x64dbg-MCP Server MCP-powered agentic reverse engineering for x64dbg.

Features • Install • Usage • Tools • Configuration • Building • Structure

x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more.

Built with Zig — zero dependencies, single-binary output, cross-compiles to both x32 and x64 from any host. No .NET, no Python, no runtime — just drop the plugin into your x64dbg plugins folder and go.

MCP 2024-11-05 — Streamable HTTP + SSE transports, JSON-RPC 2.0.

Features

• 84 MCP Tools: Full debugger control — disassembly, stepping, breakpoints, memory allocation, registers, modules, threads, call stack, pattern scanning, string extraction, xrefs, symbols, bookmarks, PE analysis, OEP detection, module dumping, PEB/SEH inspection, tracing, and more.
• 22 Event Callbacks: Full debugger event coverage — init, stop, breakpoint, exception, step, attach/detach, DLL load/unload, threads, and more.
• Zero Dependencies: Pure native plugin, no runtime or framework needed.
• x32 and x64: Single codebase, builds both architectures from one command.
• Dual Transport: Streamable HTTP + SSE — compatible with any MCP client (new and legacy).
• Bearer Auth: Mandatory token authentication — auto-generated on first run, required on every request to prevent unauthorized access.
• Config Dialog: Change IP/port/token from the Plugins menu, auto-restarts the server on save.
• Auto-Start: MCP server starts automatically when x64dbg launches.
• Cross-Compile: Build Windows plugins from Linux, macOS, or WSL.

Install

Download the latest release or build from source:

1. Copy the contents of dist/ into your x64dbg root folder (deploys both x32 and x64)
2. Launch x64dbg

The MCP server starts automatically. Default ports:

• x64: 0.0.0.0:9094
• x32: 0.0.0.0:9095

Usage

Add to your MCP client config (.mcp.json, etc.):

Streamable HTTP (recommended):

{
  "mcpServers": {
    "x64dbg": {
      "type": "http",
      "url": "http://localhost:9094/",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

SSE (legacy clients):

{
  "mcpServers": {
    "x64dbg": {
      "type": "sse",
      "url": "http://localhost:9094/sse",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

If connecting from WSL or a remote machine, use the host's IP address and set the bind address to 0.0.0.0 in the config dialog.

Example — AI-assisted reverse engineering session:

You:    Load calc.exe and break at the entry point
AI: [calls LoadBinary, SetBreakpoint, run, WaitForPause]
        Loaded calc.exe, hit breakpoint at 0x7FF7A1234000 in calc.exe

You:    What are the current registers?
AI: [calls GetAllRegisters]
        RAX: 0x0, RCX: 0x7FF7A1234000, RDX: 0x1, ...

You:    Read 64 bytes at the current instruction pointer
AI: [calls ReadMemory]
        48 83 EC 28 E8 12 34 00 00 ...

You:    Step over the next 3 instructions and show me the stack
AI: [calls StepOver x3, GetCallStack]
        Stepped to 0x7FF7A1234010, call stack: ...

Tools

72 MCP tools covering the full x64dbg debugging workflow.

Always available

Tool	Description
GetDebugState	Current debugger state, PID, instruction pointer
LoadBinary	Load an executable into the debugger
ExecuteDebuggerCommand	Run any x64dbg command
ListCommandsByCategory	List available MCP tools
SearchForStrings	Search process memory for text
GetEventLog	Last N debugger events (exceptions, breakpoints, DLL loads)
ClearEventLog	Clear the event log
EvalExpression	Evaluate any x64dbg expression (address, register, arithmetic)
AttachProcess	Attach to a running process by PID
Echo	Echo input back
WaitForEvent	Long-poll for debugger events (breakpoint, pause, resume, exception)

Requires active debug session

Tool	Description
GetCurrentAddress	Current EIP/RIP with label and comment
Disassemble	Disassemble N instructions at an address
DisassembleFunction	Disassemble an entire function by boundaries
ReadMemory	Hex dump of process memory
WaitForPause	Block until target pauses
run	Resume execution (F9)
StepInto	Single-step into calls (F7)
StepOver	Step over calls (F8)
StepOut	Run until return (Ctrl+F9)
PauseDebug	Pause the target (F12)
StopDebug	Terminate debug session
RestartDebug	Restart debug session
SetBreakpoint	Set INT3 breakpoint at address/symbol
SetHardwareBreakpoint	Set hardware breakpoint (DR0-DR3, read/write/execute)
SetConditionalBreakpoint	Set breakpoint with condition expression and optional log
EnableBreakpoint	Enable a breakpoint at a given address
DisableBreakpoint	Disable a breakpoint without deleting it
ToggleBreakpoint	Toggle a breakpoint between enabled and disabled
DeleteBreakpoint	Remove a breakpoint
DeleteAllBreakpoints	Remove all breakpoints (normal, hardware, memory)
ResetHitCount	Reset a breakpoint's hit counter to zero
ListBreakpoints	List all active breakpoints
GetAllRegisters	Dump all general-purpose registers
SetRegister	Set a CPU register value
GetCallStack	Current thread call stack
GetThreads	List all threads with IDs and instruction pointers
SwitchThread	Switch active thread context
SuspendThread	Suspend a thread by its thread ID
ResumeThread	Resume a suspended t