### Setup Development Environment Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Create a virtual environment and install project dependencies using the Makefile. Activate the virtual environment. ```bash make dev-setup source ./.venv/bin/activate ``` -------------------------------- ### Scripting Example: Start Server and Run Analysis Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md A bash script demonstrating how to start the pyghidra-mcp server, wait for it to be ready, run analysis commands, and then shut down the server. ```bash #!/bin/bash # Start server pyghidra-mcp --transport streamable-http --wait-for-analysis /path/to/binary & SERVER_PID=$! # Wait for server to be ready sleep 10 # Run analysis commands pyghidra-mcp-cli list binaries pyghidra-mcp-cli search symbols --binary my_binary.exe "main" -l 5 pyghidra-mcp-cli decompile --binary my_binary.exe main # Clean up kill $SERVER_PID ``` -------------------------------- ### Development Setup and Testing Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Provides commands for setting up the development environment, installing the package in editable mode, running tests, and linting the code. ```bash cd cli make dev-setup # or create venv manually pip install -e . ``` ```bash # Run tests pytest ``` ```bash # Lint ruff check . ``` -------------------------------- ### Basic Analysis Workflow Example Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Demonstrates a typical workflow for analyzing a binary using pyghidra-mcp-cli, including starting the server, listing binaries, searching symbols, decompiling, listing imports, checking cross-references, generating call graphs, and showing metadata. ```bash # Terminal 1: Start server with your binary pyghidra-mcp --transport streamable-http ./malware_sample & # Wait for analysis to complete (check logs or wait a bit) sleep 30 # Terminal 2: List available binaries pyghidra-mcp-cli list binaries # Find interesting symbols pyghidra-mcp-cli search symbols --binary malware_sample "crypto" -l 20 # Decompile a key function pyghidra-mcp-cli decompile --binary malware_sample crypto_init # List all imports to understand dependencies pyghidra-mcp-cli list imports --binary malware_sample -l 50 # Check cross-references pyghidra-mcp-cli xref --binary malware_sample 0x401000 # Generate a call graph pyghidra-mcp-cli callgraph --binary malware_sample main -d calling # Show binary metadata pyghidra-mcp-cli metadata --binary malware_sample ``` -------------------------------- ### Interactive Terminal Client Setup Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md To use the CLI client, first start a 'streamable-http' server. Then, issue commands against the running server using 'pyghidra-mcp-cli'. ```bash Start pyghidra-mcp --transport streamable-http ``` ```bash Run pyghidra-mcp-cli commands ``` -------------------------------- ### Install pyghidra-mcp-cli with uvx Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Install the CLI client using uvx. This is the recommended installation method. ```bash uvx pyghidra-mcp-cli ``` -------------------------------- ### Install pyghidra-mcp-cli with uvx Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Install the CLI package using uvx, the recommended package installer. ```bash uvx pyghidra-mcp-cli ``` -------------------------------- ### Start pyghidra-mcp server with existing project Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Start the pyghidra-mcp server, connecting to an existing Ghidra project. ```bash pyghidra-mcp --transport streamable-http --project-path /path/to/project.gpr ``` -------------------------------- ### Install uv Package Manager Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Install the uv package manager using pip. Alternatively, follow the official installation guide. ```bash pip install uv ``` -------------------------------- ### Install pyghidra-mcp-cli from source Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Install the CLI package from its source code. ```bash cd cli pip install -e . ``` -------------------------------- ### Install pyghidra-mcp-cli with pip Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Install the CLI client using pip. This is an alternative installation method. ```bash pip install pyghidra-mcp-cli ``` -------------------------------- ### Start pyghidra-mcp server to import multiple binaries Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Start the pyghidra-mcp server to import and analyze multiple binaries. The server will wait for analysis to complete. ```bash pyghidra-mcp --transport streamable-http --wait-for-analysis ./binary1 ./binary2 ``` -------------------------------- ### Start PyGhidra-MCP Server Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Starts the pyghidra-mcp server in the background using the streamable-http transport with the compiled test binary. ```bash pyghidra-mcp --transport streamable-http ./test_binary & ``` -------------------------------- ### Start pyghidra-mcp server to import and analyze binary Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Start the pyghidra-mcp server to import and analyze a single binary. The server will wait for analysis to complete. ```bash pyghidra-mcp --transport streamable-http --wait-for-analysis /bin/ls ``` -------------------------------- ### Install pyghidra-mcp-cli with pip Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Install the CLI package using pip. ```bash pip install pyghidra-mcp-cli ``` -------------------------------- ### Example: List Cross-References Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Demonstrates how to list cross-references for a symbol and print details about each reference. ```python xrefs = tools.list_xrefs("malloc") for ref in xrefs: print(f"{ref.function_name} calls malloc at {ref.from_address}") ``` -------------------------------- ### Start Server in Background Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Starts the pyghidra-mcp server in the background using streamable-http