Description
Reversing in x64dbg means a lot of mechanical work: set a breakpoint, step, check registers, read memory, search strings, then copy chunks over to an AI to ask what the assembly is doing, switching windows until your hands ache.
x64dbg MCP Server is a native x64dbg plugin that exposes the debugger over the MCP protocol, so AI assistants like Claude Code can drive x64dbg directly. They load a binary, break at the entry point, read registers and memory, step through code and inspect the call stack. Say "load calc.exe, break at the entry point and step through the next three instructions" and it calls the tools itself and reports back in the chat.
The plugin is written in Zig with no runtime dependencies, ships x32 and x64 builds together, and just needs to be dropped into your x64dbg folder. The MCP server starts with the debugger, and every request needs an access token, so nobody else can connect uninvited. Free and open source (MIT).
80+ MCP tools: disassembly, stepping, breakpoints, memory allocation and read/write, registers, modules, threads, call stack, pattern scanning, string extraction, xrefs, symbols and bookmarks.
PE and unpacking help: PE analysis, OEP detection, module dumping, PEB and SEH inspection, and tracing.
Debugger events: 22 event types (breakpoints, exceptions, steps, DLL load/unload, threads and more) reported to the AI.
Dual transport: Streamable HTTP and SSE, so new and legacy MCP clients both work.
Token auth: an access token is generated on first run and required on every request.
Config dialog: change IP, port and token from the Plugins menu, and the server restarts on save.
Zero dependencies: a pure native plugin with no .NET, Python or other runtime.
x64dbg MCP Server is a native x64dbg plugin that exposes the debugger over the MCP protocol, so AI assistants like Claude Code can drive x64dbg directly. They load a binary, break at the entry point, read registers and memory, step through code and inspect the call stack. Say "load calc.exe, break at the entry point and step through the next three instructions" and it calls the tools itself and reports back in the chat.
The plugin is written in Zig with no runtime dependencies, ships x32 and x64 builds together, and just needs to be dropped into your x64dbg folder. The MCP server starts with the debugger, and every request needs an access token, so nobody else can connect uninvited. Free and open source (MIT).
Features
80+ MCP tools: disassembly, stepping, breakpoints, memory allocation and read/write, registers, modules, threads, call stack, pattern scanning, string extraction, xrefs, symbols and bookmarks.
PE and unpacking help: PE analysis, OEP detection, module dumping, PEB and SEH inspection, and tracing.
Debugger events: 22 event types (breakpoints, exceptions, steps, DLL load/unload, threads and more) reported to the AI.
Dual transport: Streamable HTTP and SSE, so new and legacy MCP clients both work.
Token auth: an access token is generated on first run and required on every request.
Config dialog: change IP, port and token from the Plugins menu, and the server restarts on save.
Zero dependencies: a pure native plugin with no .NET, Python or other runtime.
