x64dbg-MCP Server

x64dbg-MCP Server connects an MCP-compatible AI assistant to x64dbg for direct inspection and control of a debugging session. It's for reverse engineers, malware analysts and security researchers investigating Windows binaries.

• Execution control: An assistant can load executables, attach to running processes, set conditional or hardware breakpoints, and step through instructions.
• Process inspection: It can examine disassembly, registers, memory, threads and call stacks, and write process memory.
• Binary analysis: String extraction, byte-pattern searches, symbols and cross-references help investigate code alongside PE analysis, original entry point detection and module dumping.
• Tracing and events: The assistant can trace execution and wait for pauses, breakpoints or exceptions before continuing its investigation.

The MIT-licensed open-source plugin runs inside x64dbg on Windows and supports 32-bit and 64-bit debugging. It needs no separate Python or .NET runtime. MCP clients connect through Streamable HTTP or SSE, including from WSL or a remote machine.

The debugger and plugin run on your Windows machine; the connected assistant receives debugger data through MCP. Every request requires a bearer token, and the connection uses HTTP.