transport. The '&' symbol detaches the process. ```bash pyghidra-mcp --transport streamable-http --project-path /path/to/project.gpr & ``` -------------------------------- ### Full Analysis Before Startup Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Ensures that PyGhidra-MCP completes all analysis tasks for the specified binary before the application starts. This is useful for production environments where immediate readiness is required. ```bash pyghidra-mcp --wait-for-analysis --project-path /production/analysis /path/to/binary ``` -------------------------------- ### Run pyghidra-mcp CLI Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Installs and runs the pyghidra-mcp package as a CLI command. Creates the pyghidra_mcp_projects directory by default. ```bash uvx pyghidra-mcp # Creates pyghidra_mcp_projects directory by default ``` -------------------------------- ### Start Headless Analysis with stdio Transport Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md Use this command to start PyGhidra-MCP in headless mode, communicating via standard input/output. The server analyzes the provided binary and responds through stdio. ```bash # Start server pyghidra-mcp --transport stdio /path/to/firmware.bin & # MCP host sends tool requests via stdio # Server analyzes and responds ``` -------------------------------- ### MCP Server Configuration for PyGhidra-MCP Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md Configuration example for integrating PyGhidra-MCP with an MCP server, specifically for Claude Desktop. This JSON defines the command and arguments to run pyghidra-mcp, including environment variables like GHIDRA_INSTALL_DIR. ```json { "mcpServers": { "pyghidra-mcp": { "command": "uvx", "args": ["--from", "git+https://github.com/clearbluejar/pyghidra-mcp", "pyghidra-mcp", "--project-path", "/tmp/pyghidra", "/bin/ls"], "env": {"GHIDRA_INSTALL_DIR": "/path/to/ghidra"} } } } ``` -------------------------------- ### Run HTTP Server for Multiple Clients Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md This setup launches PyGhidra-MCP as an HTTP server, enabling multiple CLI clients or agents to connect and perform analysis. Ensure you have a separate terminal for clients. ```bash # Terminal 1: Start server pyghidra-mcp --transport streamable-http \ --project-path /analysis /path/to/binary # Terminal 2+: Multiple CLI clients or agents pyghidra-mcp-cli decompile --binary firmware main pyghidra-mcp-cli search symbols --binary firmware malloc ``` -------------------------------- ### Get All Functions Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Retrieve a list of all functions present in the binary. Optionally include external functions in the result. ```python all_funcs = tools.get_all_functions(include_externals=True) ``` -------------------------------- ### Claude Desktop Configuration for pyghidra-mcp Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Add this JSON block to your `claude_desktop_config.json` file to integrate pyghidra-mcp. Ensure the `GHIDRA_INSTALL_DIR` environment variable points to your Ghidra installation. ```json { "mcpServers": { "pyghidra-mcp": { "command": "uvx", "args": [ "--from", "git+https://github.com/clearbluejar/pyghidra-mcp", "pyghidra-mcp", "--project-path", "/tmp/pyghidra", // or path to writeable directory "/bin/ls" // ], "env": { "GHIDRA_INSTALL_DIR": "/path/to/ghidra/ghidra_12.0_PUBLIC" } } } } ``` -------------------------------- ### Set Ghidra Installation Directory Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Configure the GHIDRA_INSTALL_DIR environment variable for Linux/Mac and Windows PowerShell. ```bash # For Linux / Mac export GHIDRA_INSTALL_DIR="/path/to/ghidra/" # For Windows PowerShell [System.Environment]::SetEnvironmentVariable('GHIDRA_INSTALL_DIR','C:\path\to\ghidra') ``` -------------------------------- ### Server Initialization Function Signature Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md The signature for init_pyghidra_context, which handles full server setup from CLI arguments. This function orchestrates PyGhidra runtime initialization, context creation, binary import, analysis triggering, and MCP tool registration. ```python def init_pyghidra_context( mcp: FastMCP, *, transport: str, input_paths: list[Path], project_name: str, project_directory: str, pyghidra_mcp_dir: Path, force_analysis: bool, verbose_analysis: bool, no_symbols: bool, gdts: list[str], program_options_path: str | None, gzfs_path: str | None, threaded: bool, max_workers: int, wait_for_analysis: bool, list_project_binaries: bool, delete_project_binary: str | None, symbols_path: str | None, sym_file_path: str | None, ) -> FastMCP ``` -------------------------------- ### Run PyGhidra-MCP with MCPO using uvx Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Combines PyGhidra-MCP with MCPO (an MCP-to-OpenAPI proxy) using the uvx command-line tool. This setup allows PyGhidra-MCP's functionalities to be exposed via a RESTful API. ```bash uvx mcpo -- \ pyghidra-mcp /bin/ls ``` -------------------------------- ### List Project Binaries Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Lists all binaries within a project, providing their names and analysis status. Useful for getting an overview of project contents. ```python def list_project_binaries(ctx: Context) -> ProgramInfos: # ... implementation details ... pass infos = list_project_binaries(ctx) for prog in infos.programs: print(f"{prog.name}: analysis={'complete' if prog.analysis_complete else 'pending'}") ``` -------------------------------- ### DecompilerPool Usage Example Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Demonstrates the internal usage of the `DecompilerPool` to acquire a decompiler instance within a `with` statement for safe and efficient decompilation of a function. ```python with tools.decompiler_pool.acquire() as decompiler: result = decompiler.decompileFunction(func, timeout, monitor) ``` -------------------------------- ### Get Program