X64dbg MCP Server
X64dbg debugger controls for AI agents via HTTP and SSE transport protocols.
Data last scanned today · Reviewed today
Overview
X64dbg-MCP Server acts as a native plugin for the x64dbg debugger, exposing its extensive functionality through the Model Context Protocol. It allows AI assistants to perform complex reverse engineering tasks such as setting breakpoints, memory inspection, and register dumping by bridging the debugger's API to a JSON-RPC 2.0 interface. Developed in Zig with zero external dependencies, the server is provided as a single-binary plugin. It supports both x32 and x64 architectures and includes features like pattern scanning, PE analysis, and module dumping, while managing debugger events through 22 distinct callbacks.
Our verdict
With a security score of 45/100, this server is classified as high-risk. The score is impacted by the fact that the authentication mechanism and read-only support have not yet been editorially reviewed, and the project is maintained by an individual rather than an official vendor. Users should exercise caution when running this tool on sensitive reverse engineering environments until these security implementations have undergone thorough validation.
- Implemented in Zig with zero direct dependencies
- Provides 84 distinct MCP tools for debugger control
- Supports both x32 and x64 architectures
- Maintains an active development cycle with recent commits
- Authentication and read-only mode have not been audited
- Community-maintained project with limited contributor base
- No official vendor backing or security verification
Tools
| Tool | Description | Risk |
|---|---|---|
| GetDebugState | Current debugger state, PID, instruction pointer | low |
| LoadBinary | Load an executable into the debugger | medium |
| ExecuteDebuggerCommand | Run any x64dbg command | high |
| ListCommandsByCategory | List available MCP tools | low |
| SearchForStrings | Search process memory for text | low |
| GetEventLog | Last N debugger events (exceptions, breakpoints, DLL loads) | low |
| ClearEventLog | Clear the event log | low |
| EvalExpression | Evaluate any x64dbg expression (address, register, arithmetic) | low |
| AttachProcess | Attach to a running process by PID | medium |
| Echo | Echo input back | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the system prerequisites for this MCP server?
There are no external runtimes or frameworks required because it is a native plugin built with Zig. You only need to drop the plugin files into your x64dbg plugins folder.
›How do I authenticate my MCP client with the server?
The server requires Bearer token authentication for every request. An authentication token is auto-generated upon the first run of the server.
›Can I configure the server's network settings?
Yes, you can modify the IP, port, and token through the configuration dialog located in the x64dbg Plugins menu. Saving these settings will trigger an automatic restart of the server.
›What are the default ports used by the server?
By default, the x64 version of the server runs on port 9094, while the x32 version runs on port 9095.
›How does the server handle remote or WSL connections?
If you are connecting from a remote machine or WSL, ensure the bind address is set to 0.0.0.0 in the server's configuration dialog and use the host's IP address in your client.
Alternatives
Changelog
Badge
Maintain this server? Add the live badge to your README.