与你的二进制对话。 将人工智能指向一个进程，让它烹饪。

Ghost-MCP 是一款可注入的 MCP（模型上下文协议）服务器，用于 Windows 上的 vibe 逆向工程助手。它将内存检查、反汇编、调试和代码注入整合到一个任何兼容 MCP 的 AI 客户端都能使用的工具中。将其注入目标进程，并通过自然对话进行交互。

⚠️ 实验性：本项目高度实验且正在开发中。API可能会在未通知的情况下更改，功能可能不完整或不稳定，文档也可能不反映当前状态。使用请自行承担风险。

你能拿它做什么？

可以问你的AI助手一些问题：

• “在本游戏中找出生命值并冻结为100”
• “显示所有引用该字符串的函数”
• “在MessageBoxA上设置断点，并告诉我它被调用时”
• “在此地址反汇编函数并解释其功能”
• “查找所有指向该地址的指针”

AI负责技术细节。你只需要描述你想要的内容。

多服务器架构

Ghost-MCP 👻

Talk to your binaries. Point the AI at a process and let him cook.

Ghost-MCP is an injectable MCP (Model Context Protocol) server for vibe reverse engineering assistant on Windows. It combines memory inspection, disassembly, debugging, and code injection into a single tool that any MCP-compatible AI client can use. Inject it into a target process and interact through natural conversation.

⚠️ EXPERIMENTAL: This project is highly experimental and under development. APIs may change without notice, features may be incomplete or unstable, and documentation may not reflect the current state. Use at your own risk.

What Can You Do With It?

Ask your AI assistant things like:

• “Find the health value in this game and freeze it at 100”
• “Show me all functions that reference this string”
• “Set a breakpoint on MessageBoxA and tell me when it gets called”
• “Disassemble the function at this address and explain what it does”
• “Find all pointers that lead to this address”

The AI handles the technical details. You just describe what you want.

Multi-Server Architecture

Ghost-MCP uses a modular multi-server architecture to provide 250+ tools while staying under MCP client limits:

Quick Setup:

• Agent listens on 13338; core server uses stdio, analysis/static on TCP
• scripts/launch-mcp.ps1 starts one or all servers
• Destructive operations require safety tokens: call safety_request_token, then include token_id

Features

Memory Operations (Cheat Engine-style)

Everything you need to hunt down values and manipulate memory:

• Read/write memory with automatic type conversion (integers, floats, strings, bytes)
• Region enumeration with protection flags (readable, writable, executable)
• Pattern scanning with AOB wildcards (48 8B ?? ?? 90)
• Pointer chain resolution for complex data structures

Pattern Scanning & YARA

Advanced pattern matching for malware analysis and signature scanning:

• AOB scanning for Array of Bytes with wildcard support
• String scanning for ASCII, Unicode (UTF-16), and UTF-8 patterns
• Regex patterns with byte-level matching (requires yara feature)
• YARA integration to load and run rules against memory
• Signature databases to store, import, and export named patterns
• Named signatures to organize patterns with tags and descriptions

Memory Dump & Analysis

Full process memory dumping with PE reconstruction:

• Full process dumps to capture all committed memory regions
• Selective region dumps for specific address ranges