### Import/Export Example

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/08-data-types.md

An example illustrating the import/export format string.

```plaintext
CreateProcessA -> 0x140010000
```

--------------------------------

### Example Response for GET /xrefs_to

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Illustrates the format of the response when querying for cross-references TO a specific address. Each line indicates the source address, the function it originates from, and the type of reference.

```text
From 0x140001050 in main [UNCONDITIONAL_CALL]
From 0x140001200 in sub_1400020a0 [UNCONDITIONAL_JUMP]
```

--------------------------------

### Ghidra Plugin Installation Path

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Place the compiled plugin JAR file in Ghidra's extension directory to install the plugin.

```text
{GHIDRA_INSTALL}/Extensions/Ghidra/
```

--------------------------------

### Start HTTP Server

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/04-java-plugin-api.md

Initializes and starts the embedded HTTP server. Reads the configured port, stops any existing server, registers endpoint handlers, and starts the server in a background thread.

```java
private void startServer() throws IOException
```

--------------------------------

### Install Python Packages

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Install required Python packages like 'requests' and 'mcp' using pip, or install all dependencies from a requirements file.

```bash
pip install requests mcp
# Or
pip install -r requirements.txt
```

--------------------------------

### Install Python Dependencies

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Install the necessary Python libraries for GhidraMCP. This includes the 'requests' and 'mcp' libraries.

```bash
pip install requests mcp
```

--------------------------------

### Install Python Dependencies via Pip

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Install the specified Python packages and their version constraints using pip.

```bash
pip install "requests>=2,<3" "mcp>=1.2.0,<2"
```

--------------------------------

### Start GhidraMCP Server with SSE Transport

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Start the GhidraMCP server using the SSE (Server-Sent Events) transport. This command should be run in a separate terminal.

```bash
cd /path/to/ghidramcp
python bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081
```

--------------------------------

### Command-Line: SSE Transport Default Settings

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Example of enabling SSE transport, which defaults to listening on http://127.0.0.1:8081/sse.

```bash
python bridge_mcp_ghidra.py --transport sse
# Listens on http://127.0.0.1:8081/sse
```

--------------------------------

### Memory Segment Example

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/08-data-types.md

An example illustrating the memory segment format string.

```plaintext
.text: 0x140001000 - 0x140050000
```

--------------------------------

### Python Dependencies from requirements.txt

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

List of Python dependencies and their version constraints, typically used with pip install -r.

```text
requests>=2,<3
mcp>=1.2.0,<2
```

--------------------------------

### GET /methods

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of available methods within the GhidraMCP system.

```APIDOC
## GET /methods

### Description
Retrieves a list of available methods within the GhidraMCP system.

### Method
GET

### Endpoint
/methods
```

--------------------------------

### Example response formats for safe_get

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Illustrates the expected response formats for the safe_get function, showing both successful data retrieval and error scenarios.

```python
# Success
["line 1", "line 2", "line 3"]

# Error
["Error 404: Not Found"]
["Request failed: Connection refused"]
```

--------------------------------

### GET /classes

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of classes or namespaces available in Ghidra.

```APIDOC
## GET /classes

### Description
Retrieves a list of classes or namespaces available in Ghidra.

### Method
GET

### Endpoint
/classes
```

--------------------------------

### Examples of Ghidra Server URL Formats

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Illustrates various valid formats for the --ghidra-server argument, including different protocols, hostnames, IP addresses, and ports.

```bash
--ghidra-server http://localhost:8080/
```

```bash
--ghidra-server http://127.0.0.1:9000/
```

```bash
--ghidra-server http://192.168.1.100:8080/
```

```bash
--ghidra-server https://ghidra.example.com:8443/
```

--------------------------------

### GhidraMCPPlugin Constructor

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/04-java-plugin-api.md

Initializes the GhidraMCPPlugin with a PluginTool instance. It registers configuration options, attempts to start the HTTP server, and logs any startup errors.

```java
public GhidraMCPPlugin(PluginTool tool)
```

--------------------------------

### GET /list_functions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Lists all functions in the program without pagination.

```APIDOC
## GET /list_functions

### Description
Lists all functions in the program (no pagination).

### Method
GET

### Endpoint
/list_functions

### Parameters
None

### Response
#### Success Response (200)
- **Body**: Formatted as `{name} at {address}`
```

--------------------------------

### Command-Line: Default Stdio Transport

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Example of running the script with default settings, using stdio transport and connecting to the local Ghidra server.

```bash
python bridge_mcp_ghidra.py
# Connects to http://127.0.0.1:8080/
# Communicates via stdio
```

