Binary Ninja
Binary Ninja MCP provides a plugin that exposes Binary Ninja's reverse engineering capabilities through the Model Context Protocol, enabling AI-assisted analysis by connecting Binary Ninja to LLM clients like Claude, Cline, and others. The server exposes Binary Ninja's functionality via HTTP endpoints and includes automatic configuration support for popular MCP clients, allowing users to leverage AI assistance directly within their reverse engineering workflow. It solves the problem of integrating Binary Ninja's static analysis and binary examination tools with large language models for enhanced code analysis and CTF challenge solving.
- GitHub stars
- 351
- tools
- 37
- last updated
- Mar 8, 2026
Tools
37 toolsPublic tool metadata for what this MCP can expose to an agent.
decompile_functionDecompile a specific function by name and return HLIL-like code with addresses.
Decompile a specific function by name and return HLIL-like code with addresses.
No parameter schema in public metadata yet.
get_ilGet IL for a function in hlil, mlil, or llil (SSA supported for MLIL/LLIL).
Get IL for a function in hlil, mlil, or llil (SSA supported for MLIL/LLIL).
No parameter schema in public metadata yet.
define_typesAdd type definitions from a C string type definition.
Add type definitions from a C string type definition.
No parameter schema in public metadata yet.
delete_commentDelete the comment at a specific address.
Delete the comment at a specific address.
No parameter schema in public metadata yet.
delete_function_commentDelete the comment for a function.
Delete the comment for a function.
No parameter schema in public metadata yet.
declare_c_typeCreate/update a local type from a single C declaration.
Create/update a local type from a single C declaration.
No parameter schema in public metadata yet.
format_valueConvert a value and annotate it at an address in BN (adds a comment).
Convert a value and annotate it at an address in BN (adds a comment).
No parameter schema in public metadata yet.
function_atRetrieve the name of the function the address belongs to.
Retrieve the name of the function the address belongs to.
No parameter schema in public metadata yet.
fetch_disassemblyGet the assembly representation of a function by name or address.
Get the assembly representation of a function by name or address.
No parameter schema in public metadata yet.
get_entry_pointsList entry point(s) of the loaded binary.
List entry point(s) of the loaded binary.
No parameter schema in public metadata yet.
get_binary_statusGet the current status of the loaded binary.
Get the current status of the loaded binary.
No parameter schema in public metadata yet.
get_commentGet the comment at a specific address.
Get the comment at a specific address.
No parameter schema in public metadata yet.
get_function_commentGet the comment for a function.
Get the comment for a function.
No parameter schema in public metadata yet.
get_user_defined_typeRetrieve definition of a user-defined type (struct, enumeration, typedef, union).
Retrieve definition of a user-defined type (struct, enumeration, typedef, union).
No parameter schema in public metadata yet.
get_xrefs_toGet all cross references (code and data) to an address.
Get all cross references (code and data) to an address.
No parameter schema in public metadata yet.
get_data_declReturn a C-like declaration and a hexdump for a data symbol or address.
Return a C-like declaration and a hexdump for a data symbol or address.
No parameter schema in public metadata yet.
hexdump_addressText hexdump at address. length < 0 reads exact defined size if available.
Text hexdump at address. length < 0 reads exact defined size if available.
No parameter schema in public metadata yet.
hexdump_dataHexdump by data symbol name or address. length < 0 reads exact defined size if available.
Hexdump by data symbol name or address. length < 0 reads exact defined size if available.
No parameter schema in public metadata yet.
get_xrefs_to_enumGet usages related to an enum (matches member constants in code).
Get usages related to an enum (matches member constants in code).
No parameter schema in public metadata yet.
get_xrefs_to_fieldGet all cross references to a named struct field.
Get all cross references to a named struct field.
No parameter schema in public metadata yet.
get_xrefs_to_structGet xrefs/usages related to a struct (members, globals, code refs).
Get xrefs/usages related to a struct (members, globals, code refs).
No parameter schema in public metadata yet.
get_xrefs_to_typeGet xrefs/usages related to a struct/type (globals, refs, HLIL matches).
Get xrefs/usages related to a struct/type (globals, refs, HLIL matches).
