Binary Ninja

This repository contains a Binary Ninja plugin, MCP server, and bridge that enables seamless integration of Binary Ninja's capabilities with your favorite LLM client.

- Seamless, real-time integration between Binary Ninja and MCP clients
- Enhanced reverse engineering workflow with AI assistance
- Support for every MCP client (Cline, Claude desktop, Roo Code, etc.)
- Open multiple binaries and switch the active target automatically

Check outthis demo video on YouTubethat uses the extension to solve a CTF challenge.

- Binary Ninja
- Python 3.12+
- MCP client (those with auto-setup support are listed below)

1. Cline (recommended) 2. Roo Code 3. Claude Desktop (recommended) 4. Cursor 5. Windsurf 6. Claude Code 7. LM Studio

To manually install the extension, this repository can be copied into theBinary Ninja plugins folder.

[Optional] Manual Setup of the MCP Client

You do NOT need to set this up manually if you use a supported MCP client and follow the installation steps before.

You can also manage MCP client entries from the command line:

python scripts/mcp_client_installer.py --install # auto setup supported MCP clients python scripts/mcp_client_installer.py --uninstall # remove entries and delete .mcp_auto_setup_done python scripts/mcp_client_installer.py --config # print a generic JSON config snippet

The recommended way to set up the MCP client is using the official npm package:

For MCP clients, use this configuration:

{ "mcpServers": { "binary-ninja-mcp": { "command": "npx", "args": ["-y", "binary-ninja-mcp", "--host", "localhost", "--port", "9009"] } } }

{ "mcpServers": { "binary-ninja-mcp": { "command": "binary-ninja-mcp", "args": ["--host", "localhost", "--port", "9009"] } } }

For other MCP clients, use the Python bridge directly:

{ "mcpServers": { "binary_ninja_mcp": { "command": "/ABSOLUTE/PATH/TO/Binary Ninja/plugins/repositories/community/plugins/fosdickio_binary_ninja_mcp/.venv/bin/python", "args": [ "/ABSOLUTE/PATH/TO/Binary Ninja/plugins/repositories/community/plugins/fosdickio_binary_ninja_mcp/bridge/binja_mcp_bridge.py" ] } } }

Note: Replace/ABSOLUTE/PATH/TOwith the actual absolute path to your project directory. The virtual environment's Python interpreter must be used to access the installed dependencies.
- Open Binary Ninja and load a binary
- Click the button shown at left bottom corner
- Start using it through your MCP client

You may now start prompting LLMs about the currently open binary (or binaries). Example prompts:

You're the best CTF player in the world. Please solve this reversing CTF challenge in the <folder_name> folder using Binary Ninja. Rename ALL the function and the variables during your analyzation process (except for main function) so I can better read the code. Write a python solve script if you need. Also, if you need to create struct or anything, please go ahead. Reverse the code like a human reverser so that I can read the decompiled code that analyzed by you.

Your task is to analyze an unknown file which is currently open in Binary Ninja. You can use the existing MCP server called "binary_ninja_mcp" to interact with the Binary Ninja instance and retrieve information, using the tools made available by this server. In general use the following strategy: - Start from the entry point of the code - If this function call others, make sure to follow through the calls and analyze these functions as well to understand their context - If more details are necessary, disassemble or decompile the function and add comments with your findings - Inspect the decompilation and add comments with your findings to important areas of code - Add a comment to each function with a brief summary of what it does - Rename variables and function parameters to more sensible names - Change the variable and argument types if necessary (especially pointer and array types) - Change function names to be more descriptive, using mcp_ as prefix. - NEVER convert number bases yourself. Use the convert_number MCP tool if needed! - When you finish your analysis, report how long the analysis took - At the end, create a report with your findings. - Based only on these findings, make an assessment on whether the file is malicious or not.

The following table lists the available MCP functions for use:

These are the list of HTTP endpoints that can be called:

- /allStrings: All strings in one response.
- /formatValue?address=<addr>&text=<value>&size=<n>: Convert and set a comment at an address.
- /getXrefsTo?address=<addr>: Xrefs to address (code+data).
- /getDataDecl?name=<symbol>|address=<addr>&length=<n>: JSON with declaration-style string and a hexdump for a data symbol or address. Keys:address,name,size,type,decl,hexdump.length < 0reads exact defined size if available.
- /hexdump?address=<addr>&length=<n>: Text hexdump aligned at address;length < 0reads exact defined size if available.
- /hexdumpByName?name=<symbol>&length=<n>: Text hexdump by symbol name. Recognizes BN auto-labels likedata_<hex>,byte_<hex>,word_<hex>,dword_<hex>,qword_<hex>,off_<hex>,unk_<hex>, and plain hex addresses.
- /makeFunctionAt?address=<addr>&platform=<name|default>: Create a function at an address (idempotent if already exists).platform=defaultuses the BinaryView/platform default.
- /platforms: List all available platform names.
- /binariesor/views: List managed/open binaries with ids and active flag.
- /selectBinary?view=<id|filename>: Select active binary for subsequent operations.
- /data?offset=<n>&limit=<m>&length=<n>: Defined data items with previews.lengthcontrols bytes read per item (capped at defined size). Default behavior reads exact defined size when available;length=-1forces exact-size.
- /getXrefsToEnum?name=<enum>: Enum usages by matching member constants.
- /getXrefsToField?struct=<name>&field=<name>: Xrefs to struct field.
- /getXrefsToType?name=<type>: Xrefs/usages related to a struct/type name.
- /getTypeInfo?name=<type>: Resolve a type and return declaration and details.
- /getXrefsToUnion?name=<union>: Union xrefs/usages (members, globals, refs).
- /getStackFrameVars?name=<function>|address=<addr>: Get stack frame variable information for a function.
- /getCallers?identifiers=<name|addr>[,...]: Return caller summaries (functions, call sites, HLIL/IL snippets) for one or more identifiers. Acceptsidentifiers,identifier,names, oraddressesquery params.
- /getCallees?identifiers=<name|addr>[,...]: Return callee summaries with the same schema as/getCallers, detailing every outgoing call target per request identifier.
- /localTypes?offset=<n>&limit=<m>: List local types.
- /strings?offset=<n>&limit=<m>: Paginated strings.
- /strings/filter?offset=<n>&limit=<m>&filter=<substr>: Filtered strings.
- /searchTypes?query=<substr>&offset=<n>&limit=<m>: Search local types by substring.
- /patchor/patchBytes?address=<addr>&data=<hex>&save_to_file=<bool>: Patch raw bytes at an address (byte-level, not assembly). Can patch entire instructions by providing their bytecode. Address: hex (e.g., "0x401000") or decimal. Data: hex string (e.g., "90 90").save_to_file(default True) saves to disk and re-signs on macOS.
- /renameVariables: Batch rename locals in a function. Parameters:

- Function: one offunctionAddress,address,function,functionName, orname.
- Provide renames via one of:

- renames: JSON array of{old, new}objects
- mapping: JSON object ofold->new
- pairs: compact stringold1:new1,old2:new2Returns per-item results plus totals. Order is respected; later pairs can refer to earlier new names.

This project usesRufffor linting and formatting. Configuration is inruff.toml.

MCP Server that exposes Creatify AI API capabilities for AI video generation, including avatar videos, URL-to-video conversion, text-to-speech, and AI-powered editing tools.