--------------------------------

### Quick Function Overview Workflow

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

This workflow outlines the steps to get a comprehensive view of a single function, including its signature, pseudocode, callers, and callees.

```text
User: "Tell me about the main function"

Claude (using tools):
1. list_methods() → find "main"
2. get_function_by_address("0x140001000") → get signature
3. decompile_function("main") → get pseudocode
4. get_xrefs_to("0x140001000") → find callers
5. get_xrefs_from("0x140001000") → find callees
```

--------------------------------

### HTTP GET Request with Timeout

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Performs an HTTP GET request with a 5-second timeout. Timeout exceptions are caught and returned as 'Request failed' messages.

```python
response = requests.get(url, params=params, timeout=5)
```

--------------------------------

### GET /namespaces

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of non-global namespaces within the Ghidra project.

```APIDOC
## GET /namespaces

### Description
Retrieves a list of non-global namespaces within the Ghidra project.

### Method
GET

### Endpoint
/namespaces
```

--------------------------------

### GET /data

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of defined data items in the Ghidra project.

```APIDOC
## GET /data

### Description
Retrieves a list of defined data items in the Ghidra project.

### Method
GET

### Endpoint
/data
```

--------------------------------

### Paginate Search Results for Crypto Functions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

This example shows how to paginate through search results for specific function names, like 'crypto'. It includes a check to stop if no matching functions are found.

```python
def search_all_crypto_functions():
    results = []
    offset = 0
    limit = 50
    
    while True:
        batch = search_functions_by_name("crypto", offset=offset, limit=limit)
        if not batch or "No functions matching" in batch[0]:
            break
        results.extend(batch)
        offset += limit
    
    return results
```

--------------------------------

### Analyze Security with Claude Desktop

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Example of a user prompt to Claude Desktop for analyzing a function's security. Claude uses integrated tools to provide a detailed report.

```text
User: "Analyze the security of the main function"

Claude analyzes using tools and reports:
1. Function signature
2. Parameters and return type
3. Internal calls and data accesses
4. Potential vulnerabilities
5. Recommended improvements
```

--------------------------------

### GET /methods

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Lists all function names in the currently loaded Ghidra program. Supports pagination via offset and limit query parameters.

```APIDOC
## GET /methods

### Description
Lists all function names in the program. Supports pagination.

### Method
GET

### Endpoint
/methods

### Parameters
#### Query Parameters
- **offset** (int) - Optional - Starting position in list (default: 0)
- **limit** (int) - Optional - Maximum results to return (default: 100)

### Response
#### Success Response (200)
- **Content-Type**: text/plain; charset=utf-8
- **Body**: Newline-delimited function names

#### Error Responses
- `No program loaded` - No program is currently open

### Request Example
```curl
http://localhost:8080/methods?offset=0&limit=10
```
```

--------------------------------

### GET /imports

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of imported symbols from external libraries.

```APIDOC
## GET /imports

### Description
Retrieves a list of imported symbols from external libraries.

### Method
GET

### Endpoint
/imports
```

--------------------------------

### Run GhidraMCP MCP Server for Cline

Source: https://github.com/lauriewired/ghidramcp/blob/main/README.md

Start the GhidraMCP MCP server with SSE transport for use with Cline. Defaults are provided if not specified.

```bash
python bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/
```

--------------------------------

### List Available Methods via HTTP

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Use curl to send an HTTP GET request to the GhidraMCP server to list available methods. The 'limit' parameter can be used to control the number of results.

```bash
# List methods
curl "http://localhost:8080/methods?limit=10"
```

--------------------------------

### GET /exports

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Lists exported functions and symbols from the program, including their addresses. Supports pagination.

```APIDOC
## GET /exports

### Description
Lists exported functions and symbols.

### Method
GET

### Endpoint
/exports

### Parameters
#### Query Parameters
- **offset** (int) - Optional - Starting position in list (default: 0)
- **limit** (int) - Optional - Maximum results to return (default: 100)

### Response
#### Success Response (200)
- **Body**: Formatted as `{name} -> {address}`
```

--------------------------------

### GET /list_functions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of all functions identified within the Ghidra project.

```APIDOC
## GET /list_functions

### Description
Retrieves a list of all functions identified within the Ghidra project.

### Method
GET

### Endpoint
/list_functions
```

--------------------------------

### Verify Ghidra Plugin Loaded

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Check the Ghidra console for specific log messages indicating that the GhidraMCPPlugin has loaded successfully and the HTTP server has started.

```text
GhidraMCPPlugin loading...
GhidraMCP HTTP server started on port 8080
GhidraMCPPlugin loaded!
```

