x64dbgMCP

x64dbgMCP acts as a powerful bridge that connects artificial intelligence with the intricate world of software debugging. In simple terms, it allows developers and security researchers to talk to their debugger using everyday language instead of memorizing complex manual commands. By integrating with the Model Context Protocol (MCP), it enables AI assistants like Claude to directly observe and interact with a running program, making the process of finding bugs or analyzing code as easy as asking a question. Under the hood, this tool provides access to over 40 different SDK functions, covering nearly every feature available in the x64dbg and x32dbg environments. It allows an AI to perform sophisticated tasks such as setting hardware breakpoints, inspecting specific memory addresses, and monitoring register values in real-time. Because it supports both 32-bit and 64-bit architectures, it is a versatile choice for a wide range of reverse engineering and software forensic projects. For developers looking to automate their workflows, x64dbgMCP offers deep integration via a Python-based API that can be triggered directly from the command line. This setup enables longer, more complex tool chains and allows the AI to autonomously manage binary execution—such as automatically restarting a process if it crashes during analysis. By providing the LLM with the full context of a target executable, users can unlock high-level automated analysis where the AI handles the heavy lifting of pattern searching and step-through debugging without constant manual intervention.

Category: Developer Tools & Code Intelligence

Tags: binary analysis, debugging, forensics, reverse engineering, x64dbg

Visit x64dbgMCP

How to install and configure x64dbgMCP

1. Installation Using Pre-built Binaries: 1. Download the plugin file (.dp64 or .dp32) from the repository's build/release directory. 2. Copy the file to your local x64dbg plugin directory: [x64dbg_dir]/release/x64/plugins/. 3. Copy the x64dbgmcp.py file from the repository's src directory to a local folder. Building from Source: 1. Clone the repository: git clone [repository-url] 2. Navigate to the directory: cd x64dbgmcp 3. Generate build files: cmake -S . -B build 4. Build the plugins: cmake --build build --target all_plugins --config Release * Note: Use -A Win32 -DBUILD_BOTH_ARCHES=OFF for specific 32-bit builds.

2. Configuration To configure the server for Claude Desktop, update your claude_desktop_config.json file with the following entry (adjusting the paths to point to your Python executable and the x64dbgmcp.py script): json { "mcpServers": { "x64dbg": { "command": "Path\\To\\Python", "args": [ "Path\\to\\x64dbgmcp.py" ] } } } Setup Requirements: * Launch x64dbg before starting Claude Desktop. * If connection issues occur, check the logs tab in x64dbg (ALT+L) to verify the port the plugin is running on and pass it as an argument to the Python script.

3. Available Tools The server provides access to 40+ x64dbg SDK tools, enabling features such as: * Debugging Control: Natural language control over debugging functions and stepping through instructions. * Memory Management: Reading specific bytes from memory addresses. * Register Inspection: Checking the current values of registers (RAX, RIP, etc.). * Pattern Searching: Finding specific byte patterns within current modules. * Automated Analysis (CMDEXEC): Using the init function with the absolute path to an EXE to allow the model to restart the binary if it crashes. * Cross-Architecture Support: Compatible with both x32dbg and x64dbg.

4. Example Prompts * "Set a breakpoint at the main function and step through the first few instructions" * "Read 100 bytes from address 0x401000 and show me what's there" * "What's the current value of RAX and RIP registers?" * "Find the pattern '48 8B 05' in the current module" * "init C:\Absolute\Path\to\EXE" (To provide context for automated analysis and restarts)

What you can do with x64dbgMCP

Use Case 1: Automated Malware Unpacking and Entry Point Discovery Problem: Malware is often packed or obfuscated, making it difficult for researchers to find the Original Entry Point (OEP). Manually stepping through decryption loops and setting breakpoints on memory allocation APIs is time-consuming and requires deep technical expertise. Solution: This MCP allows a researcher to use natural language to direct the AI to monitor system calls and memory changes. The AI can manage the tedious process of "break-and-step" until the unpacking routine completes. Example: "Monitor for calls to VirtualProtect and VirtualAlloc. Once a new memory segment is allocated and marked as executable, set a breakpoint at the start of that segment and let me know when it's hit so we can find the OEP."

