x64dbg-MCP Server

MCP-powered agentic reverse engineering for x64dbg.

Features • Install • Usage • Tools • Configuration • Building • Structure

x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more.

Built with Zig — zero dependencies, single-binary output, cross-compiles to both x32 and x64 from any host. No .NET, no Python, no runtime — just drop the plugin into your x64dbg plugins folder and go.

MCP 2024-11-05 — Streamable HTTP + SSE transports, JSON-RPC 2.0.

Features

• 71 MCP Tools: Full debugger control — disassembly, stepping, breakpoints, memory allocation, registers, modules, threads, call stack, pattern scanning, string extraction, xrefs, symbols, bookmarks, PE analysis, OEP detection, module dumping, PEB/SEH inspection, tracing, and more.
• 22 Event Callbacks: Full debugger event coverage — init, stop, breakpoint, exception, step, attach/detach, DLL load/unload, threads, and more.
• Zero Dependencies: Pure native plugin, no runtime or framework needed.
• x32 and x64: Single codebase, builds both architectures from one command.
• Dual Transport: Streamable HTTP + SSE — compatible with any MCP client (new and legacy).
• Config Dialog: Change IP/port from the Plugins menu, auto-restarts the server on save.
• Auto-Start: MCP server starts automatically when x64dbg launches.
• Cross-Compile: Build Windows plugins from Linux, macOS, or WSL.

Install

Download the latest release or build from source:

1. Copy the contents of dist/ into your x64dbg root folder (deploys both x32 and x64)
2. Launch x64dbg

The MCP server starts automatically. Default ports:

• x64: 0.0.0.0:9094
• x32: 0.0.0.0:9095

Usage

Add to your MCP client config (.mcp.json, etc.):

Streamable HTTP (recommended):

{
  "mcpServers": {
    "x64dbg": {
      "type": "http",
      "url": "http://localhost:9094/"
    }
  }
}

SSE (legacy clients):

{
  "mcpServers": {
    "x64dbg": {
      "type": "sse",
      "url": "http://localhost:9094/sse"
    }
  }
}

If connecting from WSL or a remote machine, use the host's IP address and set the bind address to 0.0.0.0 in the config dialog.

Example — AI-assisted reverse engineering session:

You:    Load calc.exe and break at the entry point
AI: [calls LoadBinary, SetBreakpoint, run, WaitForPause]
        Loaded calc.exe, hit breakpoint at 0x7FF7A1234000 in calc.exe

You:    What are the current registers?
AI: [calls GetAllRegisters]
        RAX: 0x0, RCX: 0x7FF7A1234000, RDX: 0x1, ...

You:    Read 64 bytes at the current instruction pointer
AI: [calls ReadMemory]
        48 83 EC 28 E8 12 34 00 00 ...

You:    Step over the next 3 instructions and show me the stack
AI: [calls StepOver x3, GetCallStack]
        Stepped to 0x7FF7A1234010, call stack: ...

Tools

71 MCP tools covering the full x64dbg debugging workflow.

Always available

Requires active debug session

Configuration

Go to Plugins > x64dbg-MCP Server > Configure MCP Server... to change the bind address and port.

• 0.0.0.0 — listen on all interfaces (for WSL/remote access)
• 127.0.0.1 — local-only access

Changes take effect immediately — the server auto-restarts on save. Config is persisted to mcp_config.json next to the x64dbg executable.

Building

Requires Zig 0.16-dev or later. Builds on Windows, WSL, Linux, or macOS.

zig build -Doptimize=ReleaseSafe --prefix dist

Output mirrors x64dbg's folder structure — copy the contents of dist/ into your x64dbg root to deploy both architectures at once:

dist/
├── x32/
│   └── plugins/
│       └── x64dbg-MCP-Server.dp32
└── x64/
    └── plugins/
        └── x64dbg-MCP-Server.dp64

Project Structure

├── build.zig                     # build config — x32 + x64 cross-compilation
├── build.zig.zon                 # package manifest
└── src/
    ├── main.zig                  # plugin entry point, menu, callbacks
    ├── core/
    │   ├── bridge.zig            # x64dbg SDK bindings (runtime-resolved)
    │   ├── config.zig            # Win32 config dialog and persistence
    │   └── mcp_server.zig        # HTTP server and JSON-RPC dispatch
    ├── mcp/
    │   ├── json.zig              # JSON writer and parser helpers
    │   └── tools.zig             # MCP tool definitions and handlers
    └── resources/
        └── icons.zig             # embedded PNG icon data

How It Works

The plugin loads into x64dbg at startup, resolves the debugger's API symbols at runtime from x64bridge.dll and x64dbg.dll, then spins up an HTTP server on a background thread. MCP clients connect over HTTP and send JSON-RPC requests to invoke tools — each tool maps directly to x64dbg SDK calls (breakpoints, memory reads, command execution, etc.).

No polling, no external processes — the plugin lives inside x64dbg's address space with direct access to the debugger API.

License

MIT. See LICENSE.

Made with 🖤 by @duty1g