--------------------------------

### GET /segments

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Lists all memory segments/blocks with their address ranges. Supports pagination.

```APIDOC
## GET /segments

### Description
Lists all memory segments/blocks with address ranges.

### Method
GET

### Endpoint
/segments

### Parameters
#### Query Parameters
- **offset** (int) - Optional - Starting position in list (default: 0)
- **limit** (int) - Optional - Maximum results to return (default: 100)

### Response
#### Success Response (200)
- **Body**: Formatted as `{name}: {start_address} - {end_address}`
```

--------------------------------

### Command-Line: Stdio Transport to Remote Ghidra

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Example of specifying a remote Ghidra server URL while using the default stdio transport.

```bash
python bridge_mcp_ghidra.py --ghidra-server http://192.168.1.100:8080/
# Connects to remote Ghidra server
```

--------------------------------

### GET /exports

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of exported symbols from the current Ghidra project.

```APIDOC
## GET /exports

### Description
Retrieves a list of exported symbols from the current Ghidra project.

### Method
GET

### Endpoint
/exports
```

--------------------------------

### GET /data

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Lists defined data labels and their associated values. Supports pagination.

```APIDOC
## GET /data

### Description
Lists defined data labels and their values.

### Method
GET

### Endpoint
/data

### Parameters
#### Query Parameters
- **offset** (int) - Optional - Starting position in list (default: 0)
- **limit** (int) - Optional - Maximum results to return (default: 100)

### Response
#### Success Response (200)
- **Body**: Formatted as `{address}: {label} = {value}`
```

--------------------------------

### Example response formats for safe_post

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Shows the expected response formats for the safe_post function, including successful string results and various error messages.

```python
# Success
"Result text"

# Error
"Error 404: Not Found"
"Request failed: Connection timeout"
```

--------------------------------

### GET /strings

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Lists all defined strings with optional filtering by substring. Supports pagination and special character escaping.

```APIDOC
## GET /strings

### Description
Lists all defined strings with optional filtering.

### Method
GET

### Endpoint
/strings

### Parameters
#### Query Parameters
- **offset** (int) - Optional - Starting position in list (default: 0)
- **limit** (int) - Optional - Maximum results to return (default: 2000)
- **filter** (string) - Optional - Substring filter (case-insensitive)

### Response
#### Success Response (200)
- **Body**: Formatted as `{address}: "{string_value}"`

### Notes
- Special characters are escaped: `\n`, `\r`, `\t`, `\xHH`
- Non-ASCII characters are escaped to hex
```

--------------------------------

### GET /xrefs_from

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Retrieves all cross-references originating FROM a specific memory address. This helps in tracing the execution flow or data access patterns starting from a given point.

```APIDOC
## GET /xrefs_from

### Description
Gets all cross-references FROM a specific address.

### Method
GET

### Endpoint
/xrefs_from

### Parameters
#### Query Parameters
- **address** (string) - Required - Source address (hex)
- **offset** (int) - Optional - Starting position in results (default: 0)
- **limit** (int) - Optional - Maximum results (default: 100)

### Response
#### Success Response (200)
- **to_address** (string) - The address to which the reference points.
- **target_info** (string) - Information about the target (function name, data path, or empty).
- **ref_type** (string) - The type of cross-reference (e.g., call, jump, read, write).

### Notes
- `target_info` is function name if target is a function, data path if data, or empty
- Reference type indicates kind of reference (call, jump, read, write, etc.)
```

--------------------------------

### Configure Cline Remote Server for GhidraMCP

Source: https://github.com/lauriewired/ghidramcp/blob/main/README.md

Add GhidraMCP as a remote server in Cline. The Server URL must match the MCP host and port used when starting the server.

```text
1. Server Name: GhidraMCP
2. Server URL: http://127.0.0.1:8081/sse
```

--------------------------------

### Configure 5ire with Manual Launch

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Set up GhidraMCP in 5ire UI for manual launch. 5ire will manage the Python process, using the default stdio transport.

```text
Tool Key: ghidra
Name: GhidraMCP
Command: python /path/to/bridge_mcp_ghidra.py
```

--------------------------------

### Get Reference Information as String

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/08-data-types.md

Formats details about a code reference, including the source address, the name of the function it belongs to, and the reference type. Requires a reference manager and address.

```java
Reference ref = refManager.getReferencesTo(addr).next();
String refInfo = String.format(
    "From %s in %s [%s]",
    ref.getFromAddress(),
    fromFunc.getName(),
    ref.getReferenceType().getName()
);
```