Information Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Retrieves metadata and context for a specific loaded program. Use this to check analysis status and other details. ```python context = PyGhidraContext(project_name="test", project_path="/tmp/ghidra") program_info = context.get_program_info("firmware.bin") print(f"Analysis complete: {program_info.analysis_complete}") ``` -------------------------------- ### Configure PyGhidra-MCP with Environment Variables Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Set environment variables like `GHIDRA_INSTALL_DIR`, `MCP_HOST`, and `MCP_PORT` to override CLI options. This is useful for setting up the Ghidra installation path and network configuration. ```bash export GHIDRA_INSTALL_DIR="/opt/ghidra_12.0_PUBLIC" export MCP_HOST="0.0.0.0" export MCP_PORT="8000" pyghidra-mcp --transport streamable-http ``` -------------------------------- ### Python Library Usage for Analysis Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md This Python script demonstrates how to use the PyGhidra-MCP library to perform analysis programmatically. It covers project setup, binary import, analysis, and tool usage for decompilation. ```python from pyghidra_mcp import PyGhidraContext, GhidraTools context = PyGhidraContext( project_name="test", project_path="/tmp/ghidra" ) # Import binary context.import_binaries(["/path/to/binary"]) # Analyze context.analyze_project() # Use tools program_info = context.get_program_info("binary") tools = GhidraTools(program_info) func = tools.find_function("main") decomp = tools.decompile_function(func) print(decomp.code) # Cleanup context.close() ``` -------------------------------- ### schedule_startup_indexing Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Queues all binaries for indexing on server startup, with optional staggering to avoid blocking. ```APIDOC ### schedule_startup_indexing Queue all binaries for indexing (on server startup). ```python def schedule_startup_indexing(self, max_binaries: int | None = None) -> None ``` Staggers startup indexing to avoid blocking. ``` -------------------------------- ### PyGhidra-MCP Command-Line Help Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Displays the available options and arguments for the pyghidra-mcp command-line interface. Use this to understand configuration and execution parameters. ```text $ uvx pyghidra-mcp --help Usage: pyghidra-mcp [OPTIONS] [INPUT_PATHS]... PyGhidra Command-Line MCP server Options: -v, --version Show version and exit. -t, --transport [stdio|streamable-http|sse|http] Transport protocol. SSE is deprecated; use streamable-http instead. [default: stdio] -p, --port INTEGER Port for HTTP-based transports. [default: 8000] -o, --host TEXT Host for HTTP-based transports. [default: 127.0.0.1] --project-path PATH Directory for a pyghidra-mcp project or an existing Ghidra .gpr file. [default: pyghidra_mcp_projects] --project-name TEXT Ghidra project name. Ignored for .gpr paths. [default: my_project] --threaded / --no-threaded Allow threaded analysis. [default: threaded] --max-workers INTEGER Number of analysis workers; 0 means CPU count. [default: 0] --wait-for-analysis / --no-wait-for-analysis Wait for initial analysis before starting. [default: no-wait-for-analysis] --gui / --no-gui Launch Ghidra GUI in-process and serve MCP against GUI-open programs. Cannot attach to an already-running external Ghidra process. [default: no-gui] --list-project-binaries List ingested project binaries and exit. --delete-project-binary TEXT Delete a project binary by name and exit. --force-analysis / --no-force-analysis Force a new binary analysis each run. [default: no-force-analysis] --verbose-analysis / --no-verbose-analysis Verbose logging for analysis. [default: no-verbose-analysis] --no-symbols / --with-symbols Turn off symbols for analysis. [default: with-symbols] --sym-file-path PATH Single PDB symbol file for one binary. -s, --symbols-path PATH Local symbols directory. --gdt PATH Path to GDT files. May be specified multiple times. --program-options PATH JSON file with Ghidra program options. --gzfs-path PATH Location to store GZFs of analyzed binaries. -h, --help Show this message and exit. ``` -------------------------------- ### List available binaries using CLI Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Use the CLI to list all available binaries managed by the pyghidra-mcp server. ```bash pyghidra-mcp-cli list binaries ``` -------------------------------- ### Create New Project with Default Settings Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Use this command to create a new project with default settings. It generates a self-contained project structure with necessary artifacts. ```bash # Create a new project with default settings pyghidra-mcp # Creates: $ tree pyghidra_mcp_projects/ pyghidra_mcp_projects/ ├── my_project.gpr ├── my_project-pyghidra-mcp │ ├── chromadb │ └── gzfs └── my_project.rep ``` -------------------------------- ### Main Entry Point CLI Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md The pyghidra-mcp server is invoked via CLI with Click-based options. This shows the main entry point. ```bash pyghidra-mcp [OPTIONS] [INPUT_PATHS]... ``` -------------------------------- ### Get Callees Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Retrieves a list of function names that are called by a specified function. ```APIDOC ## get_callees ### Description Get functions called by a target. ### Method Signature ```python def get_callees(self, name_or_address: str) -> list[str] ``` ### Parameters #### Path Parameters - **name_or_address** (str) - Required - The name or address of the target function. ### Returns List of called function names. ``` -------------------------------- ### Initialize PyGhidraContext Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/INDEX.md Instantiate PyGhidraContext with project details and analysis options. ```python context = PyGhidraContext( project_name="test", project_path="/tmp/ghidra", force_analysis=False, ... ) ``` -------------------------------- ### Get