pyghidra-lite — Claude Code MCP server: reverse-engineer binaries
Ghidra inside your agent: decompile, trace calls and turn addresses into file offsets. Handy when you need to read an unfamiliar ELF, Mach-O or PE binary.
claude mcp add --env GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> --transport stdio pyghidra-lite -- uvx pyghidra-liteWhat pyghidra-lite does
The server keeps Ghidra running behind the scenes and hands the agent tools for decompiling, disassembling and resolving addresses. Binaries come in as ELF, Mach-O or PE, with Swift, Objective-C and Hermes code covered. Answers stay cheap on context because it returns the fragments you ask for instead of dumping whole listings.
Read-only is the default. Analysis leaves your binaries alone and the server's own configuration is locked for the life of the process. Only annotate writes anything (renames, comments, prototypes); it needs --allow-write, and every edit waits for your approval through an MCP confirmation prompt. A client that cannot ask gets a refusal instead.
An extracted JDK 21 plus Ghidra 11.x or 12.x has to be in place first. The server locates Homebrew installs, /opt/ghidra and ~/ghidra on its own; for anything else, set GHIDRA_INSTALL_DIR. Run pyghidra-lite doctor to check the decompiler and project directory before you start. The Claude plugin launches through uvx, so uv must be on PATH. An existing manual pyghidra-lite entry in .mcp.json or ~/.claude.json should go, or all tools show up twice.
What it helps with
- map the entry point of an unknown ELF binary
- decompile a function from a Swift macOS app
- match a debugger address to an offset in the file
- follow where an argument value travels
- label functions and structs so the agent keeps findings across sessions
Example prompts for the agent
- Analyze the binary at
/path/to/binaries/app: load it and list its functions. - Decompile the function at
0x1a2b3cand explain what it does. - Rename this function to
parse_configand add a comment about its arguments.
How to install pyghidra-lite
Platform CLI
claude mcp add --env GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> --transport stdio pyghidra-lite -- uvx pyghidra-liteReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>
Platform CLI
codex mcp add pyghidra-lite --env GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> -- uvx pyghidra-liteReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>
Config file
{
"mcpServers": {
"pyghidra-lite": {
"command": "uvx",
"args": [
"pyghidra-lite"
],
"env": {
"GHIDRA_INSTALL_DIR": "<GHIDRA_INSTALL_DIR>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>
Config file
{
"servers": {
"pyghidra-lite": {
"type": "stdio",
"command": "uvx",
"args": [
"pyghidra-lite"
],
"env": {
"GHIDRA_INSTALL_DIR": "<GHIDRA_INSTALL_DIR>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>
Platform CLI
gemini mcp add -e GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> pyghidra-lite uvx pyghidra-liteReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about pyghidra-lite
How do I install pyghidra-lite in Claude Code?
Run claude mcp add pyghidra-lite -- uvx pyghidra-lite. If Ghidra sits outside the usual locations, pass the path: claude mcp add --env GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> --transport stdio pyghidra-lite -- uvx pyghidra-lite.
What does pyghidra-lite do?
It exposes Ghidra tooling to the agent: decompilation, disassembly, call tracing and address-to-file-offset mapping for ELF, Mach-O and PE binaries. Writing is limited to the opt-in annotate tool, which you confirm each time.
What has to be installed for it to work?
JDK 21 and Ghidra 11.x or 12.x, with GHIDRA_INSTALL_DIR set when Ghidra is not found automatically. pyghidra-lite doctor reports the state of the environment.