--------------------------------

### List Memory Segments with Ranges

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Retrieves a list of memory segments with their start and end addresses. Supports pagination.

```text
.text: 0x140001000 - 0x140050000
.data: 0x140051000 - 0x140052000
.rsrc: 0x140053000 - 0x140060000
```

--------------------------------

### List All Functions with Signatures

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Demonstrates how to list functions and retrieve their signatures programmatically using the MCP client. Requires an active MCP server session.

```python
# Using MCP server programmatically
from mcp.client import ClientSession

async with ClientSession("http://localhost:8081/sse") as session:
    methods = await session.call_tool("list_methods", {"offset": 0, "limit": 100})
    for func_name in methods:
        info = await session.call_tool("get_function_by_address", 
                                       {"address": ...})
        print(f"{func_name}: {info.signature}")
```

--------------------------------

### Get Function Information as String

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/08-data-types.md

Retrieves and formats information about a function, including its name, entry point, and signature. Requires a Ghidra Address object.

```java
Function func = program.getFunctionManager().getFunctionAt(addr);
String info = String.format(
    "Function: %s at %s\nSignature: %s",
    func.getName(),
    func.getEntryPoint(),
    func.getSignature()
);
```

--------------------------------

### List Segments

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Lists all memory segments within the loaded binary, including their start and end addresses.

```APIDOC
## GET /segments

### Description
Lists all memory segments within the loaded binary.

### Method
GET

### Endpoint
/segments

### Response
#### Success Response (200)
- A list of strings, each representing a segment with its name, start address, and end address.

### Request Example
```bash
curl "http://localhost:8080/segments"
```

### Response Example
```
.text: 0x140001000 - 0x140050000
.data: 0x140051000 - 0x140052000
```
```

--------------------------------

### GET /strings

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of strings found within the analyzed binary, with optional filtering capabilities.

```APIDOC
## GET /strings

### Description
Retrieves a list of strings found within the analyzed binary, with optional filtering capabilities.

### Method
GET

### Endpoint
/strings
```

--------------------------------

### Command-Line: SSE Transport Custom Host and Port

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Example of configuring SSE transport to bind to all network interfaces on a custom port (9000) and connect to a remote Ghidra server.

```bash
python bridge_mcp_ghidra.py \
  --transport sse \
  --mcp-host 0.0.0.0 \
  --mcp-port 9000 \
  --ghidra-server http://192.168.1.100:8080/
# Binds to all interfaces on port 9000
# Connects to remote Ghidra server
```

--------------------------------

### Get Current Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Gets the address currently selected in the Ghidra GUI. Requires the Ghidra GUI to be active.

```python
def get_current_address() -> str:
```

--------------------------------

### Initialize FastMCP Instance

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Creates an instance of FastMCP to implement the MCP server protocol. Configuration for logging level, host, and port can be set on this instance.

```python
mcp = FastMCP("ghidra-mcp")
```

--------------------------------

### Get Cross-References For Function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/04-java-plugin-api.md

Finds all references to a specified function's entry point. It returns references including the source address, function name, and type, with pagination. Use this to understand how a function is called or referenced throughout the program.

```java
private String getFunctionXrefs(String functionName, int offset, int limit)
```

--------------------------------

### Get Function by Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Retrieves function information, including name, signature, and body range, at a specific memory address.

```python
def get_function_by_address(address: str) -> str:
```

--------------------------------

### Get Current GUI Function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Gets the function information for the currently selected function in the Ghidra GUI. Returns function name and signature.

```HTTP
GET /get_current_function
```

--------------------------------

### Address-Based Analysis with MCP Tools

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Perform address-based operations such as retrieving function information, decompiling, getting cross-references, and setting comments.

```python
# Get function at address
func_info = get_function_by_address("0x140001000")

# Decompile
code = decompile_function_by_address("0x140001000")

# Get xrefs
xrefs = get_xrefs_from("0x140001000")

# Set comment
set_decompiler_comment("0x140001050", "This is important")
```

--------------------------------

### Get Function Information by Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Fetches details about a function at a specific memory address, including its name, signature, and address range.

```HTTP
GET /get_function_by_address?address=0x1400010a0
```

--------------------------------

### Import necessary modules and define constants

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Imports required Python modules and defines the default Ghidra server URL. This setup is essential for the bridge script to function.

```python
import sys
import requests
import argparse
import logging
from urllib.parse import urljoin

from mcp.server.fastmcp import FastMCP

DEFAULT_GHIDRA_SERVER = "http://127.0.0.1:8080/"
```

