AwesomeREA.org

Integration

Binary Ninja Headless MCP

A third-party, headless-only MCP server by Ruben Marks (mrphrazer) that gives agents a large Binary Ninja tool surface the project counts as 181 tools across 36 feature groups, including disassembly, intermediate languages, cross-references, types, search, patching with undo/redo transactions, and arbitrary scripting through binja.eval and binja.call. It speaks MCP over stdio or TCP, ships a schema-derived command-line client (binja_cli), and is meant to run in the same container as the agent runtime. A fake-backend mode runs the CLI, tests and a feature fuzzer without a Binary Ninja license, while real analysis needs a headless-capable license.

Targets
Binary
Category
Independent MCP integrations
Relationship
Independent agent integration
Sources reviewed

Requirements & limits

  • Reviewed at main 7fafd75 (2026-09-19); the pyproject declares package version 0.2.0 and there are no tagged releases. The README positions it against GUI-bound or limited Binary Ninja MCP servers as a headless-only, agent-driven alternative with mutation workflows and scripting, and states the whole project, including its code, tests and documentation, is vibe coded.
  • Needs Python 3.11+. Real analysis requires a Binary Ninja installation with a headless-capable license and the binaryninja Python module importable; the README notes enterprise and debugger APIs are not covered. A fake-backend mode (BINARY_NINJA_HEADLESS_MCP_FAKE_BACKEND=1) runs the CLI, the pytest suite and the feature fuzzer without a license, which is what CI exercises on Python 3.11 with ruff and pytest.
  • Install with pip from a clone or straight from the repository. Register it with an MCP host such as Claude Code or Codex over stdio (default) or TCP; the recommended deployment runs the agent and this server in one container. The repository bundles a sample binary, samples/ls (a stripped aarch64 GNU coreutils ls), as the fuzzer and verification target, plus small C fixtures.
  • The README's security model states that stdio and TCP transports are unauthenticated by default and that binja.eval and binja.call expose arbitrary scripting and broad API access, intended only for trusted containerized environments and not to be exposed to untrusted users or networks. Read-only mode is the session default, memory.read is capped at 65536 bytes, and mutations use undo/redo transactions.
  • The bundled CLI_VERIFICATION.md reports native coverage of all 181 tools on Binary Ninja 6.0.10601 Ultimate (AArch64 Linux host) across both architectures, transports and argument styles, but its evidence links point to files in the authors' analysis environment rather than the shipped package. GPL-2.0. This record describes analysis use of binaries the operator is authorized to examine; it reviewed the README and repository metadata without installing the server or running Binary Ninja, and establishes no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mrphrazer/binary-ninja-headless-mcp · Revision 7fafd75
  2. README.md#L15-L25 GitHub · mrphrazer/binary-ninja-headless-mcp · Revision 7fafd75
  3. README.md#L197-L203 GitHub · mrphrazer/binary-ninja-headless-mcp · Revision 7fafd75
  4. pyproject.toml GitHub · mrphrazer/binary-ninja-headless-mcp · Revision 7fafd75
  5. .github/workflows/ci.yml GitHub · mrphrazer/binary-ninja-headless-mcp · Revision 7fafd75
  6. CLI_VERIFICATION.md GitHub · mrphrazer/binary-ninja-headless-mcp · Revision 7fafd75
  7. LICENSE GitHub · mrphrazer/binary-ninja-headless-mcp · Revision 7fafd75

More in Agents and MCP

All 57 entries in Agents and MCP