Ghidra MCP Servers on GitHub: We Counted 138 of Them

Ghidra has no official MCP server, but on 13 November 2026 we counted 138 public community Ghidra MCP servers on GitHub, and 113 of them were created this year. A Ghidra MCP server is a Model Context Protocol server that exposes Ghidra's decompiler and program database as tools an AI agent can call: decompile a function, list cross-references, rename a variable. We ran a census of every public one we could find, with stars, last commit, tool count and transport, because the search results for "ghidra mcp" quote one project at 110, 179, 200+ and 219 tools, and none of the ranking pages says how many servers exist.

Your Ghidra MCP server has a read-only neighbour: Devirt's MCP connector registers in the same client as GhidraMCP or any server in this census. Its six tools read the status, coverage ledger and proof summary of devirtualization work you have already submitted and approved, and none of them can upload a file, start a job or pay. That is how AI reverse engineering on protected binaries stays under your control.

Is there an official Ghidra MCP server?

No. The NSA's Ghidra repository ships no MCP server. The seven issues and pull requests with "MCP" in the title that asked for one, the newest from July 2026, are all closed, and neither pull request was merged. Every Ghidra MCP server is a community project, and the most starred is LaurieWired's GhidraMCP, first released in March 2025: a Ghidra plugin plus a small Python bridge that an MCP client such as Claude Code or VS Code talks to.

The devirt.re guide to ghidra mcp servers explains what the three best-known ones do and where they fit next to IDA and Binary Ninja servers. This post counts the rest.

How the census was run

The census used the GitHub REST API on 13 November 2026. The method, so you can check it or rerun it:

1. Search: six repository searches (ghidra mcp, ghidra-mcp, ghidramcp, pyghidra mcp, topic:ghidra topic:mcp, ghidra model context protocol). GitHub returned complete results for all six. They gave 338 unique repositories; GitHub search leaves forks out by default.
2. Implementation check: a script read each repository's source at the head of its default branch and kept the 215 that contain an MCP implementation (an MCP SDK import, a tool registration or a tools/list handler).
3. Name test: 148 of those tie "Ghidra" to "MCP" in their name or description.
4. Hand review: we read the descriptions of all 148, and the README where a description was unclear. We removed 10 that aren't Ghidra MCP servers (a Blender SDK, a statistics tool, a Cutter fork) and 7 self-declared mirrors, snapshots or bundles.
5. Recall check: we also went through the 190 repositories the rules rejected and added back 7 Ghidra MCP servers they missed, such as a server written in Zig and one whose description never says "MCP". Multi-engine reverse-engineering servers that mention Ghidra only in their README stay out.
6. Result: 138 Ghidra MCP servers. 107 are dedicated servers; 31 are wider toolkits that include one.

Stars come from the search API. "Last commit" is the newest commit on the default branch, not GitHub's pushed_at, which moves when any branch changes. Tool counts and transports have their own caveats, covered in their sections. Nothing was cloned, installed or run. The first step anyone can repeat:

gh api -X GET search/repositories -f q="ghidra mcp" -f per_page=100 \
  --jq '.total_count, (.items[] | "\(.stargazers_count)\t\(.full_name)")'

How many Ghidra MCP servers are there?

The census counted 138 public Ghidra MCP servers on GitHub on 13 November 2026, and the count is climbing fast. 24 were created in 2025, 113 in 2026, and 28 in October 2026 alone, the busiest month so far. One server, cyberkaida's ReVa, is older: its repository dates from August 2023 and gained an MCP server later.

Activity is uneven. 46 of the 138 Ghidra MCP servers had a commit in the 30 days before the census, and 85 in the last 90 days, but 37 had nothing for more than 180 days. One is archived, and 35 have no licence file GitHub can detect, which matters if you plan to build on one.

Who holds the stars

GitHub stars on Ghidra MCP servers are concentrated in very few projects. LaurieWired's GhidraMCP holds 11,911 of the 23,376 stars across all 138 servers, 51% on its own. The three most-starred repositories hold 83%, the top ten hold 97%, and 71 servers have no stars at all.