--------------------------------

### Configure 5ire for GhidraMCP

Source: https://github.com/lauriewired/ghidramcp/blob/main/README.md

Set up GhidraMCP within 5ire by creating a new tool configuration. Specify the tool key, name, and the command to run the bridge script.

```text
1. Tool Key: ghidra
2. Name: GhidraMCP
3. Command: python /ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py
```

--------------------------------

### Get All Function Names

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/04-java-plugin-api.md

Retrieves a paginated list of all function names from the FunctionManager. Use this to get a subset of function names based on offset and limit.

```java
private String getAllFunctionNames(int offset, int limit)
```

--------------------------------

### Get Xrefs to Address via HTTP

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Use curl to send an HTTP GET request to the GhidraMCP server to retrieve cross-references (xrefs) to a specific memory address. The address is provided as a query parameter.

```bash
# Get xrefs
curl "http://localhost:8080/xrefs_to?address=140001000"
```

--------------------------------

### get_current_address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Get the memory address that is currently selected by the user.

```APIDOC
## get_current_address

### Description
Get the address currently selected by the user.

### Parameters
None

### Returns
`str` - Current address or error message
```

--------------------------------

### Configure Cline with SSE Transport

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Launch GhidraMCP using the SSE transport for Cline UI. This command must be run before connecting Cline.

```bash
python /path/to/bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/
```

--------------------------------

### List All Functions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Retrieves a complete list of all functions in the program with their names and addresses. This endpoint does not support pagination.

```text
{name} at {address}
```

--------------------------------

### disassemble_function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Gets the assembly code for a function, including address, instruction, and comments.

```APIDOC
## GET /disassemble_function

### Description
Gets assembly code for a function as address, instruction, and comment triples.

### Method
GET

### Endpoint
/disassemble_function

### Parameters
#### Query Parameters
- **address** (str) - Required - Hex memory address of the function
```

--------------------------------

### GET /get_current_function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves information about the function currently selected in the Ghidra GUI.

```APIDOC
## GET /get_current_function

### Description
Retrieves information about the function currently selected in the Ghidra GUI.

### Method
GET

### Endpoint
/get_current_function
```

--------------------------------

### Build GhidraMCP from Source with Maven

Source: https://github.com/lauriewired/ghidramcp/blob/main/README.md

Compile the GhidraMCP project using Maven. This process packages the Ghidra plugin and its resources into a zip file.

```bash
mvn clean package assembly:single
```

--------------------------------

### GET /get_current_address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves the memory address currently selected in the Ghidra GUI.

```APIDOC
## GET /get_current_address

### Description
Retrieves the memory address currently selected in the Ghidra GUI.

### Method
GET

### Endpoint
/get_current_address
```

--------------------------------

### GET /segments

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves a list of memory segments defined in the Ghidra project.

```APIDOC
## GET /segments

### Description
Retrieves a list of memory segments defined in the Ghidra project.

### Method
GET

### Endpoint
/segments
```

--------------------------------

### Configure Claude Desktop for GhidraMCP

Source: https://github.com/lauriewired/ghidramcp/blob/main/README.md

Add GhidraMCP as an MCP server in Claude Desktop's configuration. Ensure the command and arguments correctly point to the bridge script and Ghidra server.

```json
{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "/ABSOLUTE_PATH_TO/bridge_mcp_ghidra.py",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}
```

--------------------------------

### GET /searchFunctions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Searches for functions by a given name substring (case-insensitive). Supports pagination.

```APIDOC
## GET /searchFunctions

### Description
Searches for functions by name substring.

### Method
GET

### Endpoint
/searchFunctions

### Parameters
#### Query Parameters
- **query** (string) - Required - Substring to search for (case-insensitive)
- **offset** (int) - Optional - Starting position in results (default: 0)
- **limit** (int) - Optional - Maximum results (default: 100)

### Response
#### Success Response (200)
- **Body**: Formatted as `{name} @ {address}`

#### Error Responses
- `Error: query string is required` - query parameter missing
- `No functions matching '{query}'` - No matches found
```

--------------------------------

### Main Entry Point Function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Defines the main function for the MCP server, responsible for argument parsing and server configuration.

```python
def main():
```

--------------------------------

### Initialize logger and MCP server instance

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Initializes a logger for module-level logging and creates an instance of the FastMCP server. It also sets the global Ghidra server URL.

```python
logger = logging.getLogger(__name__)
mcp = FastMCP("ghidra-mcp")
ghidra_server_url = DEFAULT_GHIDRA_SERVER
```

--------------------------------

### GET /function_xrefs

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves cross-references related to a specific function. The function identifier is not specified.

```APIDOC
## GET /function_xrefs

### Description
Retrieves cross-references related to a specific function. The function identifier is not specified.

### Method
GET

### Endpoint
/function_xrefs
```