No parameter schema in public metadata yet.
get_xrefs_to_unionGet xrefs/usages related to a union (members, globals, code refs).
Get xrefs/usages related to a union (members, globals, code refs).
No parameter schema in public metadata yet.
get_stack_frame_varsGet stack frame variable information for a function (names, offsets, sizes, types).
Get stack frame variable information for a function (names, offsets, sizes, types).
No parameter schema in public metadata yet.
get_type_infoResolve a type and return declaration, kind, and members.
Resolve a type and return declaration, kind, and members.
No parameter schema in public metadata yet.
get_callersList callers plus call sites for one or more function identifiers.
List callers plus call sites for one or more function identifiers.
No parameter schema in public metadata yet.
get_calleesList callees plus call sites for one or more function identifiers.
List callees plus call sites for one or more function identifiers.
No parameter schema in public metadata yet.
make_function_atCreate a function at an address. platform optional; use default to pick the BinaryView/platform default.
Create a function at an address. platform optional; use default to pick the BinaryView/platform default.
No parameter schema in public metadata yet.
list_platformsList all available platform names.
List all available platform names.
No parameter schema in public metadata yet.
list_binariesList managed/open binaries with ids and active flag.
List managed/open binaries with ids and active flag.
No parameter schema in public metadata yet.
select_binarySelect active binary by id or filename.
Select active binary by id or filename.
No parameter schema in public metadata yet.
list_all_stringsList all strings (no pagination; aggregates all pages).
List all strings (no pagination; aggregates all pages).
No parameter schema in public metadata yet.
list_classesList all namespace/class names in the program.
List all namespace/class names in the program.
No parameter schema in public metadata yet.
list_data_itemsList defined data labels and their values.
List defined data labels and their values.
No parameter schema in public metadata yet.
list_exportsList exported functions/symbols.
List exported functions/symbols.
No parameter schema in public metadata yet.
list_importsList imported symbols in the program.
List imported symbols in the program.
No parameter schema in public metadata yet.
list_local_typesList local Types in the current database (name/kind/decl).
List local Types in the current database (name/kind/decl).
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
Binary Ninja MCP
This repository contains a Binary Ninja plugin, MCP server, and bridge that enables seamless integration of Binary Ninja's capabilities with your favorite LLM client.
Binary Ninja MCP Logo
Features
- Seamless, real-time integration between Binary Ninja and MCP clients
- Enhanced reverse engineering workflow with AI assistance
- Support for every MCP client (Cline, Claude desktop, Roo Code, etc.)
- Open multiple binaries and switch the active target automatically
Examples
Solving a CTF Challenge
Check out this demo video on YouTube that uses the extension to solve a CTF challenge.
Components
This repository contains two separate components:
- A Binary Ninja plugin that provides an MCP server that exposes Binary Ninja's capabilities through HTTP endpoints. This can be used with any client that implements the MCP protocol.
- A separate MCP bridge component that connects your favorite MCP client to the Binary Ninja MCP server.
Prerequisites
- Binary Ninja
- Python 3.12+
- MCP client (those with auto-setup support are listed below)
Details
- Repository
- github.com/fosdickio/binary_ninja_mcp
- Categories
- AI & LLM Tools, Reverse Engineering
Related AI & LLM Tools MCP servers
View all
interactivettommyth/interactive-mcpVibe coding should have human in the loop! interactive-mcp: Local, cross-platform MCP server for interact with your AI Agent345stars
MemoryMeshchemiguel23/memorymeshA knowledge graph server that uses the Model Context Protocol (MCP) to provide structured memory persistence for AI models.342stars
showtimefaviovazquez/showtimeLocal video studio for your coding agent: scenes, voice, music and captions, on your machine.321stars
ComfyUIjoenorton/comfyui-mcp-serverA lightweight Python-based MCP server that interfaces with a local ComfyUI instance to generate images via AI agent requests.313stars
Guaardvarkguaardvark/guaardvarkLocal AI studio on your GPU: images, video, music, voice, RAG. Needs the Guaardvark app installed.300stars
Google Surf Mcpharimxchoi/google-surf-mcpWeb, academic and code search with graph RAG, data lineage, ontology and cross-project schema links.291stars