x64dbgMCP acts as a powerful bridge that connects artificial intelligence with the intricate world of software debugging. In simple terms, it allows developers and security researchers to talk to their debugger using everyday language instead of memorizing complex manual commands. By integrating with the Model Context Protocol (MCP), it enables AI assistants like Claude to directly observe and interact with a running program, making the process of finding bugs or analyzing code as easy as asking a question. Under the hood, this tool provides access to over 40 different SDK functions, covering nearly every feature available in the x64dbg and x32dbg environments. It allows an AI to perform sophisticated tasks such as setting hardware breakpoints, inspecting specific memory addresses, and monitoring register values in real-time. Because it supports both 32-bit and 64-bit architectures, it is a versatile choice for a wide range of reverse engineering and software forensic projects. For developers looking to automate their workflows, x64dbgMCP offers deep integration via a Python-based API that can be triggered directly from the command line. This setup enables longer, more complex tool chains and allows the AI to autonomously manage binary execution—such as automatically restarting a process if it crashes during analysis. By providing the LLM with the full context of a target executable, users can unlock high-level automated analysis where the AI handles the heavy lifting of pattern searching and step-through debugging without constant manual intervention.
1. Installation Using Pre-built Binaries: 1. Download the plugin file (.dp64 or .dp32) from the repository's build/release directory. 2. Copy the file to your local x64dbg plugin directory: [x64dbg_dir]/release/x64/plugins/. 3. Copy the x64dbgmcp.py file from the repository's src directory to a local folder. Building from Source: 1. Clone the repository: git clone [repository-url] 2. Navigate to the directory: cd x64dbgmcp 3. Generate build files: cmake -S . -B build 4. Build the plugins: cmake --build build --target all_plugins --config Release * Note: Use -A Win32 -DBUILD_BOTH_ARCHES=OFF for specific 32-bit builds.
2. Configuration To configure the server for Claude Desktop, update your claude_desktop_config.json file with the following entry (adjusting the paths to point to your Python executable and the x64dbgmcp.py script): json { "mcpServers": { "x64dbg": { "command": "Path\\To\\Python", "args": [ "Path\\to\\x64dbgmcp.py" ] } } }Setup Requirements: * Launch x64dbg before starting Claude Desktop. * If connection issues occur, check the logs tab in x64dbg (ALT+L) to verify the port the plugin is running on and pass it as an argument to the Python script.
3. Available Tools The server provides access to 40+ x64dbg SDK tools, enabling features such as: * Debugging Control: Natural language control over debugging functions and stepping through instructions. * Memory Management: Reading specific bytes from memory addresses. * Register Inspection: Checking the current values of registers (RAX, RIP, etc.). * Pattern Searching: Finding specific byte patterns within current modules. * Automated Analysis (CMDEXEC): Using the init function with the absolute path to an EXE to allow the model to restart the binary if it crashes. * Cross-Architecture Support: Compatible with both x32dbg and x64dbg.
4. Example Prompts * "Set a breakpoint at the main function and step through the first few instructions" * "Read 100 bytes from address 0x401000 and show me what's there" * "What's the current value of RAX and RIP registers?" * "Find the pattern '48 8B 05' in the current module" * "init C:\Absolute\Path\to\EXE" (To provide context for automated analysis and restarts)
What you can do with x64dbgMCP
Use Case 1: Automated Malware Unpacking and Entry Point Discovery Problem: Malware is often packed or obfuscated, making it difficult for researchers to find the Original Entry Point (OEP). Manually stepping through decryption loops and setting breakpoints on memory allocation APIs is time-consuming and requires deep technical expertise. Solution: This MCP allows a researcher to use natural language to direct the AI to monitor system calls and memory changes. The AI can manage the tedious process of "break-and-step" until the unpacking routine completes. Example: "Monitor for calls to VirtualProtect and VirtualAlloc. Once a new memory segment is allocated and marked as executable, set a breakpoint at the start of that segment and let me know when it's hit so we can find the OEP."
Use Case 2: Root Cause Analysis of Application Crashes Problem: When an application crashes during development or testing, identifying why a specific register became corrupted or why a stack overflow occurred requires careful inspection of the machine state at the moment of failure. Solution: By connecting Claude to x64dbg, the developer can ask the AI to analyze the crash state immediately. The AI can inspect registers, the stack, and memory to hypothesize the cause of the exception. Example: "The program just hit an Access Violation. Check the values of RAX and RBX. Is RAX pointing to a null or unallocated memory address? Read 32 bytes from the top of the stack and tell me if the return address looks like it was overwritten by user input."
Use Case 3: Reverse Engineering Undocumented Proprietary Functions Problem: Developers often need to interface with or replicate functionality from legacy binaries that lack source code. Understanding how a specific function transforms input data into output requires repetitive tracing. Solution: The MCP enables a "conversation" with the binary. The user can instruct the AI to set up test cases by modifying register values and observing the function's behavior in real-time. Example: "Set a breakpoint at the start of the function at 0x401500. When hit, change the RCX register to 0x1, step over the function, and tell me the value of RAX. Then restart the process, set RCX to 0x2, and compare the results."
Use Case 4: Vulnerability Research and Pattern Scanning Problem: Security auditors often look for "gadgets" or specific instruction sequences (like `pop
pop/ret`) to build exploits or verify security mitigations. Manual hex searching across large modules…