--------------------------------

### Configure and Run MCP with SSE Transport

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Sets up logging, MCP settings (host, port, log level), and then runs the server using the Server-Sent Events (SSE) transport protocol. Connects to a specified Ghidra server.

```python
# Configure logging
logging.basicConfig(level=logging.INFO)
logging.getLogger().setLevel(logging.INFO)

# Set MCP settings
mcp.settings.log_level = "INFO"
mcp.settings.host = args.mcp_host or "127.0.0.1"
mcp.settings.port = args.mcp_port or 8081

# Log startup info
logger.info(f"Connecting to Ghidra server at {ghidra_server_url}")
logger.info(f"Starting MCP server on http://{mcp.settings.host}:{mcp.settings.port}/sse")
logger.info(f"Using transport: {args.transport}")

# Run server
mcp.run(transport="sse")
```

--------------------------------

### GET /disassemble_function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves the assembly code for a specific function. The identifier for the function is not specified.

```APIDOC
## GET /disassemble_function

### Description
Retrieves the assembly code for a specific function. The identifier for the function is not specified.

### Method
GET

### Endpoint
/disassemble_function
```

--------------------------------

### List All Functions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Lists all functions in the program without pagination. Returns a list of functions in 'name at address' format.

```python
def list_functions() -> list:
```

--------------------------------

### GET /decompile_function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves the decompiled code for a specific function. The identifier for the function is not specified.

```APIDOC
## GET /decompile_function

### Description
Retrieves the decompiled code for a specific function. The identifier for the function is not specified.

### Method
GET

### Endpoint
/decompile_function
```

--------------------------------

### List Namespaces with Pagination

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Lists all non-global namespaces in the program, supporting pagination. Use to explore the program's organizational structure.

```python
@mcp.tool()
def list_namespaces(offset: int = 0, limit: int = 100) -> list:
    return safe_get("namespaces", {"offset": offset, "limit": limit})
```

--------------------------------

### Get Xrefs To Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Retrieves a list of cross-references (xrefs) pointing to a specific memory address.

```APIDOC
## GET /xrefs_to

### Description
Retrieves a list of cross-references (xrefs) pointing to a specific memory address.

### Method
GET

### Endpoint
/xrefs_to

### Parameters
#### Query Parameters
- **address** (string) - Required - The memory address to find cross-references for.
- **limit** (integer) - Optional - The maximum number of results to return.

### Response
#### Success Response (200)
- A list of strings, each describing a cross-reference including the source address and type.

### Request Example
```bash
curl "http://localhost:8080/xrefs_to?address=140010a0&limit=5"
```

### Response Example
```
From 0x140005000 in main [UNCONDITIONAL_CALL]
From 0x140008500 in sub_1400020a0 [UNCONDITIONAL_CALL]
```
```

--------------------------------

### list_methods

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Lists all function names in the currently loaded program with pagination support. It returns a list of function names.

```APIDOC
## GET /methods?offset={offset}&limit={limit}

### Description
Lists all function names in the currently loaded program with pagination support. It returns a list of function names.

### Method
GET

### Endpoint
/methods

### Parameters
#### Query Parameters
- **offset** (int) - Optional - Starting position in result list (default: 0)
- **limit** (int) - Optional - Maximum number of functions to return (default: 100)

### Response
#### Success Response (200)
- **list[str]** - List of function names
```

--------------------------------

### get_current_function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Gets the function at the current Ghidra GUI selection. Returns function name and signature.

```APIDOC
## GET /get_current_function

### Description
Gets the function at the current Ghidra GUI selection.

### Method
GET

### Endpoint
/get_current_function

### Parameters
None
```

--------------------------------

### Set Windows API Function Prototype

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Demonstrates setting a specific Windows API function prototype for a given memory address. This helps Ghidra correctly interpret function calls and arguments.

```python
set_function_prototype("0x140001000", 
    "int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)")
```

--------------------------------

### get_current_address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Gets the address currently selected in the Ghidra GUI. Requires the Ghidra GUI to be active.

```APIDOC
## GET /get_current_address

### Description
Gets the address currently selected in the Ghidra GUI.

### Method
GET

### Endpoint
/get_current_address

### Parameters
None
```

--------------------------------

### GET /xrefs_from

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves cross-references originating FROM a specific memory address. The address parameter is not specified.

```APIDOC
## GET /xrefs_from

### Description
Retrieves cross-references originating FROM a specific memory address. The address parameter is not specified.

### Method
GET

### Endpoint
/xrefs_from
```

