GhidraMCP vs jshookmcp
GhidraMCP: GhidraMCP is a Model Context Protocol (MCP) server that enables Large Language Models (LLMs) to perform autonomous reverse engineering of applications. It exposes Ghidra's core functionalities to various MCP clients, facilitating automated binary analysis and renaming.; jshookmcp: jshook is an MCP server that gives AI agents a front-end and binary reverse-engineering workspace: 735 tools across 36 domains for hooking pages, capturing network traffic, deobfuscating bundles, disassembling WASM and instrumenting processes. A search-first profile loads only about 3K tokens of tool metadata so agents are not flooded with schemas.
TL;DR
- You use the free, open-source NSA Ghidra reverse engineering suite and want to give Claude or Cursor direct access to decompilation, functions, and symbols via MCP.
- You need an open-source, non-commercial binary analysis pipeline that works out of the box without proprietary licenses.
- Your workflow standardizes on IDA Pro with Hex-Rays decompilers; ida-pro-mcp is the dedicated bridge for IDA Pro.
- You do not perform binary reverse engineering or disassembly.
Letting an agent analyse and deobfuscate a web app's JavaScript and network protocol
Side-by-Side Comparison
GhidraMCPjshookmcpFeatures
GhidraMCPjshookmcpUse Cases
GhidraMCPjshookmcpBest For
GhidraMCPjshookmcpFAQ
Deploy on DigitalOcean
Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.