SuperGhidra: Lock-Free Ghidra Daemon, C++ Recovery, and MCP Suite

Repositoryyuatemycat/SuperGhidraTool

SuperGhidra accelerates Ghidra scripting, rewrites decompiler output into compilable C, and provides an MCP server for AI agents. A warm daemon and SQLite cache eliminate JVM startup latency and project lock contention.

Key points

  1. Removes 5–15 second JVM startup delays per headless run using a warm background daemon on port 5073 and an L2 SQLite cache.
  2. Avoids .rep project lock contention with active Ghidra GUI sessions via read-only access and a JSON write overlay.
  3. Executes MSVC RTTI and MFC recovery outside the JVM using pure Python, NumPy SIMD, or WGPU compute shaders.
  4. Integrates a Z3 equivalence checker for P-code alongside cross-version function and struct-shift matching.
  5. Provides an MCP server interface to connect AI agents such as Claude Desktop, Claude Code, or Cursor.

Why it matters

Security researchers and reverse engineers can automate Ghidra and integrate AI agents without facing GUI project locks or repetitive JVM startup overhead.

Analysis

Architecture and Core Approach

SuperGhidra solves two prominent friction points in automated Ghidra workflows: heavy JVM cold-start penalties (5–15 seconds) and .rep project file lockouts when the GUI is running. The tool operates a persistent background daemon (127.0.0.1:5073) to keep Ghidra warm. Read operations are served via an L2 SQLite cache, while modifications are stored non-destructively in a JSON write overlay.

JVM-Free Static Analysis

Several static binary analyses bypass the Ghidra/Java runtime entirely. Extracting MSVC RTTI metadata and MFC Serialize() archive layouts is implemented in pure Python, leveraging NumPy SIMD or WGPU compute shaders directly against PE files. Additionally, semantic verification of P-code decompilation relies on the Z3 SMT solver.

Target Audience and Maturity

The suite is built for reverse engineers, vulnerability researchers, and developers integrating autonomous coding agents via the Model Context Protocol (MCP). With 162 stars, active CI workflows, and a PyPI release under AGPL-3.0, it represents a capable, specialized utility targeting advanced binary analysis.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 28 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Repository:NationalSecurityAgency/ghidra

    Ghidra: Open-Source Software Reverse Engineering Framework by the NSA

    Ghidra is a software reverse engineering (SRE) framework developed by the US National Security Agency (NSA) Research Directorate and released under the Apache 2.0 licence. It provides a comprehensive suite of analysis tools for compiled code across Windows, macOS, and Linux.

    74.3kstarsJava

    Security· Tool

  • X post:Trending GitHub Repositories

    REA: MCP Server for Agentic Reverse Engineering

    Open-source tool REA connects AI agents to reverse engineering utilities via the Model Context Protocol (MCP), enabling local analysis of binaries, Electron apps, and web applications.

    283bookmarks14.7kviews

    AI & LLMs· Tool

  • Repository:DeusData/codebase-memory-mcp

    codebase-memory-mcp: High-Performance Knowledge-Graph Code Intelligence via MCP

    codebase-memory-mcp is a pure C Model Context Protocol (MCP) server that indexes codebases into persistent knowledge graphs, providing AI coding agents with sub-millisecond structural search while dramatically reducing token consumption.

    42.3kstarsC

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.