--------------------------------

### POST /decompile

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Initiates the decompilation process for a function. Specific input details are not provided in the source.

```APIDOC
## POST /decompile

### Description
Initiates the decompilation process for a function. Specific input details are not provided in the source.

### Method
POST

### Endpoint
/decompile
```

--------------------------------

### GET /xrefs_to

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves cross-references pointing TO a specific memory address. The address parameter is not specified.

```APIDOC
## GET /xrefs_to

### Description
Retrieves cross-references pointing TO a specific memory address. The address parameter is not specified.

### Method
GET

### Endpoint
/xrefs_to
```

--------------------------------

### GET /get_function_by_address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Retrieves information about a function using its memory address. The address parameter is not specified.

```APIDOC
## GET /get_function_by_address

### Description
Retrieves information about a function using its memory address. The address parameter is not specified.

### Method
GET

### Endpoint
/get_function_by_address
```

--------------------------------

### Run Python MCP Server with Stdio Transport

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/01-overview.md

Launches the Python MCP server using standard input/output for communication with Ghidra. Ensure the Ghidra server is accessible at the specified URL.

```bash
python bridge_mcp_ghidra.py --ghidra-server http://127.0.0.1:8080/ --transport stdio
```

--------------------------------

### GET /searchFunctions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/00-index.md

Searches for functions based on specified criteria. The exact parameters are not detailed in the source.

```APIDOC
## GET /searchFunctions

### Description
Searches for functions based on specified criteria. The exact parameters are not detailed in the source.

### Method
GET

### Endpoint
/searchFunctions
```

--------------------------------

### Retrieve Data in Batches using Pagination

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Use the offset and limit parameters in API requests to retrieve large datasets in smaller, manageable chunks. This reduces memory usage and latency.

```bash
/methods?offset=0&limit=100   # Retrieve in batches
```

--------------------------------

### Get Function Cross-References

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Retrieves all cross-references to a specific function by its name. Supports pagination with offset and limit.

```python
def get_function_xrefs(name: str, offset: int = 0, limit: int = 100) -> list:
```

--------------------------------

### List Classes with Pagination

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Lists all namespace and class names in the program, supporting pagination. Use to retrieve class and namespace lists with control over the number of results.

```python
@mcp.tool()
def list_classes(offset: int = 0, limit: int = 100) -> list:
    return safe_get("classes", {"offset": offset, "limit": limit})
```

--------------------------------

### Python Script Dependencies

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Specifies Python version and required packages for the bridge script. Install these using pip.

```python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2,<3",
#     "mcp>=1.2.0,<2",
# ]
# ///
```

--------------------------------

### list_classes

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Lists all namespace and class names in the program with pagination support. It returns a list of class/namespace names.

```APIDOC
## GET /classes?offset={offset}&limit={limit}

### Description
Lists all namespace and class names in the program with pagination support. It returns a list of class/namespace names.

### Method
GET

### Endpoint
/classes

### Parameters
#### Query Parameters
- **offset** (int) - Optional - Starting position in result list (default: 0)
- **limit** (int) - Optional - Maximum number of classes to return (default: 100)

### Response
#### Success Response (200)
- **list[str]** - List of class/namespace names
```

--------------------------------

### List Namespaces

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Lists all non-global namespaces in the program. Supports pagination with offset and limit parameters.

```python
def list_namespaces(offset: int = 0, limit: int = 100) -> list:
```

--------------------------------

### Set Standard C Function Prototype

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Illustrates setting a standard C function prototype for a memory address. This is useful for functions like 'malloc' to ensure correct type information is available.

```python
set_function_prototype("0x140005000", 
    "void* malloc(unsigned int size)")
```

--------------------------------

### Configure Claude Desktop with Stdio Transport

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Use this JSON configuration for Claude Desktop to connect to Ghidra via the default stdio transport. Ensure Python is in your system's PATH.

```json
{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "/home/user/ghidramcp/bridge_mcp_ghidra.py",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}
```

--------------------------------

### Get Current Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Retrieves the memory address currently selected by the user. Returns the address or an error message.

```python
@mcp.tool()
def get_current_address() -> str
```

```python
return "\n".join(safe_get("get_current_address"))
```

--------------------------------

### GET /get_function_by_address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/03-http-endpoints.md

Retrieves information about a function located at a specific memory address. The address is provided as a query parameter.

```APIDOC
## GET /get_function_by_address

### Description
Gets function information at a specific address. Requires the address as a query parameter.

### Method
GET

### Endpoint
/get_function_by_address

### Parameters
#### Query Parameters
- **address** (string) - Required - Hex memory address

### Response
#### Success Response (200)
- **Body**: Function information in the format `Function: {name} at {address}\nSignature: {signature}\nEntry: {entry_point}\nBody: {min_address} - {max_address}`
```

