.

Connect to the kernel debugger on port 50000
Show the dispatch table for \\Driver\\MyDriver
Analyze the crash dump at C:\Windows\MEMORY.DMP

.NET Analysis - Decompile managed assemblies.

Decompile the type MyNamespace.MyClass to C#

Capabilities (245 tools)

Static Analysis (Ghidra) - 35 tools

Analysis, decompilation, cross-references, memory maps, byte pattern search, function renaming, call graphs, API pattern detection (100+ Windows APIs), crypto constant identification, IOC extraction, and binary compatibility checking.

Dynamic Analysis (x64dbg) - 159 tools

| Category | What It Does | |----------|-------------| | Execution Control | Run, pause, step into/over/out, run to user code, instruction undo | | Breakpoints | Software, hardware, memory, DLL load, exception, and conditional breakpoints with logging | | Tracing | Conditional tracing (ticnd/tocnd), trace recording, OEP finder for packed binaries | | Memory | Read, write, dump, allocate, protect, pattern scan, string search, memory watch with diff | | Registers & Stack | Read/write registers, stack trace with raw fallback, expression evaluation | | Analysis | Control flow analysis, cross-references, function boundaries, disassembly with capstone fallback | | Type System | Define structs/unions, overlay on memory (VisitType), parse C headers, enumerate types | | Search | Find assembly patterns, GUIDs, module calls, string references, reference ranges | | Anti-Debug | Detect and bypass anti-debug techniques (PEB, NtGlobalFlag, heap flags) | | Watch & Logging | Watch expressions with watchdog triggers, API call logging, breakpoint hit logging | | Annotations | Comments, labels, bookmarks, function boundaries, variables | | Thread Control | Switch, suspend, resume threads individually or all at once | | Process | Attach/detach, minidump creation, module listing with exports | | Navigation | Navigate disassembly/dump/graph views, generic command execution |

Kernel Debugging (WinDbg) - 20 tools

Connection (KDNET, local kernel, crash dumps), execution control, breakpoints, register and memory inspection, driver object analysis, IOCTL decoding, process listing, and raw WinDbg command execution.

.NET Analysis (ILSpyCmd) - 7 tools

Type listing, C# decompilation, IL disassembly, type search, and full assembly decompilation.

PE Structure (pefile) - 1 tool

Comprehensive PE header, section, import, export, resource, debug, TLS, and Rich header analysis in a single fast call ( Install Extensions -> Jython**, then restart Ghidra. Ghidra 12.0.x and earlier ship with Jython built in and need no extra setup.

Development

uv run pytest              # Run tests
uv run pytest --cov=src    # With coverage
uv run ruff check src/     # Lint

Resources

• [Installation Guide](INSTALL.md)
• [Contributing](CONTRIBUTING.md)
• [WinDbg/Kernel Debugging Guide](docs/windbg-kernel-debugging.md)
• [x64dbg Architecture](docs/x64dbg-architecture.md)
• MCP Protocol

License

Apache 2.0 - See [LICENSE](LICENSE) for details.

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Sarks0
• Source: Sarks0/binary-mcp
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.