Ghidra BizHawk MCP server

Read from the package source without running it. The installed server may list more.

• bizhawk_buttons

  Set joypad button state for a player. Accepts an object like {A: true, B: true, Up: true, Start: true, Select: true}. State persists until changed or cleared. Use bizhawk_tap_buttons for a single atomic press/hold/release sequence.

• bizhawk_connect

  Check connectivity to BizHawk by pinging the bridge.lua script running inside EmuHawk. Use first before any other bizhawk.* tool to verify the emulator is responsive.

• bizhawk_frame

  Advance the emulator by N frames. Use to step through execution frame by frame. If you need to apply input and release it atomically, prefer bizhawk_tap_buttons.

• bizhawk_info

  Get ROM name, ROM hash, current framecount, available memory domains, and capabilities from the connected BizHawk instance.

• bizhawk_input_state

  Read the current joypad state for a player. Returns the active button table as reported by BizHawk, which is useful for verifying that input was applied correctly.

• bizhawk_launch

  Launch the BizHawk emulator process and establish the Lua bridge connection. Optionally specify a ROM path to load. Call this first before any other bizhawk.* tool if the emulator is not already running.

• bizhawk_load_state

  Load emulator state from a previously saved savestate file. Restores all CPU registers, memory, and hardware state exactly. Use with bizhawk.save_state for reproducible testing.

• bizhawk_memory_domains

  List available memory domains for the currently loaded emulation core (e.g. WRAM, RAM, EWRAM, VRAM, System Bus). Use before bizhawk.read to determine valid domain names.

• bizhawk_pause

  Pause BizHawk emulation. Use before reading memory or inspecting state to prevent the emulated system from changing values between operations.

• bizhawk_read

  Read bytes from BizHawk emulated memory at a given address. Returns an array of byte values. Use bizhawk.memory_domains first to discover valid domain names for the loaded game.

• bizhawk_reset

  Reset the loaded emulation core (reboot the emulated console). All emulated memory and CPU state is lost. Use to restart a game or boot a different ROM path.

• bizhawk_save_state

  Save the current emulator state to a file. The savestate captures all CPU registers, memory, and hardware state for later reload. Use with bizhawk.load_state for checkpoint-based testing workflows.

• bizhawk_screenshot

  Save a PNG screenshot of the current emulator display to a file path. Useful for capturing in-game state, error screens, or UI elements during automated testing.

• bizhawk_tap_buttons

  Atomically press a set of buttons for a fixed number of frames, then release them. Use for timed inputs such as a one-frame tap or a short hold.

• bizhawk_unpause

  Unpause BizHawk emulation after a previous pause call. The emulated system resumes normal execution.

• bizhawk_writewrite action

  Write bytes to BizHawk emulated memory at a given address. Use to patch game state, inject values, or modify emulated hardware registers in real time.

• ghidra_analyze

  Import and analyze a binary into a named Ghidra session. Creates or replaces a session. Returns session_id, platform info, and function count. Call this first before any other Ghidra analysis tool.

• ghidra_apply_signatures

  Scan the current binary, match every function by structural fingerprint against a previously exported signature map, and rename matches automatically. Use after loading a new binary version to restore meaningful names.

• ghidra_call_graph

  Get the call graph for a function — shows which functions it calls (callees) and which functions call it (callers). Use after ghidra.decompile to understand function relationships.

• ghidra_comment

  Attach a comment to a code unit at a given address. Supports comment types: plate, pre, post, eol, repeatable. Use to document reverse-engineering findings inline.

• ghidra_create_structwrite action

  Create a custom structured data type from a JSON member layout. Each member specifies offset (optional), field name, and type string. Use to model protocol headers, packet formats, and data structures.

• ghidra_cross_references

  Get cross-references to and from a given address. Shows what references the address and what the address references. Useful for understanding how data or code is used across the binary.

• ghidra_data_types

  List all data types defined in the loaded program, including structures, enums, and typedefs. Useful for understanding the program's type landscape before creating new types.

• ghidra_decompile

  Decompile a function by name or hex address. Returns decompiled C code. Use after session.analyze has loaded a binary.

• ghidra_decompile_entrypoints

  Composite tool that bulk-decompiles all entry points in one call — program entry, exports, main, _start, etc. Use early in analysis to get an overview of the binary's surface area.

• ghidra_decompile_paginated

  Decompile a function with line range, token budget, and optional summarization to prevent context-window exhaustion on large functions. Use for functions over 50 lines.

• ghidra_diff

  Compare two loaded sessions by function name and body size. Returns functions unique to each side and functions that changed between versions. Use for patch diffing and version comparison.

• ghidra_disassemble

  Disassemble N raw instructions at an address. Returns mnemonic, operands, hex bytes, and length for each instruction. Use for precise lower-level inspection when decompiled C is insufficient.