--------------------------------

### Get Current Ghidra Program

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/04-java-plugin-api.md

Retrieves the currently loaded Ghidra program. Returns null if no program is loaded.

```java
public Program getCurrentProgram()
```

--------------------------------

### Get Function Cross-References by Name

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Finds all references to a function identified by its name. Supports pagination with offset and limit parameters.

```python
@mcp.tool()
def get_function_xrefs(name: str, offset: int = 0, limit: int = 100) -> list:
    pass
```

--------------------------------

### Get Cross-References To Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Retrieves all references pointing to a specific memory address. Supports pagination with offset and limit parameters.

```python
@mcp.tool()
def get_xrefs_to(address: str, offset: int = 0, limit: int = 100) -> list:
    pass
```

--------------------------------

### List Functions

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Lists all functions present in the database. Returns a list of functions in 'name at address' format.

```python
@mcp.tool()
def list_functions() -> list
```

```python
return safe_get("list_functions")
```

--------------------------------

### Call Graph Analysis Workflow

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

This workflow explains how to understand function call relationships by listing all functions, analyzing callees recursively from entry points, and building a call graph visualization.

```text
User: "What are the main code paths through this library?"

Claude (using tools):
1. list_functions() → get all functions
2. For entry points (main, exported):
   a. get_xrefs_from(address) → find immediate callees
   b. Recursively analyze callees
   c. Build call graph visualization
```

--------------------------------

### Get Current Function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Retrieves information about the function currently selected by the user. Returns function info or an error message.

```python
@mcp.tool()
def get_current_function() -> str
```

```python
return "\n".join(safe_get("get_current_function"))
```

--------------------------------

### List Program Strings

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Lists all defined strings in the program. Supports pagination and an optional case-insensitive substring filter.

```python
def list_strings(offset: int = 0, limit: int = 2000, filter: str = None) -> list:
```

--------------------------------

### Get Function by Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/05-python-bridge-api.md

Retrieves function information using its hexadecimal memory address. Returns function info with newlines.

```python
@mcp.tool()
def get_function_by_address(address: str) -> str
```

```python
return "\n".join(safe_get("get_function_by_address", {"address": address}))
```

--------------------------------

### get_function_by_address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Gets function information at a specific memory address. Returns name, signature, entry point, and body range.

```APIDOC
## GET /get_function_by_address

### Description
Gets function information at a specific memory address.

### Method
GET

### Endpoint
/get_function_by_address

### Parameters
#### Query Parameters
- **address** (str) - Required - Hex memory address (e.g., "0x1400010a0")

### Response Example
{
  "example": "Function: main at 0x140001000\nSignature: int main(int argc, char** argv)\nEntry: 0x140001000\nBody: 0x140001000 - 0x140001500"
}
```

--------------------------------

### Get Current Function

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Retrieves the function at the current Ghidra GUI selection. Returns function info or an error message.

```python
def get_current_function() -> str:
```

--------------------------------

### Check Python Version and Execute Script

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/06-configuration.md

Verify the Python version is 3.10 or later. Explicitly use 'python3' to run the script to avoid using an older default Python version.

```bash
python3 --version   # Check version
python3 bridge_mcp_ghidra.py  # Use python3 explicitly
```

--------------------------------

### List Classes with Pagination

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Retrieves a paginated list of namespace and class names from the loaded Ghidra program. Use offset and limit parameters to control the returned range.

```python
def list_classes(offset: int = 0, limit: int = 100) -> list:
    # Returns: list[str] - List of class/namespace names
    pass
```

--------------------------------

### Iterate All Functions with Pagination

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/07-usage-examples.md

Use this pattern to retrieve all functions from the program when the total number might exceed API limits. It repeatedly fetches batches of functions until none are returned.

```python
def get_all_functions():
    all_funcs = []
    offset = 0
    limit = 100
    
    while True:
        batch = list_methods(offset=offset, limit=limit)
        if not batch:
            break
        all_funcs.extend(batch)
        offset += limit
    
    return all_funcs
```

--------------------------------

### Get Cross-References From Address

Source: https://github.com/lauriewired/ghidramcp/blob/main/_autodocs/02-mcp-tools.md

Retrieves a list of all cross-references originating from a specific memory address. Supports pagination with offset and limit parameters.

```python
def get_xrefs_from(address: str, offset: int = 0, limit: int = 100) -> list:
    # Implementation omitted
    pass
```