{"name":"io.github.getanirao/ghidra-bizhawk-mcp","slug":"getanirao-ghidra-bizhawk-mcp","title":"Ghidra BizHawk MCP","description":"Unified Ghidra + BizHawk MCP server for static analysis, P-code emulation, and retro ROM triage.","url":"https://mcp.market/server/getanirao-ghidra-bizhawk-mcp","rating":null,"grade":"A","score":92,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":21,"stars":1,"forks":0,"downloads_week":null,"last_push_at":"2026-10-16T04:42:46.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/getanirao/ghidra-bizhawk-mcp","website":"https://github.com/getanirao/ghidra-bizhawk-mcp","version":"1.1.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"ghidra-bizhawk-mcp","version":"1.1.0","transport":{"type":"stdio"},"environmentVariables":[{"description":"Absolute path to the Ghidra installation directory","isRequired":true,"format":"string","name":"GHIDRA_INSTALL_DIR"},{"description":"Optional path to EmuHawk.exe for live emulation features","format":"string","name":"BIZHAWK_EXE_PATH"},{"description":"Set to 1 for zero-dependency CI simulation","format":"string","default":"0","name":"MOCK_MODE"}]}],"tools":[{"name":"bizhawk_buttons","description":"Set joypad button state for a player. Accepts an object like {A: true, B: true, Up: true, Start: true, Select: true}. State persists until changed or cleared. Use bizhawk_tap_buttons for a single atomic press/hold/release sequence.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_connect","description":"Check connectivity to BizHawk by pinging the bridge.lua script running inside EmuHawk. Use first before any other bizhawk.* tool to verify the emulator is responsive.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_frame","description":"Advance the emulator by N frames. Use to step through execution frame by frame. If you need to apply input and release it atomically, prefer bizhawk_tap_buttons.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_info","description":"Get ROM name, ROM hash, current framecount, available memory domains, and capabilities from the connected BizHawk instance.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_input_state","description":"Read the current joypad state for a player. Returns the active button table as reported by BizHawk, which is useful for verifying that input was applied correctly.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_launch","description":"Launch the BizHawk emulator process and establish the Lua bridge connection. Optionally specify a ROM path to load. Call this first before any other bizhawk.* tool if the emulator is not already running.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_load_state","description":"Load emulator state from a previously saved savestate file. Restores all CPU registers, memory, and hardware state exactly. Use with bizhawk.save_state for reproducible testing.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_memory_domains","description":"List available memory domains for the currently loaded emulation core (e.g. WRAM, RAM, EWRAM, VRAM, System Bus). Use before bizhawk.read to determine valid domain names.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_pause","description":"Pause BizHawk emulation. Use before reading memory or inspecting state to prevent the emulated system from changing values between operations.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_read","description":"Read bytes from BizHawk emulated memory at a given address. Returns an array of byte values. Use bizhawk.memory_domains first to discover valid domain names for the loaded game.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_reset","description":"Reset the loaded emulation core (reboot the emulated console). All emulated memory and CPU state is lost. Use to restart a game or boot a different ROM path.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_save_state","description":"Save the current emulator state to a file. The savestate captures all CPU registers, memory, and hardware state for later reload. Use with bizhawk.load_state for checkpoint-based testing workflows.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_screenshot","description":"Save a PNG screenshot of the current emulator display to a file path. Useful for capturing in-game state, error screens, or UI elements during automated testing.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_tap_buttons","description":"Atomically press a set of buttons for a fixed number of frames, then release them. Use for timed inputs such as a one-frame tap or a short hold.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_unpause","description":"Unpause BizHawk emulation after a previous pause call. The emulated system resumes normal execution.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bizhawk_write","description":"Write bytes to BizHawk emulated memory at a given address. Use to patch game state, inject values, or modify emulated hardware registers in real time.","write_action":true,"price_micros":0,"input_schema":null},{"name":"ghidra_analyze","description":"Import and analyze a binary into a named Ghidra session. Creates or replaces a session. Returns session_id, platform info, and function count. Call this first before any other Ghidra analysis tool.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_apply_signatures","description":"Scan the current binary, match every function by structural fingerprint against a previously exported signature map, and rename matches automatically. Use after loading a new binary version to restore meaningful names.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_call_graph","description":"Get the call graph for a function — shows which functions it calls (callees) and which functions call it (callers). Use after ghidra.decompile to understand function relationships.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_comment","description":"Attach a comment to a code unit at a given address. Supports comment types: plate, pre, post, eol, repeatable. Use to document reverse-engineering findings inline.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_create_struct","description":"Create a custom structured data type from a JSON member layout. Each member specifies offset (optional), field name, and type string. Use to model protocol headers, packet formats, and data structures.","write_action":true,"price_micros":0,"input_schema":null},{"name":"ghidra_cross_references","description":"Get cross-references to and from a given address. Shows what references the address and what the address references. Useful for understanding how data or code is used across the binary.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_data_types","description":"List all data types defined in the loaded program, including structures, enums, and typedefs. Useful for understanding the program's type landscape before creating new types.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_decompile","description":"Decompile a function by name or hex address. Returns decompiled C code. Use after session.analyze has loaded a binary.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_decompile_entrypoints","description":"Composite tool that bulk-decompiles all entry points in one call — program entry, exports, main, _start, etc. Use early in analysis to get an overview of the binary's surface area.