Comment by Retr0id
8 hours ago
You don't even need an MCP, I just let the agent write scripts for headless ghidra. The MCPs are fragile and there isn't a whole lot of knowledge about how to use them in the training datasets, whereas there are plenty of ghidra scripts (and proper docs for the APIs).
I agree! Don't give it away!
Seriously, though, the popular Ghidra MCP is really badly architected; it's way better to rearchitect it or just script Ghidra directly. With that said, Opus 5.5 seems to have been trained on CoT from the popular Ghidra MCP. This makes it work better, but also makes it even more inefficient if you modify the MCP without changing its name and shape significantly (it will try to make tool calls using the "mainline" format, then have to retry them when they fail).
Even with Opus 5.5, IMO it's better to just ditch the MCP and let the LLMs eat with bintools and headless Ghidra; with both GLM and Opus this produces significantly more efficient results than the popular MCP. On the other hand the IDA Pro MCP is much better architected and seems to be pretty good.
I will note that Opus 4.8 and below was unable to use the MCP very well, misused it really often even with instructing. Good to see that they have improved some things.
Will opus 5.5 even reverse engineer binaries? I get instant blocks when it sees word like decompile etc..
Reversed an old video game pretty extensively for me. Got it running in 30 minutes, then patched some bugs, reversed the entire game logic VM and rendering pipeline, and we're now in process of expressing game logic as Lisp and upscaling assets for rendered that it already made to operate at 4x its hardcoded resolution...
Starting point was literally original installer copied over from a CD, which I hold on to and dug up from an old hard drive, plus a short prompt asking to make it work. Installing Ghirda and developing a whole framework for patching the binary, as well as substituting DirectDraw with its own DLL shim, was Claude's own invention.
It depends on what you're reversing. It tends not to like DRM-shaped things or security-sensitive things (for a very vague definition of "security-sensitive"), but e.g. game engines are fine. (For the things it doesn't like, dropping down to Opus 4.8 or 4.6 usually works)
Works fine for me. I didn't explicitly say decompile but it had no issue digging into executables to give me information on how it and various file formats were designed.
if you include a SKILL.md for the MCP (or just dump it into the prompt) it's not a problem.
I don't use Ghidra but IDA Pro MCP works extremely well for me for all manner of tasks. for example, some software likes to call home for license checking (and I wish to run it with networking denied to it). it no longer does.
Sure, you can do that, but in my experience it's usually best to let agents do the things they already know how to do.
The IDA Pro MCP is substantially better than the most popular Ghidra MCP, for what it's worth.