Another™ MCP Server for Binary Ninja

English | 中文

Demo

The tests/binary/beleaf.elf is taken from CSAW'19: Beleaf - Nightmare. You can also find the complete writeup from the link above!

... but why Another?

See: Key Differences from the Existing Plugin

Installation

Server Setup

There are two ways to run the MCP server:

1. Binary Ninja UI Plugin:

   • Install the plugin via Binary Ninja's plugin manager
   • The MCP server will start automatically when first file is loaded.
     • Auto start is configurable via Settings - MCP Server - Auto Start
     • Listen port is configurable via Settings - MCP Server - Server port number
   • All opened files are exposed to separate resources, see Available Resources section below

2. Binary Ninja Headless Mode:

   uvx binaryninja-mcp install-api  # only run once
   uvx binaryninja-mcp server <filename> [filename]...
   

   • filename could be any binary files or BNDB, like in UI mode, all opened files are available to the MCP client.
   • Server runs on default port 7000
   • Use --port flag to specify a different port

MCP Client Setup

1. Claude Desktop (stdio relay client): Configure the client to connect via stdio transport using built-in relay.

   {
     "mcpServers": {
       "binaryninja": {
         "command": "uvx",
         "args": ["binaryninja-mcp", "client"]
       }
     }
   }
   

2. Cherry Studio:

   • SSE endpoint (recommanded): URL: http://localhost:7000/sse
   • stdio client:
     • Command: uvx
     • Arguments:

       binaryninja-mcp
       client
       

Add --port 12345 to both server and client command line if you prefer to run MCP server on port other than default.

Available Tools for MCP Clients

The MCP server provides the following tools:

• rename_symbol: Rename a function or a data variable
• pseudo_c: Get pseudo C code of a specified function
• pseudo_rust: Get pseudo Rust code of a specified function
• high_level_il: Get high level IL of a specified function
• medium_level_il: Get medium level IL of a specified function
• disassembly: Get disassembly of a function or specified range
• update_analysis_and_wait: Update analysis for the binary and wait for completion
• get_triage_summary: Get basic information from BinaryNinja Triage view
• get_imports: Get dictionary of imported symbols
• get_exports: Get dictionary of exported symbols
• get_segments: Get list of memory segments
• get_sections: Get list of binary sections
• get_strings: Get list of strings found in the binary
• get_functions: Get list of functions
• get_data_variables: Get list of data variables

Available Resources for MCP Clients

MCP Resources can be accessed via URIs in the format: binaryninja://{filename}/{resource_type}

The server provides these resource

... View full README on GitHub