Callees Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Retrieves a list of function names called by a specified function or address. ```python def get_callees(self, name_or_address: str) -> list[str] ``` -------------------------------- ### Schedule Startup Indexing Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Queues all binaries for indexing upon server startup. This method staggers the indexing process to prevent blocking the server's initialization. ```python def schedule_startup_indexing(self, max_binaries: int | None = None) -> None ``` -------------------------------- ### Get Referenced Strings Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Retrieves a list of string literals that are referenced within a given function. ```APIDOC ## get_referenced_strings ### Description Get string literals referenced in a function. ### Method Signature ```python def get_referenced_strings(self, name_or_address: str) -> list[str] ``` ### Parameters #### Path Parameters - **name_or_address** (str) - Required - The name or address of the function. ### Returns List of string values. ``` -------------------------------- ### Get Referenced Strings Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Retrieves a list of string literals referenced within a given function. ```python def get_referenced_strings(self, name_or_address: str) -> list[str] ``` -------------------------------- ### Initialize FastMCP Server Instance - Python Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/modules.md Creates an instance of the FastMCP server with a specified name and lifespan. Tools are registered at module import time. ```python mcp = FastMCP("pyghidra-mcp", lifespan=server_lifespan) ``` -------------------------------- ### PyGhidraContext Constructor Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/INDEX.md Demonstrates how to instantiate the PyGhidraContext with various constructor parameters for project configuration. ```APIDOC ## PyGhidraContext Constructor ### Description Initializes a PyGhidraContext with specified project settings. ### Parameters - `project_name` (string): The name of the Ghidra project. - `project_path` (string): The file system path for the project. - `force_analysis` (bool): Whether to force analysis on import. ### Example ```python context = PyGhidraContext( project_name="test", project_path="/tmp/ghidra", force_analysis=False, ... ) ``` ``` -------------------------------- ### Set Ghidra Installation Directory Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Sets the GHIDRA_INSTALL_DIR environment variable, which is required for pyghidra-mcp to locate Ghidra. ```bash export GHIDRA_INSTALL_DIR="/path/to/ghidra/" ``` -------------------------------- ### Launch GUI Mode with Live Analysis Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md Initiate PyGhidra-MCP with the `--gui` flag to launch the Ghidra GUI and enable live analysis. Changes made in the GUI, such as renaming functions, are visible in real-time. ```bash pyghidra-mcp --gui --transport streamable-http \ --project-path /research/myproject.gpr # Ghidra GUI opens # MCP tools can navigate CodeBrowser, rename functions # Changes visible in real-time in GUI ``` -------------------------------- ### disassemble Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Disassembles instructions starting from a given address in a binary. It can optionally include the raw bytes of the instructions. ```APIDOC ## disassemble ### Description Disassemble instructions at an address. ### Method Signature ```python def disassemble( binary_name: str, ctx: Context, address: str, count: int = 20, include_bytes: bool = False, ) -> DisassembleResult ``` ### Parameters #### Path Parameters - **binary_name** (str) - Required - Binary name - **address** (str) - Required - Hex address to start disassembly #### Query Parameters - **count** (int) - Optional - Number of instructions (max 200). Default: 20 - **include_bytes** (bool) - Optional - Include raw bytes in output. Default: False ### Returns `DisassembleResult` with address, instruction count, and compact listing string (one instruction per line). ### Example ```python result = disassemble( binary_name="firmware.bin", address="0x08001000", ctx=ctx, count=30, include_bytes=True ) # result.listing = "08001000 48894c240c push rbp\n08001005 55 mov rbp,rsp\n..." ``` ``` -------------------------------- ### Get All Symbols Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Retrieve a list of all symbols in the binary. Supports filtering to include external and dynamic symbols. ```python all_syms = tools.get_all_symbols(include_externals=True, include_dynamic=True) ``` -------------------------------- ### Quick Reference: Show Metadata Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md A quick command to display metadata for a specified binary. ```bash pyghidra-mcp-cli metadata --binary BINARY ``` -------------------------------- ### Example MCP Error Response Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Illustrates the JSON structure for an error response, specifically for invalid parameters. ```json { "error": { "code": "INVALID_PARAMS", "message": "Function or symbol 'nonexistent' not found." } } ``` -------------------------------- ### Program Options JSON Format Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Example JSON structure for specifying Ghidra program analyzer options. ```json { "analyze.MipsAnalyzer": true, "analyze.x86.AnalysisOptions": { "option1": "value1" } } ``` -------------------------------- ### goto Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Navigates the Ghidra GUI to a specified address or function within a given binary. ```APIDOC ## goto ### Description Navigate the Ghidra GUI to an address or function. ### Method ```python def goto( binary_name: str, target: str, target_type: Literal["address", "function"], ctx: Context, ) -> GotoResponse ``` ### Parameters #### Path Parameters - **binary_name** (str) - Required - Binary name - **target** (str) - Required - Address or function name - **target_type** ("address" | "function") - Required - Type of target ### Returns `GotoResponse` with success flag and resolved address. ### Example ```python result = goto( binary_name="firmware.bin", target="main", target_type="function", ctx=ctx ) # result.success = True # result.address = "0x08001000" ``` ``` -------------------------------- ### Run PyGhidra-MCP with Default Configuration Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Executes PyGhidra-MCP using all default settings. This creates a project in the current directory, uses stdio transport, and performs background indexing without waiting for analysis to complete. ```bash pyghidra-mcp ``` -------------------------------- ### Get All Strings Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Retrieve a list of all defined strings within the binary. Each string is returned with its value and memory address. ```python all_strings = tools.get_all_strings() ``` -------------------------------- ### Create and Compile C Test Binary Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Defines a simple C program and compiles it into an executable file named 'test_binary'. This is a prerequisite for testing CLI commands that operate on binaries. ```c #include void function_one(int x) { if (x > 0) { printf("Positive: %d", x); } else { printf("Non-positive: %d", x); } } void function_two(char* str) { printf("%s", str); } int main() { function_one(42); function_two("Hello, World!"); return 0; } ``` ```bash cat > test_binary.c << 'EOF' #include void function_one(int x) { if (x > 0) { printf("Positive: %d", x); } else { printf("Non-positive: %d", x); } } void function_two(char* str) { printf("%s", str); } int main() { function_one(42); function_two("Hello, World!"); return 0; } EOF gcc -o test_binary test_binary.c ``` -------------------------------- ### disassemble Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Disassembles instructions starting from a given memory address. Allows specifying the number of instructions and whether to include raw bytes. ```APIDOC ## disassemble ### Description Disassemble instructions at an address. ### Method `disassemble` ### Parameters #### Path Parameters None #### Query Parameters * **address** (str) - Required - Hex address * **count** (int) - Optional - Instructions (max 200) (default: 20) * **include_bytes** (bool) - Optional - Include raw bytes (default: False) ### Response #### Success Response `DisassembleResult` with compact text listing. Format: `address [bytes] mnemonic operands` (one per line). ``` -------------------------------- ### Quick Reference: List Imports Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md A quick command to list imported functions or libraries for a given binary. ```bash pyghidra-mcp-cli list imports --binary BINARY -l LIMIT ``` -------------------------------- ### Get Active GUI Context Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Retrieves the current state and location of the active GUI context, including the active program and address. ```python def get_active_gui_context(self) -> dict ``` -------------------------------- ### Example: Search for Function Symbols Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Searches for function symbols matching a regex pattern, limiting results and specifying to only include functions. ```python funcs = tools.search_symbols_by_name("^usb_.*init", functions_only=True, limit=50) ``` -------------------------------- ### Initialize GhidraTools Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Instantiate GhidraTools with program information obtained from PyGhidraContext. This is the first step before using other GhidraTools methods. ```python context = PyGhidraContext(project_name="test", project_path="/tmp/ghidra") program_info = context.get_program_info("firmware.bin") tools = GhidraTools(program_info) ``` -------------------------------- ### Configure Transport Protocol Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Specify the transport protocol for communication. 'stdio' is for subprocess invocation, while 'streamable-http' is recommended for GUI and multi-client setups. ```bash pyghidra-mcp --transport streamable-http /bin/ls ``` -------------------------------- ### Run pyghidra-mcp in GUI mode with Streamable HTTP Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Launch pyghidra-mcp in GUI mode using the Streamable HTTP transport. Specify the project path using the --project-path argument. ```bash pyghidra-mcp \ --gui \ --transport streamable-http \ --project-path /absolute/path/to/my_project.gpr ``` -------------------------------- ### Enable Verbose Logging in Analysis Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md Use the --verbose-analysis flag to get detailed output during binary analysis. This is helpful for debugging analysis issues. ```bash pyghidra-mcp --verbose-analysis /path/to/binary ``` -------------------------------- ### Create Project with Custom Path and Name Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Create a project with a custom name and location by specifying the project path and name. This allows for better organization of analysis artifacts. ```bash # Create project with custom name and location pyghidra-mcp --project-path ~/analysis/malware_study --project-name malware_analysis $ tree ~/analysis/ /home/vscode/analysis/ └── malware_study ├── malware_analysis.gpr ├── malware_analysis-pyghidra-mcp │ ├── chromadb │ └── gzfs └── malware_analysis.rep ``` -------------------------------- ### Rename Function Example Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Renames a function in Ghidra. This operation is atomic and returns a dictionary with the old and new names. Use this to standardize function naming. ```python result = tools.rename_function("FUN_08001000", "initialize_device") ``` -------------------------------- ### Import Binary Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Imports