Use Case 2: Root Cause Analysis of Application Crashes Problem: When an application crashes during development or testing, identifying why a specific register became corrupted or why a stack overflow occurred requires careful inspection of the machine state at the moment of failure. Solution: By connecting Claude to x64dbg, the developer can ask the AI to analyze the crash state immediately. The AI can inspect registers, the stack, and memory to hypothesize the cause of the exception. Example: "The program just hit an Access Violation. Check the values of RAX and RBX. Is RAX pointing to a null or unallocated memory address? Read 32 bytes from the top of the stack and tell me if the return address looks like it was overwritten by user input."

Use Case 3: Reverse Engineering Undocumented Proprietary Functions Problem: Developers often need to interface with or replicate functionality from legacy binaries that lack source code. Understanding how a specific function transforms input data into output requires repetitive tracing. Solution: The MCP enables a "conversation" with the binary. The user can instruct the AI to set up test cases by modifying register values and observing the function's behavior in real-time. Example: "Set a breakpoint at the start of the function at 0x401500. When hit, change the RCX register to 0x1, step over the function, and tell me the value of RAX. Then restart the process, set RCX to 0x2, and compare the results."

Use Case 4: Vulnerability Research and Pattern Scanning Problem: Security auditors often look for "gadgets" or specific instruction sequences (like `pop

pop/ret`) to build exploits or verify security mitigations. Manual hex searching across large modules…

Key facts

  • Open Source
  • https://github.com/Wasdubya/x64dbgMCP
  • Developer Tools & Code Intelligence, Security & Compliance
  • binary analysis, debugging, forensics, reverse engineering, x64dbg

Part of MCP Servers

Related MCP servers

  • MCP LaTeX Server — MCP LaTeX Server is an MCP server that provides tools for creating, editing, validating, and compiling LaTeX documents directly through…
  • MCP JSON — MCP JSON is an MCP server collection that bundles tools for file system operations, Google search, browser-based web automation, and…
  • MCP Jupyter Complete — MCP Jupyter Complete is an MCP server that provides tools for manipulating Jupyter notebook files through position-based cell operations and…
  • MCP LSP Go — MCP LSP Go is an MCP server that connects AI assistants to the official Go Language Server Protocol implementation, gopls,…
  • MCP Manager — MCP Manager is an MCP server management tool that connects directly to your Claude Desktop environment, enabling users to discover,…
  • MCP Lab — MCP Lab is an MCP server development environment designed for building, testing, and debugging custom Model Context Protocol servers integrated…

What is x64dbgMCP?

x64dbgMCP is an open-source Model Context Protocol server that bridges artificial intelligence clients to the x64dbg debugger. It exposes over 40 debugger SDK tools, enabling language models to inspect registers, read memory, execute pattern searches, and control process stepping using natural language prompts.

Which MCP clients work with x64dbgMCP?

The server has been tested and verified to work with Claude Desktop and Cursor. Any AI client or development environment supporting the Model Context Protocol over standard input and output can communicate with the Python bridge script to control x64dbg.

Does x64dbgMCP support 32-bit and 64-bit binaries?

Yes, x64dbgMCP provides cross-architecture support for both x64dbg and x32dbg. You can deploy the pre-built .dp64 plugin for 64-bit targets or the .dp32 plugin for 32-bit targets into their corresponding plugin folders, or compile both architectures from source using CMake.

How do I install x64dbgMCP?

Place the compiled plugin file into your x64dbg plugins directory, install the required Python packages mcp and requests, and copy the Python script to your machine. Then, register the script inside your Claude Desktop configuration file and launch x64dbg before opening your AI client.

Is x64dbgMCP open source?

Yes, x64dbgMCP is open-source software hosted publicly on GitHub. Developers and security researchers can inspect the source code, build the C++ plugin and Python scripts locally using CMake and MSVC, and contribute improvements directly to the project repository.

  • AI Tools
  • Categories
  • Industries
  • CLI Coding Agents
  • MCP Servers
  • MCP Categories