Pyghidra Lite

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/johnzfitch-pyghidra-lite

About

Use cases: debugging, security-scanning

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

5 read · 1 write · 1 delete · 2 not yet classified

Secrets

None asked for

Install scripts

None found

Runs as

Python package

Tools (9)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• annotate

  Persist an analysis finding back into the binary: rename a function, set a comment, or apply a corrected prototype. **This is the only tool that writes.** Writes are opt-in and human-supervised: - The server must be started with `--allow-write`; otherwise every call is refused (the default posture is strictly read-only). - Each change requires interactive confirmation: the server elicits a yes/no from you (the human) showing the exact old -> new before it commits. If your client can't show that prompt, the call returns a preview with applied=false and writes nothing (fail…

• binaries

  Show everything pyghidra-lite knows about: binaries loaded in memory, analyses currently running, queued jobs, and completed projects on disk from previous sessions. Use this to: - Find the exact binary name or unit_id needed by other tools. - Check whether a binary is already analyzed (avoid redundant load calls). - Monitor progress of large async analyses (pass jobs=True). - Find the best source binary for version tracking (pass rank_sources=True to sort by transferable named function count). Binaries listed as "on_disk" or "evicted" auto-load into memory the first time any too…

• code

  Read code from a binary. This is the core analysis tool - use it to understand what a function does. Default mode (what="decompile") returns pseudo-C source code for a function, along with its callers, callees, and referenced strings - all in one call. No need to make separate xrefs or search calls after decompiling. Pass a single function name or hex address (e.g., "main" or "0x4011a0") as target. Pass a list of names/addresses for batch decompilation - more efficient than repeated single calls. The what parameter selects output format: - "decompile" (default): pseudo-C with full contex…

• deleteDelete Binarycan change or delete data

  Permanently remove a binary, its on-disk Ghidra project, and any running analysis worker. Use this to free disk space, clean up failed analyses, or remove binaries you no longer need. Accepts a binary name, unit_id, or partial name match. For ambiguous matches, use the exact unit_id from binaries(). Args: name: Binary name or unit_id.

• functions

  List, search, or filter functions in a binary. This is the primary navigation tool for understanding what code exists and finding targets to decompile. The type parameter selects which view of the binary's symbols to show: - "all" (default): every function, sorted by name. Returns compact {name, addr} pairs. Filter with query= for substring matching. Start here when exploring an unfamiliar binary after running info(detail="full"). - "swift": Swift functions with demangled human-readable names, kind classification (function/initializer/getter/setter/witness), and addresses. …

• info

  Get a binary overview, from a quick summary to a full first-contact triage. **Call this right after load() to orient on an unfamiliar binary before diving into code or search.** The detail parameter controls how much work info does: - "summary" (default): format, arch, bits, endianness, function/symbol counts, and detected capabilities (swift/objc/elf/macho/hermes). Fast, minimal tokens. Use this when you just need to confirm what you're working with. - "full": complete triage in one call. Returns everything from summary plus: top functions ranked by reference count (likely …

• loadLoad Binary

  Load a binary into pyghidra-lite for reverse engineering. This is always the first tool to call - no other tool works until a binary is loaded. Small binaries (<10MB) block until analysis finishes and return full results. Large binaries (>=10MB) return immediately with a unit_id; poll progress with binaries(jobs=True). If you load a path that was previously analyzed, it returns from cache instantly with status="ready". To throw away a stale or wrong-profile analysis and start clean, pass fresh=True. Profile selection matters: - "fast" (default): skips 20 slow Ghidra analyzers. Good enough…

• search

  Find strings, byte patterns, symbols, or search everything at once. This is the primary discovery tool for finding interesting targets to investigate with code() or xrefs(). Default (type="strings", mode="indexed") searches Ghidra's defined string list - fast and returns xref information (which functions reference each string). Use this first. If expected strings are missing, switch to mode="deep" which scans raw memory for ASCII runs that Ghidra hasn't classified as strings yet - slower but finds strings in lightly-analyzed sections. For batch efficiency, pass a list of queries (up to 20) t…

• xrefs

  Trace references through a binary - find who calls a function, what a function depends on, or build a call graph. This tool answers navigation questions: - "Who calls malloc?" -> xrefs(binary, "malloc") - default direction="to" - "What does main call?" -> xrefs(binary, "main", direction="from") - "Show me the call tree around this function" -> xrefs(binary, "parse_input", depth=3) - "What changed between these two versions?" -> xrefs(binary_a, binary_b, diff=True) The behavior changes based on parameters: direction="to" (default): returns a list of references TO the target - eve…

Compare and alternatives

Featured in

• Best MCP servers for reverse engineering

Signals

Stars

36

Forks

2

Open issues

0

Contributors

3

Weekly downloads

99

Last commit

Oct 10, 2026 (18 days ago)

Last release

Oct 10, 2026 (18 days ago)

Last package publish

Oct 10, 2026 (18 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.johnzfitch/pyghidra-lite

Version

0.9.1

Auth

No auth

Packages

pypi pyghidra-lite

License

MIT

Repository

github.com/johnzfitch/pyghidra-lite

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql