Binary Ninja

The Binary Ninja MCP Server lets you control and query Binary Ninja from large language models. It exposes commands for retrieving function assembly, HLIL decompiled code, renaming entities, and adding comments, enabling automated analysis and editing workflows without leaving your editor or chat client.

How to use

You connect an MCP client (like Claude Desktop or Cursor) to the server and issue high-level requests such as asking for a function’s assembly, decompiled HLIL, or making edits to names or comments. Start by running the MCP server locally, then interact with it through your MCP client. The server responds with the requested Binary Ninja data and applies changes when you request edits.

Key capabilities you can rely on include: getting the assembly for a named function, retrieving the HLIL decompiled output, renaming functions or variables, and adding comments. Use these in your prompts to guide the LLM to inspect, modify, or annotate the target binary inside Binary Ninja.

How to install

Prerequisites: you need a runtime to start the MCP server (Python or uvx runtime are commonly used). You may also install a Binary Ninja MCP Server plugin if you prefer a plugin-based workflow.

Install options to run the MCP server locally:

{
  "mcpServers": {
    "binja": {
      "command": "uvx",
      "args": ["-n","mcp-server-binja"]
    }
  }
}

Alternative Python installation if you prefer a Python-based server runner:

{
  "mcpServers": {
    "binja": {
      "command": "python",
      "args": [
        "-m",
        "mcp_server_binja"
      ]
    }
  }
}

If you’re developing and want to run from source with a local path, you can use the development configuration that runs via uv pointing to the source directory and the run script:

{
  "mcpServers": {
    "binja": {
      "command": "uv",
      "args": [
        "--directory",
        "/<path to mcp-server-binja>/src",
        "run",
        "mcp-server-binja"
      ]
    }
  }
}

When you are testing with Claude Desktop or Cursor, you may also use a runtime command that runs from the local source path with uv, as shown in development snippets.

npx @modelcontextprotocol/inspector uvx binja_mcp

Configuration

Configure your MCP client to connect to the Binary Ninja MCP Server using one of the available runners. The recommended approach is to use uvx for a straightforward, local run, or pip/python if you prefer a Python-based runner.

Common runtime configurations you can copy-paste into your MCP client settings:

{
  "mcpServers": {
    "binja": {
      "command": "uvx",
      "args": ["-n","mcp-server-binja"]
    }
  }
}

{
  "mcpServers": {
    "binja": {
      "command": "python",
      "args": [
        "-m",
        "mcp_server_binja"
      ]
    }
  }
}

{
  "mcpServers": {
    "binja": {
      "command": "uv",
      "args": [
        "--directory",
        "/<path to mcp-server-binja>/src",
        "run",
        "mcp-server-binja"
      ]
    }
  }
}

Notes and troubleshooting

If you encounter issues starting the server, ensure the chosen runner has access to the necessary runtime (uvx, Python, or uv) and that the specified paths exist. Verify that the server process stays alive while your MCP client is connected, and check the client logs for any transport or JSON-RPC errors.

Available tools

binja_get_function_assembly

Fetches the assembly code for a named function in the loaded Binary Ninja project.

binja_get_function_decompiled

Fetches the HLIL decompiled code for a named function.

binja_get_global_variable

Retrieves information about a global variable from the current binary context.

binja_get_current_function_assembly

Returns the assembly for the function currently in focus or at the cursor.

binja_get_current_function_decompiled

Returns the decompiled HLIL for the function currently in focus or at the cursor.