a binary file into the Ghidra project. ```bash pyghidra-mcp-cli import ``` -------------------------------- ### Python Client: Handling Batch Operation Errors Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/errors.md Example of iterating through results from a batch operation and checking for individual errors within the results list. ```python # decompile_function with multiple targets returns list results = await decompile_function( binary_name="firmware.bin", name_or_address=["main", "nonexistent", "init"], ctx=ctx ) for result in results: if result.error: print(f"Error decompiling {result.name}: {result.error}") else: print(f"Decompiled {result.name}") ``` -------------------------------- ### GUI Mode with a Specific Project Path Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Launches PyGhidra-MCP in GUI mode, utilizing a streamable HTTP transport and specifying a custom project path for analysis. ```bash pyghidra-mcp --gui --transport streamable-http \ --project-path /research/myproject ``` -------------------------------- ### List Open Programs (GUI) Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Lists programs that are currently open in the Ghidra GUI. This command requires the `--gui` server to be running. ```bash pyghidra-mcp-cli list open-programs ``` -------------------------------- ### Python Client: Handling Single Tool Errors Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/errors.md Example of catching McpError in Python and checking specific error codes like INVALID_PARAMS or INTERNAL_ERROR. ```python from mcp.shared.exceptions import McpError from mcp.types import ErrorData try: result = decompile_function( binary_name="firmware.bin", name_or_address="main", ctx=ctx ) except McpError as e: if e.error.code == "INVALID_PARAMS": print(f"Invalid parameter: {e.error.message}") elif e.error.code == "INTERNAL_ERROR": print(f"Server error: {e.error.message}") ``` -------------------------------- ### Configure Storage Paths Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Specify directories for analyzed binary .gzf files and a JSON file for Ghidra program analyzer options. ```bash pyghidra-mcp --gzfs-path /fast/ssd/ghidra_cache \ --program-options /etc/ghidra-opts.json /path/to/binary ``` -------------------------------- ### Disassembly Result Model Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/types.md Contains the disassembly listing for a given address range. Includes the starting address, instruction count, and the formatted listing. Used by `disassemble`. ```python class DisassembleResult(BaseModel): address: str count: int listing: str ``` -------------------------------- ### List All Project Binary Infos Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Fetches metadata for all binaries within the Ghidra project. This provides a comprehensive overview of each binary's analysis status and metadata. ```python infos = context.list_project_binary_infos() for info in infos: print(f"{info.name}: {'done' if info.analysis_complete else 'pending'}") ``` -------------------------------- ### Batch Operation Error Handling Example Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md Illustrates how errors are returned inline for individual items in a batch operation. Other items in the batch may still succeed. ```json [ {"name": "main", "code": "void main() { ... }"}, {"name": "bad_func", "code": "", "error": "Function or symbol 'bad_func' not found."} ] ``` -------------------------------- ### Configure Project Path and Name Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Specify the directory for Ghidra projects or an existing .gpr file. The project name is used when creating a new project in a directory. ```bash # Create/open project in custom directory pyghidra-mcp --project-path ~/research --project-name malware_study /path/to/binary ``` ```bash # Open existing .gpr file pyghidra-mcp --project-path /existing/project.gpr ``` -------------------------------- ### PyGhidraContext Methods Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/INDEX.md Provides methods for managing Ghidra projects in a headless environment. These include retrieving program information, listing and importing binaries, analyzing the project, deleting programs, and managing the context lifecycle. ```APIDOC ## PyGhidraContext ### Description Manages Ghidra projects in a headless environment. ### Methods - `get_program_info(binary_name)`: Retrieves information about a specific program. - `list_binaries()`: Lists all available binaries in the project. - `import_binary(path)`: Imports a binary file into the project. - `analyze_project()`: Triggers an analysis of the entire project. - `delete_program(name)`: Deletes a program from the project. - `save()`: Saves the current project state. - `close()`: Closes the Ghidra context. ``` -------------------------------- ### Get Project Binary Metadata Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Retrieves detailed metadata for a specific binary in the project, including architecture, compiler, and file hashes. Use this to understand binary characteristics. ```python def list_project_binary_metadata(binary_name: str, ctx: Context) -> dict: # ... implementation details ... pass metadata = list_project_binary_metadata("firmware.bin", ctx) # metadata = { # "architecture": "x86:LE:64:default", # "compiler": "clang (14.0.6)", # ... # } ``` -------------------------------- ### Launch PyGhidra-MCP in GUI Mode Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Use the `--gui` option to launch Ghidra in GUI mode. This requires a streaming HTTP transport. It exposes GUI-only tools and runs mutation tools as live Ghidra transactions. ```bash pyghidra-mcp --gui --transport streamable-http \ --project-path /research/myproject.gpr ``` -------------------------------- ### Disassemble Instructions from Binary Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Disassembles instructions starting from a given address in a binary file. Optionally include raw instruction bytes. The maximum number of instructions to disassemble is 200. ```python def disassemble( binary_name: str, ctx: Context, address: str, count: int = 20, include_bytes: bool = False, ) -> DisassembleResult ``` ```python result = disassemble( binary_name="firmware.bin", address="0x08001000", ctx=ctx, count=30, include_bytes=True ) # result.listing = "08001000 48894c240c push rbp\n08001005 55 mov rbp,rsp\n..." ``` -------------------------------- ### Bytes Read Result Model Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/types.md Represents raw bytes read from a specific memory address in the binary. Includes the starting address, size, and hex-encoded data. Used by `read_bytes`. ```python class BytesReadResult(BaseModel): address: str size: int data: str ``` -------------------------------- ### Launch Ghidra GUI with pyghidra-mcp Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Launches and controls a live Ghidra GUI from MCP using streamable-http transport. Requires specifying host, port, project path, and project name. ```bash uvx pyghidra-mcp \ --gui \ --transport streamable-http \ --host 127.0.0.1 \ --port 8000 \ --project-path /absolute/path/to/ghidra-projects \ --project-name my_project ``` -------------------------------- ### Get Ghidra GUI Context Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Retrieves the current active user location and metadata within the Ghidra GUI, such as the active program, function, and address. This function is only available in GUI mode. ```python def get_gui_context(ctx: Context) -> GuiContextResponse: # ... implementation details ... pass context = get_gui_context(ctx) # context.active_program = "firmware.bin" # context.active_function = "main" # context.active_address = "0x08001234" ``` -------------------------------- ### GuiPyGhidraContext.goto Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Navigates the Ghidra GUI to a specific address or function within a given program. ```APIDOC ## goto ### Description Navigates the Ghidra GUI to a specified target (address or function) within a given binary. ### Method ```python def goto(self, binary_name: str, target: str, target_type: str) -> dict ``` ### Parameters - **binary_name** (str) - Required - The name of the binary to navigate within. - **target** (str) - Required - The address or function name to navigate to. - **target_type** (str) - Required - The type of the target, e.g., 'address' or 'function'. ### Returns - `dict`: A dictionary with keys `"success"` (bool) and `"address"` (str) indicating the outcome of the navigation. ``` -------------------------------- ### Import New Binary Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Imports a new binary file into the current Ghidra project. Provide the full path to the binary. ```bash pyghidra-mcp-cli import /path/to/new_binary ``` -------------------------------- ### Open Existing Ghidra Project Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Open an existing Ghidra project by providing the path to its `.gpr` file. PyGhidra-mcp will automatically create its associated artifacts in a sibling directory. ```bash # Open existing Ghidra project (project name derived from filename) pyghidra-mcp --project-path ~/existing/ghidra/my_research.gpr # Result: ~/existing/ghidra/my_research-pyghidra-mcp/ # └── chromadb/, gzfs/ (pyghidra-mcp additions) ``` -------------------------------- ### Quick Reference: List Exports Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md A quick command to list exported functions or symbols from a binary. ```bash pyghidra-mcp-cli list exports --binary BINARY -l LIMIT ``` -------------------------------- ### PyGhidraContext Class Definition Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Defines the PyGhidraContext class, the main context for headless operation in PyGhidra. It inherits from IndexingMixin and includes numerous parameters for configuring project setup, analysis, and symbol handling. ```python class PyGhidraContext(IndexingMixin): def __init__( self, project_name: str, project_path: str | Path, pyghidra_mcp_dir: Path | None = None, force_analysis: bool = False, verbose_analysis: bool = False, no_symbols: bool = False, gdts: list | None = None, program_options: dict | None = None, gzfs_path: str | Path | None = None, threaded: bool = True, max_workers: int | None = None, wait_for_analysis: bool = False, symbols_path: str | Path | None = None, sym_file_path: str | Path | None = None, ) ``` -------------------------------- ### List Project Binaries Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/configuration.md Use the `--list-project-binaries` flag to list all binaries within a specified project and then exit. This is useful for inspecting project contents. ```bash # List binaries in project pyghidra-mcp --list-project-binaries --project-path /analysis ``` -------------------------------- ### Rename Function Example Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md Demonstrates how to rename a function using the tools.rename_function method. This operation uses Ghidra transactions for ACID semantics and invalidates the decompiler cache on success. The result includes old and new values for confirmation. ```python result = tools.rename_function("old_name", "new_name") # {"address": "0x08001000", "old_name": "old_name", "new_name": "new_name"} ``` -------------------------------- ### GhidraTools Initialization Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/ghidra-tools.md Initializes the GhidraTools class with program information. ```APIDOC ## GhidraTools Initialization Initializes the GhidraTools class with program information. ### Method Signature ```python __init__(self, program_info: ProgramInfo) ``` ### Parameters #### Path Parameters - **program_info** (ProgramInfo) - Required - Context from PyGhidraContext.get_program_info() ### Request Example ```python context = PyGhidraContext(project_name="test", project_path="/tmp/ghidra") program_info = context.get_program_info("firmware.bin") tools = GhidraTools(program_info) ``` ``` -------------------------------- ### Open Program in GUI Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Opens a specified binary in the Ghidra CodeBrowser. Requires the `--gui` server to be running. Supports opening in new or reusing existing windows. ```bash pyghidra-mcp-cli open program --binary [options] ``` -------------------------------- ### GuiPyGhidraContext Initialization Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Initializes the GUI-backed context, which runs within the Ghidra GUI's JVM and synchronizes live state. It inherits from MCPContext and IndexingMixin. ```python class GuiPyGhidraContext(IndexingMixin): def __init__(self, project_spec: ProjectSpec) ``` -------------------------------- ### Package Layout Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/INDEX.md Illustrates the directory structure of the pyghidra-mcp package, highlighting key modules and their purposes. ```text pyghidra_mcp/ ├── __init__.py # Lazy-loaded public API ├── server.py # FastMCP server + CLI ├── context.py # PyGhidraContext ├── gui_context.py # GuiPyGhidraContext ├── tools.py # GhidraTools ├── mcp_tools.py # MCP tool handlers ├── models.py # Pydantic models └── [support] # indexing, decompiler_pool, etc. ``` -------------------------------- ### View Project Directory Structure Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/README.md This illustrates the typical directory structure of a PyGhidra-MCP project, including configuration files, analysis results, and caches. ```text project_dir/ ├── project.gpr ├── project.rep/ └── pyghidra-mcp/ ├── chromadb/ (code search index) ├── gzfs/ (analyzed .gzf files) └── symbols/ (symbol cache) ``` -------------------------------- ### Show Metadata Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Displays metadata associated with a specific binary in the project. ```bash pyghidra-mcp-cli metadata --binary ``` -------------------------------- ### Run pyghidra-mcp Docker container with SSE Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Launch the pyghidra-mcp Docker container with the Server-sent Events (SSE) transport enabled. The server will listen on http://127.0.0.1:8000/sse. ```bash docker run -p 8000:8000 ghcr.io/clearbluejar/pyghidra-mcp -t sse ``` -------------------------------- ### Launch PyGhidra-MCP in GUI Mode Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Launch pyghidra-mcp in GUI mode to interact with Ghidra's live program objects. This mode requires `--transport streamable-http` and automatically launches Ghidra. ```bash pyghidra-mcp \ --gui \ --transport streamable-http \ --project-path /absolute/path/to/my_research.gpr ``` -------------------------------- ### open_program_in_gui Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Opens a specified binary project in the Ghidra GUI CodeBrowser. It can open the binary in a new window or reuse an existing one if available. ```APIDOC ## open_program_in_gui ### Description Open a project binary in the Ghidra GUI CodeBrowser. ### Method ```python def open_program_in_gui( binary_name: str, new_window: bool = True, ctx: Context, ) -> OpenProgramInfo ``` ### Parameters #### Path Parameters - **binary_name** (str) - Required - Binary name - **new_window** (bool) - Optional - Open in new window; False reuses existing if available. Defaults to True. ### Returns `OpenProgramInfo` with opened program info. ### Throws ValueError if not in GUI mode. ### Example ```python info = open_program_in_gui( binary_name="firmware.bin", new_window=False, ctx=ctx ) ``` ``` -------------------------------- ### Import Binary into Project Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/mcp-tools.md Imports a binary file or recursively scans a directory for binaries to import into the project. Returns the status of the import request. ```python def import_binary(binary_path: str, ctx: Context) -> ImportRequestResult: # ... implementation details ... pass result = import_binary("/path/to/firmware.bin", ctx) # result.queued_count = 1 # result.queued_paths = ["/path/to/firmware.bin"] # result.message = "1 binary queued for import" ``` -------------------------------- ### Map Binaries with Docker Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/README.md Integrates PyGhidra-MCP with Docker by mapping local binary directories into the container. This allows the containerized tool to access and analyze files from your host system. ```bash # Create and populate the new directory mkdir -p ./binaries cp /path/to/your/binaries/* ./binaries/ # Run the Docker container with volume mapping docker run -i --rm \ -v "$(pwd)/binaries:/binaries" \ ghcr.io/clearbluejar/pyghidra-mcp \ /binaries/* ``` -------------------------------- ### Quick Reference: Generate Call Graph Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md A quick command to generate a call graph for a function, with options for direction. ```bash pyghidra-mcp-cli callgraph --binary BINARY FUNCTION -d DIRECTION ``` -------------------------------- ### Navigate GUI Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/cli/README.md Navigates the Ghidra GUI to a specified target (address or function). Requires the `--gui` server to be running. ```bash pyghidra-mcp-cli goto --binary --type [address|function] ``` -------------------------------- ### list_project_binary_infos Source: https://github.com/clearbluejar/pyghidra-mcp/blob/main/_autodocs/api-reference/context.md Retrieves detailed metadata for all binaries within the project. ```APIDOC ## list_project_binary_infos ### Description Get metadata for all binaries in the project. ### Method Signature ```python def list_project_binary_infos(self) -> list[ProgramInfoModel] ``` ### Returns List of `ProgramInfoModel` (the API model) with name, analysis_complete, metadata, indexing state. ### Example ```python infos = context.list_project_binary_infos() for info in infos: print(f"{info.name}: {'done' if info.analysis_complete else 'pending'}") ``` ```