# pyghidra-lite

Ghidra inside your agent: decompile, trace calls and turn addresses into file offsets. Handy when you need to read an unfamiliar ELF, Mach-O or PE binary.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 36
- Author: johnzfitch
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/johnzfitch/pyghidra-lite
- Updated: 2026-10-10
- HTML: https://affpapa.org/en/nevibecode/mcp/pyghidra-lite

## What it does

The server keeps Ghidra running behind the scenes and hands the agent tools for decompiling, disassembling and resolving addresses. Binaries come in as ELF, Mach-O or PE, with Swift, Objective-C and Hermes code covered. Answers stay cheap on context because it returns the fragments you ask for instead of dumping whole listings.

Read-only is the default. Analysis leaves your binaries alone and the server's own configuration is locked for the life of the process. Only `annotate` writes anything (renames, comments, prototypes); it needs `--allow-write`, and every edit waits for your approval through an MCP confirmation prompt. A client that cannot ask gets a refusal instead.

An extracted JDK 21 plus Ghidra 11.x or 12.x has to be in place first. The server locates Homebrew installs, `/opt/ghidra` and `~/ghidra` on its own; for anything else, set `GHIDRA_INSTALL_DIR`. Run `pyghidra-lite doctor` to check the decompiler and project directory before you start. The Claude plugin launches through `uvx`, so `uv` must be on `PATH`. An existing manual `pyghidra-lite` entry in `.mcp.json` or `~/.claude.json` should go, or all tools show up twice.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `GHIDRA_INSTALL_DIR` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> --transport stdio pyghidra-lite -- uvx pyghidra-lite
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>

### Codex

**Platform CLI**
```bash
codex mcp add pyghidra-lite --env GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> -- uvx pyghidra-lite
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "pyghidra-lite": {
            "command": "uvx",
            "args": [
                "pyghidra-lite"
            ],
            "env": {
                "GHIDRA_INSTALL_DIR": "<GHIDRA_INSTALL_DIR>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "pyghidra-lite": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "pyghidra-lite"
            ],
            "env": {
                "GHIDRA_INSTALL_DIR": "<GHIDRA_INSTALL_DIR>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e GHIDRA_INSTALL_DIR=<GHIDRA_INSTALL_DIR> pyghidra-lite uvx pyghidra-lite
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from pyghidra-lite <command>

## When to use it
- map the entry point of an unknown ELF binary
- decompile a function from a Swift macOS app
- match a debugger address to an offset in the file
- follow where an argument value travels
- label functions and structs so the agent keeps findings across sessions

## Example prompts
- Analyze the binary at `/path/to/binaries/app`: load it and list its functions.
- Decompile the function at `0x1a2b3c` and explain what it does.
- Rename this function to `parse_config` and add a comment about its arguments.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md