Binary NinjaCAUTION
A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This repository contains a Binary Ninja plugin, MCP server, and bridge that enables seamless integration of Binary Ninja's capabilities with your favorite LLM client.
Features
- Seamless, real-time integration between Binary Ninja and MCP clients
- Enhanced reverse engineering workflow with AI assistance
- Support for every MCP client (Cline, Claude desktop, Roo Code, etc.)
- Open multiple binaries and switch the active target automatically
Examples
Solving a CTF Challenge
Check out this demo video on YouTube that uses the extension to solve a CTF challenge.
Components
This repository contains two separate components:
- A Binary Ninja plugin that provides an MCP server that exposes Binary Ninja's capabilities through HTTP endpoints. This can be used with any client that implements the MCP protocol.
- A separate MCP bridge component that connects your favorite MCP client to the Binary Ninja MCP server.
Prerequisites
- Binary Ninja
- Python 3.12+
- MCP client (those with auto-setup support are listed below)
Installation
MCP Client
Please install the MCP client before you install Binary Ninja MCP so that the MCP clients can be auto-setup. We currently support auto-setup for these MCP clients:
- Cline (recommended)
- Roo Code
- Claude Desktop (recommended)
- Cursor
- Windsurf
- Claude Code
- LM Studio
Extension Installation
After the MCP client is installed, you can install the MCP server using the Binary Ninja Plugin Manager or manually. Both methods support auto-setup of MCP clients.
If your MCP client is not set, you should install it first then try to reinstall the extension.
Binary Ninja Plugin Manager
You may install the extension through Binary Ninja's Plugin Manager (Plugins > Manage Plugins).
![Plugin Manager](images/plugin-manager-l
c8a61b46299aOBSERVED · 2026-10-01Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add binary-ninja-mcp -- npx -y [email protected]
{
"mcpServers": {
"binary-ninja-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (56)
45 read · 9 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
convert_number | read | |
declare_c_type | read | |
decompile_function | read | |
define_types | read | |
delete_comment | destructive | |
delete_function_comment | destructive | |
fetch_disassembly | read | |
format_value | read | |
function_at | read | |
get_binary_status | read | |
get_callees | read | |
get_callers | read | |
get_comment | read | |
get_data_decl | read | |
get_entry_points | read | |
get_function_comment | read | |
get_il | read | |
get_stack_frame_vars | read | |
get_type_info | read | |
get_user_defined_type | read | |
get_xrefs_to | read | |
get_xrefs_to_enum | read | |
get_xrefs_to_field | read | |
get_xrefs_to_struct | read | |
get_xrefs_to_type | read | |
get_xrefs_to_union | read | |
hexdump_address | read | |
hexdump_data | read | |
list_all_strings | read | |
list_binaries | read | |
list_classes | read | |
list_data_items | read | |
list_exports | read | |
list_imports | read | |
list_local_types | read | |
list_methods | read | |
list_namespaces | read | |
list_platforms | read | |
list_sections | read | |
list_segments | read | |
list_strings | read | |
list_strings_filter | read | |
make_function_at | read | |
patch_bytes | write | |
rename_data | write | |
rename_function | write | |
rename_multi_variables | write | |
rename_single_variable | write | |
retype_variable | read | |
search_functions_by_name | read | |
search_types | read | |
select_binary | read | |
set_comment | write | |
set_function_comment | write | |
set_function_prototype | write | |
set_local_variable_type | write |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
return ["/opt/homebrew/bin/python3", "/usr/local/bin/python3", "/usr/bin/python3"]
return ["/usr/bin/python3", "/usr/local/bin/python3"]
"/usr/local/bin/python3",
delete_comment, delete_function_comment
chal
patch_bytes = bytes.fromhex(data_str)
@modelcontextprotocol/sdk, axios, zod, @types/node, tsx, typescript
anthropic, mcp, requests
- **50+ Tools**: Full access to Binary Ninja's reverse engineering capabilities
images/mcp-demo-rename.gif
images/mcp-demo-report.png
Gates applied: no_behavioural_pass.
c8a61b46299afull audit observations/trust-audit/mcp-server/fosdickio__binary-ninja.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-01 | c8a61b46299a | CAUTION | B | 89 | first audit |
Questions
What is the Binary Ninja MCP server?
A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.
What tools does Binary Ninja expose?
56 in total: 45 read-only, 9 that write, and 2 that can delete or overwrite (delete_comment, delete_function_comment). Every one is listed on this page with its risk.
Is Binary Ninja safe to connect to an agent?
With care. The audit graded it B (89/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Binary Ninja need?
No credential environment variables were found in its source, so it appears to need none.
How does Binary Ninja run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as binary-ninja-mcp at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (c8a61b46299a), read on 2026-10-01. The repository is watched and re-audited when it changes.