Binary Ninja reverse engineering

Start safely

1. Confirm the repository case scope is ready before acting on a target.
2. Check

   skills/tool-index.md

   for

   binaryninja

   ; Binary Ninja is commercial software and must be installed manually with a valid Vector 35 license.
3. Work on a copy when applying patches or saving database changes.
4. Record imports/exports, entry points, architecture, and file hash before promoting findings.

Choose the integration

• GUI or Python API: preferred when Binary Ninja is already open or the user wants direct interactive analysis.
• Community MCP bridge: use only when explicitly requested and after reviewing the third-party plugin boundary. Keep the Binary Ninja HTTP listener on

  127.0.0.1:9009

  ; do not enable network exposure by default.
• Fallback: use

  ghidra-reverse

  ,

  ida-reverse

  , or

  radare2

  when Binary Ninja is unavailable or its license/API cannot open the target.

fosdickio/binary_ninja_mcp

1.1.0

4000

8c5134ee46e2bf44f9a4d846bd971c3e39b3e306

npx -y binary-ninja-mcp@1.0.0 --host 127.0.0.1 --port 9009

Analysis workflow

1. Enumerate open binaries and select the intended view.
2. Capture binary status, entry points, segments, imports, exports, and representative strings.
3. Follow call sites and cross-references before interpreting a function in isolation.
4. Use HLIL for readable logic, MLIL SSA for data flow, and LLIL/disassembly when lifting loses instruction-level behavior.
5. Apply names, comments, and types incrementally; keep the original addresses in evidence.
6. Treat byte patches, prototype changes, and saved-file writes as mutations. Perform them only when requested and preserve the original artifact.
7. Cross-check high-impact conclusions with a second evidence source or another disassembler.

list_imports

list_exports

list_strings

decompile_function

get_il

Output