What you can do with X64 DBG MCP Server

3 use cases

• Find the original entry point of a packed binary

  Use an AI assistant to load a packed executable in x64dbg, detect its OEP, and dump the module to disk.

  • X64 DBG MCP Server
  • Security and science
  • Intermediate
  View prompt

  Using the x64dbg-MCP-Server MCP tools at http://localhost:9094/ with my Bearer token, load <target executable path>, call DetectOEP, then call DumpModule. Report the Original Entry Point address and the dump file path. Verify that the dump file exists on disk.

  Share Save

• Step through a live process with an AI assistant

  Set breakpoints, step through code, and read registers and memory by describing the goal in plain language.

  • X64 DBG MCP Server
  • Security and science
  • Intermediate
  View prompt

  Using the x64dbg-MCP-Server tools at http://localhost:9094/ with my Bearer token, load <target executable path>, set a breakpoint at <address or symbol>, run, and call WaitForPause. Then report GetAllRegisters and GetCallStack output. Verify that the reported instruction pointer matches the breakpoint address.

  Share Save

• Triage a binary by strings, patterns, and references

  Use an AI assistant to scan a loaded module for strings, byte patterns, and call or jump references.

  • X64 DBG MCP Server
  • Security and science
  • Advanced
  View prompt

  Using the x64dbg-MCP-Server tools at http://localhost:9094/ with my Bearer token, run GetStrings and FindPattern with ?? wildcards on <module name>, then GetReferences for <target address>. Report the matching strings, pattern hits, and callers. Verify that each reported address falls inside the module range from ListModules.

  Share Save

How to use X64 DBG MCP Server

1. Check you have what it needs: Windows with x64dbg installed, or a Windows target for the plugin; The release contents of dist/ or Zig 0.16-dev or later to build from source; An MCP-compatible AI assistant client that can send HTTP requests with a Bearer token.
2. Open duty1g/x64dbg-mcp-server on GitHub and read the README and license.
3. Build the plugin with zig build -Doptimize=ReleaseSafe --prefix dist or download the latest release.
4. Copy the contents of dist/ into your x64dbg root folder.
5. Launch x64dbg. The MCP server starts automatically on 0.0.0.0:9094 for x64.
6. Copy the Bearer token from Plugins > x64dbg-MCP Server > Configure MCP Server... and add the Streamable HTTP config with the Authorization header to your MCP client config.

These steps come from our top use case, Find the original entry point of a packed binary, which also has a copy-paste agent prompt.

X64 DBG MCP Server alternatives · Best AI repos for Security and science

About this repo

• Who it is forReverse engineers and malware analysts who already use x64dbg and want an MCP-compatible AI assistant to drive breakpoints, stepping, and memory inspection.
• Why it is hot
• LanguageZig
• Sourcegithub.com/duty1g/x64dbg-mcp-server · Back to Hot repos

Requirements

• Windows with x64dbg installed, or a Windows target for the plugin
• The release contents of dist/ or Zig 0.16-dev or later to build from source
• An MCP-compatible AI assistant client that can send HTTP requests with a Bearer token
• Authorization to analyze the target software

Related repos

• Trended earlier Rea A plug-in that lets your AI agent take apart an app and explain how a feature works.
• Trended earlier Reverify Reverify is a Python toolkit and MCP server where deterministic tools verify every AI claim about a binary or code before it counts as fact.
• Trended earlier Ablation Ablation is a self-contained reverse engineering framework that, when used with Codex or Claude Code, works as an autonomous reverse engineering system.