mcp-to-http protocol translation for reverse engineering operations
Translates Model Context Protocol (MCP) JSON-RPC requests from LLM clients into HTTP GET/POST calls targeting a local Binary Ninja plugin HTTP server on port 9009. Uses FastMCP framework to expose 64 reverse engineering tools as standardized MCP tool definitions, enabling seamless integration between LLM clients (Claude Desktop, Cline, Cursor, etc.) and Binary Ninja's analysis engine without requiring direct Binary Ninja API knowledge from the LLM.
Unique: Implements a three-tier architecture (LLM Client → MCP Bridge → HTTP Server → Binary Ninja Plugin) that decouples the MCP protocol layer from Binary Ninja's native API, allowing multiple MCP clients to connect to a single Binary Ninja instance without client-specific modifications. Uses FastMCP's tool registry pattern to dynamically expose Binary Ninja capabilities as standardized MCP tools.
vs alternatives: Provides native MCP support for Binary Ninja whereas alternatives require custom REST API wrappers or direct Binary Ninja Python API calls, making it the only standardized bridge for MCP-compatible LLM clients.
function-level binary code analysis and metadata extraction
Exposes Binary Ninja's function analysis capabilities through HTTP endpoints that retrieve detailed metadata about functions in loaded binaries, including function names, type signatures, parameter types, return types, and internal control flow information. The BinaryOperations layer queries Binary Ninja's internal function objects and type system to construct structured JSON responses containing function-level analysis without requiring the LLM to understand Binary Ninja's Python API.
Unique: Leverages Binary Ninja's internal function objects and type inference engine to provide structured function metadata through HTTP endpoints, avoiding the need for LLMs to parse disassembly or understand calling conventions. The BinaryOperations layer abstracts Binary Ninja's Python API complexity into simple JSON responses.
vs alternatives: Provides richer function metadata than IDA Pro's REST API and requires no manual type annotation, as Binary Ninja's type inference is performed automatically during binary analysis.
plugin extensibility and custom tool registration
Provides a plugin architecture that allows developers to extend the Binary Ninja MCP bridge with custom tools and analysis capabilities. Developers can register new HTTP endpoints in the BinaryNinjaEndpoints class and expose them as MCP tools through the bridge, enabling custom reverse engineering workflows without modifying the core bridge code. The architecture supports adding new tools by implementing simple HTTP endpoint handlers that follow the existing pattern.
Unique: Implements a simple plugin architecture where developers can register custom HTTP endpoints that are automatically exposed as MCP tools, without requiring knowledge of the MCP protocol. The BinaryNinjaEndpoints class acts as a registry that maps HTTP routes to Binary Ninja operations.
vs alternatives: Provides easier extensibility than building custom MCP servers from scratch because it abstracts the MCP protocol layer and provides a simple HTTP endpoint registration pattern.
cross-reference tracking and data flow analysis
Exposes Binary Ninja's cross-reference (xref) tracking system through HTTP endpoints that identify all locations where a function, variable, or memory address is referenced within a binary. Queries Binary Ninja's internal xref graph to return caller/callee relationships, data references, and control flow dependencies, enabling LLMs to understand data flow and function call chains without manual graph traversal.
Unique: Wraps Binary Ninja's internal xref graph in HTTP endpoints that return structured JSON, allowing LLMs to reason about function call chains and data dependencies without understanding Binary Ninja's graph query API. Supports bidirectional xref queries (callers and callees) through a single abstraction layer.
vs alternatives: Provides more accurate xref tracking than Ghidra's REST API because Binary Ninja's analysis engine is more aggressive in identifying indirect calls and data references through type-aware analysis.
interactive function renaming and type annotation through llm suggestions
Enables LLMs to suggest and apply function renames and type annotations to a loaded binary through HTTP POST endpoints that modify Binary Ninja's internal function objects. The BinaryOperations layer validates rename requests and applies changes to the binary's symbol table, allowing LLMs to improve binary readability by assigning meaningful names based on code analysis without requiring manual Binary Ninja UI interaction.
Unique: Implements bidirectional communication where LLMs can not only read function metadata but also write changes back to the binary through HTTP POST endpoints, creating an interactive feedback loop. Validates all rename requests against C identifier rules before applying to prevent corrupting the binary's symbol table.
vs alternatives: Unlike read-only reverse engineering tools, this capability enables LLMs to actively improve binary analysis quality through iterative renaming and annotation, creating a collaborative human-AI workflow.
memory and data inspection with type-aware interpretation
Provides HTTP endpoints to inspect memory contents and data structures at specific addresses in a loaded binary, with type-aware interpretation using Binary Ninja's type system. Queries memory regions, interprets raw bytes according to inferred or user-defined types, and returns structured representations of data structures, enabling LLMs to understand data layout and contents without manual hex dump parsing.
Unique: Combines Binary Ninja's type system with memory inspection to provide type-aware data interpretation, automatically converting raw bytes to structured representations based on inferred types. Abstracts the complexity of manual type casting and struct layout calculation.
vs alternatives: Provides more intelligent data interpretation than raw hex dump tools because it leverages Binary Ninja's type inference to automatically structure untyped memory regions.
disassembly retrieval and instruction-level code analysis
Exposes HTTP endpoints to retrieve disassembled code for functions or address ranges, returning instruction-level details including mnemonics, operands, and metadata. The BinaryOperations layer queries Binary Ninja's IL (Intermediate Language) and disassembly representations to provide both high-level and low-level code views, enabling LLMs to analyze instruction sequences and understand control flow without requiring manual disassembly parsing.
Unique: Provides multiple levels of code abstraction (LLIL, MLIL, HLIL) through a single HTTP endpoint, allowing LLMs to choose between low-level instruction details and high-level pseudocode representations. Includes IL metadata that captures Binary Ninja's semantic analysis of instructions.
vs alternatives: Offers richer code representations than IDA Pro's REST API by exposing multiple IL levels, enabling LLMs to reason about code at different abstraction levels without requiring separate disassembly tools.
binary file management and multi-binary session handling
Provides HTTP endpoints to load, unload, and manage multiple binary files within a single Binary Ninja instance, enabling LLMs to switch between binaries or analyze related binaries in a single session. The plugin maintains a registry of loaded binaries and routes requests to the appropriate binary context, allowing complex analysis workflows that involve multiple executable files or libraries.
Unique: Implements a binary registry pattern that allows multiple binaries to be loaded and managed within a single Binary Ninja instance, with automatic context switching based on HTTP request parameters. Enables complex multi-binary workflows without requiring separate Binary Ninja instances.
vs alternatives: Provides better multi-binary support than standalone Binary Ninja because it abstracts binary switching through HTTP endpoints, allowing LLMs to seamlessly analyze multiple files without UI interaction.
+3 more capabilities