MCP server · Audited from source

Ghidra MCP server

by lauriewired/ghidramcpApache-2.0 licenceAudited 20 Sep 2026 · source cbd110b08263

sse★ 10,129

!CAUTIONGrade B · 89/100 · 20 Sep 2026 · cbd110b

10,129GitHub stars

Is it safe? With care — CAUTION, grade B (89/100). It exposes 27 tools: 19 read, 8 write and 0 destructive. The audit recorded 5 findings (0 critical, 0 high, 2 medium, 3 low). Maintainer's description: MCP Server for Ghidra

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Ghidra MCP server (lauriewired/ghidramcp)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/lauriewired/ghidra-1

2 MCP servers are called Ghidra. This is the one we pick. Compare all 2 →

lauriewired/ghidramcp★ 10,129!CAUTION
bethington/ghidra-mcp★ 3,948!CAUTION

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score89/100!CAUTION B

0 critical0 high2 medium3 low0 info

5 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkDeclared4 observations
ShellNone observedNothing seen in the source
DependenciesPinnedNothing floats
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS
`L1` Static source	Secrets, path traversal, supply chain	WARN 4 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner lauriewiredUser accountAccount type recorded when we read the repository.
PackageNo packageRuns from a repository checkout or a hosted URL.
LicenceApache-2.0From the repository, as read at the audited commit.
Last push15 months agoActivity of the repository when we read it.
Source commit readcbd110b08263The audit covers exactly this commit, read on 20 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory27 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (5)

Sorted by severity

MEDIUMNetwork egressnet.raw_ip · bridge_mcp_ghidra.py:17

F-04 Network egressCWE-200 · CWE-319Layer L1

DEFAULT_GHIDRA_SERVER = "http://127.0.0.1:8080/"

Why: No further detail recorded for this rule.
Fix: —

MEDIUMAuth / authzmcp.remote_no_auth

F-10 Auth / authzCWE-287 · CWE-862Layer L3

sse

Why: a network transport with no auth environment variable found
Fix: require a token

LOWNetwork egressnet.raw_ip · README.md:64

F-04 Network egressCWE-200 · CWE-319Layer L1

"http://127.0.0.1:8080/"

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:82

F-04 Network egressCWE-200 · CWE-319Layer L1

python bridge_mcp_ghidra.py --transport sse --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:92

F-04 Network egressCWE-200 · CWE-319Layer L1

2. Server URL: `http://127.0.0.1:8081/sse`

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

27 declared in source · 0 destructive

19 read8 write0 destructive

Tool	Risk	What it does
`rename_data`	write	No description in the source
`rename_function`	write	No description in the source
`rename_function_by_address`	write	No description in the source
`rename_variable`	write	No description in the source
`set_decompiler_comment`	write	No description in the source
`set_disassembly_comment`	write	No description in the source
`set_function_prototype`	write	No description in the source
`set_local_variable_type`	write	No description in the source
`decompile_function`	read	No description in the source
`decompile_function_by_address`	read	No description in the source
`disassemble_function`	read	No description in the source
`get_current_address`	read	No description in the source
`get_current_function`	read	No description in the source
`get_function_by_address`	read	No description in the source
`get_function_xrefs`	read	No description in the source
`get_xrefs_from`	read	No description in the source
`get_xrefs_to`	read	No description in the source
`list_classes`	read	No description in the source
`list_data_items`	read	No description in the source
`list_exports`	read	No description in the source
`list_functions`	read	No description in the source
`list_imports`	read	No description in the source
`list_methods`	read	No description in the source
`list_namespaces`	read	No description in the source
`list_segments`	read	No description in the source
`list_strings`	read	No description in the source
`search_functions_by_name`	read	No description in the source

Install

audited commit cbd110b

Read the findings first. The most severe is Network egress (medium) at bridge_mcp_ghidra.py.

No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.

Audit history

2026-09-20
!CAUTION B 89 / 100
Source changed, verdict held · cbd110b08263

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/lauriewired/ghidra-1/badge.svg)](https://modelsatlas.com/mcp/lauriewired/ghidra-1/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Ghidra MCP server

What is the Ghidra MCP server?

MCP Server for Ghidra

What tools does Ghidra expose?

27 in total: 19 read-only, 8 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Ghidra safe to connect to an agent?

With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Ghidra need?

No credential environment variables were found in its source, so it appears to need none.

How does Ghidra run?

It speaks sse, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (cbd110b08263), read on 2026-09-20. The repository is watched and re-audited when it changes.

Which Ghidra MCP server is the right one?

lauriewired/ghidramcp (this page). 2 servers share the name; see the side-by-side comparison.

Sources

lauriewired/ghidramcp on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit cbd110b08263Observed · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Ghidra MCP server?
GChatGPT CClaude PPerplexity
What tools does Ghidra expose?
GChatGPT CClaude PPerplexity
Is Ghidra safe to connect to an agent?
GChatGPT CClaude PPerplexity