Pyghidra Lite
Run token-efficient Ghidra reverse-engineering steps from your agent—decompile, cross-references, Swift/ObjC, ELF/Mach-O—without flooding the context window.
Overview
pyghidra-lite is a Ship-phase MCP server that provides token-efficient Ghidra reverse engineering (decompile, xrefs, Swift/ObjC, ELF/Mach-O, async analysis) to coding agents.
What is this MCP server?
- Token-efficient Ghidra MCP tools: decompile, xrefs, Swift/ObjC, ELF/Mach-O
- Async analysis support for long-running Ghidra jobs
- Python stdio server (pyghidra-lite v0.7.0 on PyPI) with GHIDRA_INSTALL_DIR env
- Self-hosted RE bridge for Claude Code and similar MCP clients
- Package version 0.7.0 on PyPI identifier pyghidra-lite
- Requires environment variable GHIDRA_INSTALL_DIR
- Repository: github.com/johnzfitch/pyghidra-lite
Community signal: 33 GitHub stars.
What problem does it solve?
Feeding raw Ghidra output into an agent burns tokens and slows RE loops, while manual GUI-only workflows do not compose with Claude or Cursor.
Who is it for?
Indie security researchers and mobile developers auditing Mach-O/ELF binaries with Ghidra already installed.
Skip if: Beginners with no Ghidra setup or anyone who only needs source-level linting without binary analysis.
What do I get? / Deliverables
After configuration, your agent can request focused decompilation and xref data from Ghidra through MCP with less context bloat.
- Agent-callable Ghidra decompile and xref tools
- Async analysis hooks for longer Ghidra jobs
Recommended MCP Servers
Journey fit
Binary analysis and vulnerability hunting sit in ship when you harden releases, audit dependencies, or investigate suspicious artifacts before launch. Security subphase fits because Ghidra workflows are about understanding untrusted binaries and attack surface, not everyday feature coding.
How it compares
MCP wrapper around Ghidra RE, not a standalone decompiler skill or cloud sandbox.
Common Questions / FAQ
Who is pyghidra-lite for?
It is for builders and researchers who use Ghidra locally and want MCP agents to drive decompilation, xrefs, and format-specific analysis efficiently.
When should I use pyghidra-lite?
Use it in ship-phase security reviews when you have binaries to analyze and need iterative agent-guided Ghidra workflows.
How do I add pyghidra-lite to my agent?
Install Ghidra, set GHIDRA_INSTALL_DIR to your install path, add the PyPI pyghidra-lite (v0.7.0) stdio MCP server in your client config, then invoke tools from your agent session.