# x64dbg

Connects an AI assistant to the x64dbg debugger. Use it to trace execution and inspect memory without manual scripting.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 135
- Author: bromoket
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/bromoket/x64dbg_mcp
- Updated: 2026-06-08
- HTML: https://affpapa.org/en/nevibecode/mcp/x64dbg

## What it does

The setup operates in two layers. A C++ plugin runs inside the debugger, hosting a local REST service on `127.0.0.1`. On the client side, a lightweight TypeScript process communicates via stdio and forwards assistant actions to that port. Network traffic stays on localhost.

The model interacts with 23 debugger tools. It inspects CPU registers, disassembles instructions, and configures memory breakpoints. The server also handles dumping PE modules to disk with IAT repairs and hiding the session from anti-debug checks.

The debugger must be running with the `.dp64` or `.dp32` binary placed inside its `plugins` folder. The bridge fails immediately if the target debugger instance is not open.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `X64DBG_MCP_HOST`, `X64DBG_MCP_PORT` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env X64DBG_MCP_HOST=<X64DBG_MCP_HOST> --env X64DBG_MCP_PORT=<X64DBG_MCP_PORT> --transport stdio x64dbg -- npx -y x64dbg-mcp-server
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add x64dbg --env X64DBG_MCP_HOST=<X64DBG_MCP_HOST> --env X64DBG_MCP_PORT=<X64DBG_MCP_PORT> -- npx -y x64dbg-mcp-server
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "x64dbg": {
            "command": "npx",
            "args": [
                "-y",
                "x64dbg-mcp-server"
            ],
            "env": {
                "X64DBG_MCP_HOST": "<X64DBG_MCP_HOST>",
                "X64DBG_MCP_PORT": "<X64DBG_MCP_PORT>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "x64dbg": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "x64dbg-mcp-server"
            ],
            "env": {
                "X64DBG_MCP_HOST": "<X64DBG_MCP_HOST>",
                "X64DBG_MCP_PORT": "<X64DBG_MCP_PORT>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e X64DBG_MCP_HOST=<X64DBG_MCP_HOST> -e X64DBG_MCP_PORT=<X64DBG_MCP_PORT> x64dbg npx -y x64dbg-mcp-server
```
Replace <…> with your own values

## When to use it
- set software and hardware breakpoints during execution
- disassemble functions and inspect basic block graphs
- scan memory for byte patterns and decoded strings
- dump PE modules to disk and rebuild import address tables
- hide debugger presence from anti-debug checks

## Example prompts
- Set a breakpoint on `CreateFileW` and resume execution.
- Scan the main module for byte sequence `48 8B ?? 48 85 C0` and show disassembled instructions.
- Dump the main module to disk and rebuild its import table.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md