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_decompile_paginated","description":"Decompile a function with line range, token budget, and optional summarization to prevent context-window exhaustion on large functions. Use for functions over 50 lines.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_diff","description":"Compare two loaded sessions by function name and body size. Returns functions unique to each side and functions that changed between versions. Use for patch diffing and version comparison.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_disassemble","description":"Disassemble N raw instructions at an address. Returns mnemonic, operands, hex bytes, and length for each instruction. Use for precise lower-level inspection when decompiled C is insufficient.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_emulate","description":"Headlessly execute a slice of instructions using Ghidra's P-code emulator. Seed initial register values and track value propagation across execution steps. No debugger, GDB stub, or network needed. Works on any Ghidra-supported architecture (ARM, x86, MIPS, etc.)","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_emulate_breakpoints","description":"Execute instructions until a break condition is met or the instruction count expires. Supports equality (R0==0), inequality (R1>0xFF), not-equal (R2!=R3), and PC address (PC==0x1234). Stops before or after the matching instruction. Ideal for finding copy-loop bounds, null-pointer paths, or switch-table targets.","write_action":true,"price_micros":0,"input_schema":null},{"name":"ghidra_emulate_taint","description":"Execute an instruction slice with automatic taint tracking. Specify a taint register; the tool reports every step where its value is modified or propagates to other registers. Use to trace data flows through cryptographic routines or input processing.","write_action":true,"price_micros":0,"input_schema":null},{"name":"ghidra_export_signatures","description":"Export a complete {structural_hash -> function_name} signature map for every function in the current binary. Save the output JSON to reuse across binary versions. Call before closing a session to preserve naming for future diffing.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_fingerprint","description":"Generate a behavior-based structural hash for a function that survives compiler shuffling and optimization changes across binary versions. Use with ghidra.apply_signatures for cross-version function matching.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_listing","description":"Return a raw hex + ASCII dump for a byte range, equivalent to Ghidra's Listing panel. Complements ghidra.disassemble for inspecting data regions, strings, and padding.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_rename","description":"Rename a function or label at a given address. Changes are stored in the Ghidra project database. Use to replace auto-generated names like FUN_* with meaningful identifiers.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_report","description":"Produce a Markdown summary of the active workspace — functions, entry points, custom symbols, recovered structures, renamed functions, and comment count. Replaces a GUI CodeBrowser window. Call at the end of a session to get a human-readable overview.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_retype","description":"Change a local variable or function parameter's type annotation in the decompiled view. Use to replace generic types like undefined4* with meaningful types like MyStruct* for cleaner decompilation.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_search","description":"Search the entire loaded binary for a hex byte pattern. Returns matching addresses with context bytes and any string labels at the hit. Use to locate known constants, magic bytes, or patch locations.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_session_close","description":"Close and remove a Ghidra session workspace, freeing project resources. Cannot be undone. Use ghidra.sessions first to find active session IDs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_sessions","description":"List all active Ghidra session workspaces with their session IDs, binary paths, and load timestamps. Useful before calling ghidra.session_close or ghidra.diff.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_stash_auto_restore","description":"Zero-input auto-restore: hashes the loaded binary, looks up a previously stashed map by content hash, and renames matching functions automatically. Pair with ghidra.stash_auto_save for fully automatic cross-version name recovery.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_stash_auto_save","description":"Zero-input auto-stash: hashes the loaded binary's first 4 KB and saves a signature map under that hash. No group ID or user input needed. Just analyze and call.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_stash_list","description":"List all stashed signature groups currently in the local server cache (~/.ghidra_bizhawk_mcp/signatures/). Use before ghidra.stash_restore to see available lineage_group_ids.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_stash_restore","description":"Load a previously stashed signature map by lineage_group_id and auto-rename every matching function in the current session. Use with ghidra.stash_save for persistent cross-version function name recovery.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_stash_save","description":"Fingerprint all functions and stash the signature map server-side under a lineage_group_id label (e.g. 'my_firmware_v1'). No JSON file management needed — stored in ~/.ghidra_bizhawk_mcp/signatures/.","write_action":false,"price_micros":0,"input_schema":null},{"name":"ghidra_triage","description":"Examines raw file magic header signatures to detect retro console architectures (NES, SNES, GBA, NDS, Switch, PSX, Genesis, SMS, Dreamcast), headlessly maps correct Ghidra language loaders, hooks multi-session project bindings, and applies automated signature caching overlays. Single-call entry point for ROM analysis.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":92,"grade":"A","scanned_at":"2026-10-16T04:55:09.619Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-16T04:55:09.591Z","components":{"code":{"score":25,"max":25,"notes":["11 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"ghidra-bizhawk-mcp","version":"1.1.0","found":true,"license":"Apache-2.0","dependencyCount":2,"publishedAt":"2026-10-16T03:19:12.476192Z","repositoryUrl":"https://github.com/getanirao/ghidra-bizhawk-mcp"}],"repo":{"found":true,"owner":"getanirao","repo":"ghidra-bizhawk-mcp","archived":false,"pushedAt":"2026-10-16T04:42:46Z","stars":1,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/140450826?v=4","ownerCreatedAt":"2023-07-24T20:26:54Z","license":"Apache-2.0"},"icon":{"url":"https://avatars.githubusercontent.com/u/140450826?v=4&s=128","source":"github"},"presence":{"stars":1,"forks":0,"downloadsWeek":null,"license":"Apache-2.0","lastPushAt":"2026-10-16T04:42:46.000Z","score":21}}}},"grade_history":[],"reviews":[]}