mq1n/ghostmcp

Developer tools

Эта страница переведена автоматически. Технические детали смотрите в оригинале. Открыть оригинал

33 stars 4 forks Качество 65 Тренд 11MIT

Repository Install

Injectable MCP server for AI-driven reverse engineering inside processes

Обзор

Point the AI at a process and let him cook. Ghost-MCP is an injectable MCP (Model Context Protocol) server for vibe reverse engineering assistant on Windows. It combines memory inspection, disassembly, debugging, and code injection into a single tool that any MCP-compatible AI client can use. Inject it into a target process and interact through natural conversation. ⚠️ : This project is highly experimental and under development. APIs may change without notice, features may be incomplete or unstable, and documentation may not reflect the current state. Use at your own risk. Ask your AI assistant things like: - "Find the health value in this game and freeze it at 100" - "Show me all functions that reference this string" - "Set a breakpoint on MessageBoxA and tell me when it gets called" - "Disassemble the function at this address and explain what it does" - "Find all pointers that lead to this address" The AI handles the technical details. You just describe what you want.

README

Показан фрагмент оригинального README. Открыть оригинал.

Ghost-MCP 👻

Talk to your binaries. Point the AI at a process and let him cook.

Ghost-MCP is an injectable MCP (Model Context Protocol) server for vibe reverse engineering assistant on Windows. It combines memory inspection, disassembly, debugging, and code injection into a single tool that any MCP-compatible AI client can use. Inject it into a target process and interact through natural conversation.

⚠️ EXPERIMENTAL: This project is highly experimental and under development. APIs may change without notice, features may be incomplete or unstable, and documentation may not reflect the current state. Use at your own risk.

What Can You Do With It?

Ask your AI assistant things like:

“Find the health value in this game and freeze it at 100”
“Show me all functions that reference this string”
“Set a breakpoint on MessageBoxA and tell me when it gets called”
“Disassemble the function at this address and explain what it does”
“Find all pointers that lead to this address”

The AI handles the technical details. You just describe what you want.

Multi-Server Architecture

Ghost-MCP uses a modular multi-server architecture to provide 250+ tools while staying under MCP client limits:

Server	Port	Tools	Purpose
ghost-core-mcp	13340	85	Memory, debugging, execution, safety
ghost-analysis-mcp	13341	82	Scanning, pointers, dumps, structures
ghost-static-mcp	13342	84	Radare2, IDA, Ghidra, AI, YARA
ghost-extended-mcp	13343	85	Injection, anti-debug, input, speedhack

Quick Setup:

Agent listens on 13338; core server uses stdio, analysis/static on TCP
scripts/launch-mcp.ps1 starts one or all servers
Destructive operations require safety tokens: call safety_request_token, then include token_id

Features

Memory Operations (Cheat Engine-style)

Everything you need to hunt down values and manipulate memory:

Read/write memory with automatic type conversion (integers, floats, strings, bytes)
Region enumeration with protection flags (readable, writable, executable)
Pattern scanning with AOB wildcards (48 8B ?? ?? 90)
Pointer chain resolution for complex data structures

Pattern Scanning & YARA

Advanced pattern matching for malware analysis and signature scanning:

AOB scanning for Array of Bytes with wildcard support
String scanning for ASCII, Unicode (UTF-16), and UTF-8 patterns
Regex patterns with byte-level matching (requires yara feature)
YARA integration to load and run rules against memory
Signature databases to store, import, and export named patterns
Named signatures to organize patterns with tags and descriptions

Memory Dump & Analysis

Full process memory dumping with PE reconstruction:

Full process dumps to capture all committed memory regions
Selective region dumps for specific address ranges

Открыть полный README на GitHub

Установка

This server does not publish a one-line install command.

Open the repository installation guide Новичок в MCP? Начните с руководства на mcpskill.org →

Конфигурация

{
  "mcpServers": {
    "ghost-core": {
      "command": "path/to/ghost-core-mcp.exe",
      "args": ["--transport", "stdio"]
    },
    "ghost-analysis": {
      "command": "path/to/ghost-analysis-mcp.exe",
      "args": ["--port", "13341"]
    },
    "ghost-static": {
      "command": "path/to/ghost-static-mcp.exe",
      "args": ["--port", "13342"]
    },
    "ghost-extended": {
      "command": "path/to/ghost-extended-mcp.exe",
      "args": ["--port", "13343"]
    }
  }
}