Ghidra MCP by bethington

Findings (1)

• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (8)

• list_instances

  List known Ghidra instances from UDS discovery and the active TCP fallback. Returns JSON with each instance's project name, PID, open programs, and socket path or TCP URL. Also shows which instance is currently connected.

• connect_instance

  Switch the MCP bridge to a different Ghidra instance by project name. IMPORTANT: Before calling this function only the static bridge tools are exposed (list_instances, connect_instance, tool-group management, debugger proxy). After a successful connect the bridge fetches the in

• list_tool_groups

  List all available tool groups with their tool counts and loaded status. Returns each category with: tool count, loaded status, and tool names. Use load_tool_group(group) to load a group's tools.

• load_tool_group

  Load all tools in a category. Accepts a category name or "all" to load everything. Use list_tool_groups() to see available categories. Args: group: Category name (e.g. "function", "datatype") or "all"

• unload_tool_group

  Unload all tools in a category. Default groups are protected from unloading. Args: group: Category name to unload

• check_tools

  Check if specific tools are callable right now. Returns status for each tool: "callable", "not_loaded" (exists but group not loaded), or "not_found" (doesn't exist). Args: tools: Comma-separated tool names, e.g. "rename_symbol,batch_set_comments,analyze_function_completeness"

• search_tools

  Search the full Ghidra tool catalog by keyword — including tools whose group is not currently loaded. Use this to discover the right tool without paying the context cost of loading all groups (run the bridge with --lazy and search on demand). Matches against tool name, description,

• import_file

  Import a binary file from disk into the current Ghidra project. Imports the file, opens it in the CodeBrowser, and optionally starts auto-analysis. When analysis is enabled, sends a log notification when analysis completes. For raw firmware binaries, specify language (e.g. "ARM:LE