These are the ten most-starred dedicated Ghidra MCP servers. Three wider toolkits outrank some of them on stars (open-reverselab, a batch-rename tool built on GhidraMCP, and RE-MCP, which drives IDA Pro as well), so they appear in the chart above but not in this table:

The repositories are bethington/ghidra-mcp, ReVa, GhidrAssistMCP and pyghidra-mcp for the four you'll meet most after LaurieWired's. Popularity and maintenance don't line up neatly. bethington's server, second on stars, had the most recent commit of the ten, while LaurieWired's had gone more than a month without one.

How many tools does a Ghidra MCP server expose?

A Ghidra MCP server exposes anywhere from a handful of tools to more than 200, so a tool count says more about a project's scope than its quality. bethington's README lists 219 MCP tools, GhidrAssistMCP lists 100 (93 enabled by default), and LaurieWired's GhidraMCP registers 30 in its current code.

The census found a cluster: 11 Ghidra MCP servers register exactly 27 tools. That's the number in LaurieWired's bridge script from its 1.3 release in April 2025 until the 2.0 release on 10 October 2026, which suggests a good share of the "new" servers started from that code without forking it on GitHub.

Two caveats on the "counted" figures. The script counts tool registrations it can recognise in source (decorators such as @mcp.tool, Java tool annotations, SDK tool objects), so servers that build their tool list at runtime show low or zero. That's why the table uses the README figure where a project states one. And a large toolset has a cost of its own: every tool definition takes up room in the agent's context, which is why bethington's server lazy-loads tools and mecha_ghidra exposes only what a task needs.

stdio, SSE or streamable HTTP: how the servers connect

Most Ghidra MCP servers talk to the MCP client over stdio. Of the 135 census servers with a README, 79 document stdio, 35 document SSE and 31 document streamable HTTP. 36 name no transport at all, so you find out from the code or the client config.

The other split is where the server runs. 47 of the 138 ship a Ghidra extension that runs inside the Ghidra GUI. 90 reference a headless path (pyghidra or Ghidra's headless analyzer) in their code or README; a headless server lets the agent work without anyone opening Ghidra. Headless suits batch work across many binaries; the GUI plugin suits sitting next to the agent and watching what it renames.

How do you pick a Ghidra MCP server?

Pick a Ghidra MCP server by maintenance and fit before tool count. With 37 of the 138 untouched for six months, the first filter does most of the work:

1. Recent commits: a commit on the default branch in the last month, and issues that get answers.
2. A transport your client supports: stdio for local desktop clients, streamable HTTP if the server runs on another machine or in Docker.
3. GUI or headless: a plugin if you want to watch the session in Ghidra, headless for scripted runs over many files.
4. Write tools you can review: many servers can rename, retype and comment. Snapshot the Ghidra project first and check the agent's changes the way you would a colleague's.
5. Then the tool list, trimmed to what the job needs.

If Ghidra itself is new to you, learn how to use Ghidra before adding an agent on top. You need to recognise a wrong rename when you see one.

What no Ghidra MCP server changes

Every Ghidra MCP server in the census reads what Ghidra's decompiler can read, no more. On a function protected by code virtualization, which developers apply to the functions they most want to protect, that's the protector's interpreter loop: a dispatcher, virtual registers and handlers. A 139th server would change the tool list, not what the agent sees. Agents stall at the same wall in AI decompiler workflows, and for the same reason.

Recovering that function is a devirtualization step, and its output should say which functions were proven, which depend on runtime data and which remain open. Devirt reports those proof states per function, and its read-only connector hands them back to the same agent. That's for binaries you own or are authorized to analyze.

The census is a snapshot, and a field that added 28 servers in a month will look different by December. We'll rerun it and update the numbers with a new date.

Written by Devirt, an automated devirtualization service for authorized analysis of protected software. Census data: GitHub REST API, 13 November 2026.