• ghidra_emulate

  Headlessly execute a slice of instructions using Ghidra's P-code emulator. Seed initial register values and track value propagation across execution steps. No debugger, GDB stub, or network needed. Works on any Ghidra-supported architecture (ARM, x86, MIPS, etc.)

• ghidra_emulate_breakpointswrite action

  Execute instructions until a break condition is met or the instruction count expires. Supports equality (R0==0), inequality (R1>0xFF), not-equal (R2!=R3), and PC address (PC==0x1234). Stops before or after the matching instruction. Ideal for finding copy-loop bounds, null-pointer paths, or switch-table targets.

• ghidra_emulate_taintwrite action

  Execute an instruction slice with automatic taint tracking. Specify a taint register; the tool reports every step where its value is modified or propagates to other registers. Use to trace data flows through cryptographic routines or input processing.

• ghidra_export_signatures

  Export a complete {structural_hash -> function_name} signature map for every function in the current binary. Save the output JSON to reuse across binary versions. Call before closing a session to preserve naming for future diffing.

• ghidra_fingerprint

  Generate a behavior-based structural hash for a function that survives compiler shuffling and optimization changes across binary versions. Use with ghidra.apply_signatures for cross-version function matching.

• ghidra_listing

  Return a raw hex + ASCII dump for a byte range, equivalent to Ghidra's Listing panel. Complements ghidra.disassemble for inspecting data regions, strings, and padding.

• ghidra_rename

  Rename a function or label at a given address. Changes are stored in the Ghidra project database. Use to replace auto-generated names like FUN_* with meaningful identifiers.

• ghidra_report

  Produce a Markdown summary of the active workspace — functions, entry points, custom symbols, recovered structures, renamed functions, and comment count. Replaces a GUI CodeBrowser window. Call at the end of a session to get a human-readable overview.

• ghidra_retype

  Change a local variable or function parameter's type annotation in the decompiled view. Use to replace generic types like undefined4* with meaningful types like MyStruct* for cleaner decompilation.

• ghidra_search

  Search the entire loaded binary for a hex byte pattern. Returns matching addresses with context bytes and any string labels at the hit. Use to locate known constants, magic bytes, or patch locations.

• ghidra_session_close

  Close and remove a Ghidra session workspace, freeing project resources. Cannot be undone. Use ghidra.sessions first to find active session IDs.

• ghidra_sessions

  List all active Ghidra session workspaces with their session IDs, binary paths, and load timestamps. Useful before calling ghidra.session_close or ghidra.diff.

• ghidra_stash_auto_restore

  Zero-input auto-restore: hashes the loaded binary, looks up a previously stashed map by content hash, and renames matching functions automatically. Pair with ghidra.stash_auto_save for fully automatic cross-version name recovery.

• ghidra_stash_auto_save

  Zero-input auto-stash: hashes the loaded binary's first 4 KB and saves a signature map under that hash. No group ID or user input needed. Just analyze and call.

• ghidra_stash_list

  List all stashed signature groups currently in the local server cache (~/.ghidra_bizhawk_mcp/signatures/). Use before ghidra.stash_restore to see available lineage_group_ids.

• ghidra_stash_restore

  Load a previously stashed signature map by lineage_group_id and auto-rename every matching function in the current session. Use with ghidra.stash_save for persistent cross-version function name recovery.

• ghidra_stash_save

  Fingerprint all functions and stash the signature map server-side under a lineage_group_id label (e.g. 'my_firmware_v1'). No JSON file management needed — stored in ~/.ghidra_bizhawk_mcp/signatures/.

• ghidra_triage

  Examines raw file magic header signatures to detect retro console architectures (NES, SNES, GBA, NDS, Switch, PSX, Genesis, SMS, Dreamcast), headlessly maps correct Ghidra language loaders, hooks multi-session project bindings, and applies automated signature caching overlays. Single-call entry point for ROM analysis.

• Code scan11 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 0 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

92/100

higher than 95% of 48,255 servers

Tools

46

the typical server has 7

Tools that change things

9%

typical: 0%. Fewer write tools means less an agent can break

GitHub stars

1

more than 65% of 28,688 servers

Ghidra BizHawk MCP: common questions

Is Ghidra BizHawk MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the Ghidra BizHawk MCP safety report

How do I install Ghidra BizHawk MCP?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Ghidra BizHawk MCP need an API key?

No secret keys are declared. It reads 3 settings from the environment.

Is Ghidra BizHawk MCP maintained?

The last commit was 19 days ago (2026-10-16). The latest release is v1.1.0.

How does Ghidra BizHawk MCP compare with other MCP servers?

safety score 92/100 (higher than 95% of 48,255 servers); tools 46 (the typical server has 7); tools that change things 9% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.