BinAssistMCP

BinAssistMCP provides an MCP server that bridges Binary Ninja with large language models, enabling AI-assisted reverse engineering through Server-Sent Events and Streamable HTTP transports. It exposes Binary Ninja capabilities as MCP tools, resources, and prompts so you can analyze binaries, trace data flows, and generate documentation with an LLM-driven workflow.

How to use

You will run or auto-start the server from Binary Ninja, then connect your MCP client (such as an LLM interface) to the provided HTTP or SSE endpoints. Use the HTTP endpoint to stream data to and from the MCP server, or subscribe to Server-Sent Events for real-time updates. You can execute pre-built workflows, request code, or trigger analyses, with results delivered through the chosen transport.

How to install

Prerequisites you need before installation.

# Prerequisites
# Binary Ninja is required (version 4000 or higher)
# Python 3.8+ (typically bundled with Binary Ninja)

# Option 1: Binary Ninja Plugin Manager (recommended)
# 1) Open Binary Ninja
# 2) Tools → Manage Plugins
# 3) Search for BinAssistMCP
# 4) Install
# 5) Restart Binary Ninja

# Option 2: Manual installation
# 1) Clone the repository
git clone https://github.com/jtang613/BinAssistMCP.git
cd BinAssistMCP

# 2) Install dependencies
pip install -r requirements.txt

# 3) Copy to Binary Ninja plugins directory (examples; adjust per OS)
# Windows
# %APPDATA%\Binary Ninja\plugins\
# macOS
# ~/Library/Application Support/Binary Ninja/plugins/
# Linux
# ~/.binaryninja/plugins/

Configuration and startup

Configure how you want the server to run and how clients connect. You can start the server from within Binary Ninja, or rely on auto-startup when a file is loaded. The default HTTP endpoint for MCP is http://localhost:9090/mcp and the SSE endpoint is http://localhost:9090/sse.

{
  "server": {
    "host": "localhost",
    "port": 9090,
    "transport": "streamablehttp"
  },
  "binary": {
    "max_binaries": 10
  },
  "plugin": {
    "auto_startup": true
  }
}

Transport and client connection

Choose your transport based on client capabilities. Use Streamable HTTP for broad compatibility, or Server-Sent Events for real-time streaming. The MCP server exposes two endpoints you will connect to from your client software.

Examples of workflows with the MCP server

Leverage the 36 Tools, 8 Resources, and 7 Prompts to perform comprehensive analyses, vulnerability research, and protocol investigations. You can combine multiple tools in a single client request to build end-to-end analysis pipelines.

Available tools

list_binaries

List all loaded binary files within the current Binary Ninja session

get_binary_status

Check analysis status and metadata for a loaded binary

update_analysis_and_wait

Force a re-analysis of binaries and wait for completion

get_code

Unified code retrieval across formats (decompile, hlil, mlil, llil, disasm, pseudo_c)

get_function_low_level_il

Retrieve Low-Level IL for a specific function

analyze_function

Analyze a function with control flow and complexity metrics

get_basic_blocks

Obtain basic block information for a function

get_function_stack_layout

Get stack frame layout with variable offsets

xrefs_tool

Unified cross-references actions: refs_to, refs_from, call_graph

comments_tool

Unified comment management: get, set, list, remove, set_function

variables_tool

Unified variable management: list, create, rename, set_type

types_tool

Unified type management: create, create_enum, create_typedef, create_class, add_member, get_info, list

get_classes

List all classes and structures

get_functions

List all functions with metadata (paginated)

search_functions_by_name

Find functions by name pattern

get_functions_advanced

Advanced filtering by size, complexity, parameters

search_functions_advanced

Multi-target search by name, comments, calls, variables

get_function_statistics

Comprehensive statistics for all functions

rename_symbol

Rename functions and data variables

batch_rename

Rename multiple symbols in one operation

get_namespaces

List namespaces and symbol organization

get_imports

Import table grouped by module

get_exports

Export table with symbol information

get_strings

String extraction with filtering

search_strings

Search strings by pattern

get_segments

Memory segment layout

get_sections

Binary section information

get_current_address

Get current cursor position with context

get_current_function

Identify function at current address

get_task_status

Check status of async operations

list_tasks

List all pending or running tasks

cancel_task

Cancel a running task