re-mcp

One MCP server. Every RE tool. One conversation.

Let your AI assistant drive Cheat Engine, x64dbg, and Ghidra — scan memory, debug processes, decompile functions, and more — all through natural language.

AI Assistant ── MCP / stdio ──► re-mcp (Node.js) ──┬── HTTP poll ──► Cheat Engine  (Lua bridge)
  (Copilot / Claude)                                ├── HTTP poll ──► x64dbg       (Python bridge)
                                                    └── HTTP poll ──► Ghidra       (Python bridge)

This is a Model Context Protocol (MCP) server that exposes the full feature set of multiple reverse engineering tools as AI-callable tools. Works with any MCP-compatible client — GitHub Copilot Chat in VS Code, Claude Desktop, or any other MCP host.

Why re-mcp?

Every existing MCP project for RE tools is tool-specific — separate repos, separate installs, separate configs. re-mcp is the first unified server:

• One install — one npm install gives you access to all backends
• Cross-tool workflows — find an address in Cheat Engine, hit a breakpoint in x64dbg, decompile in Ghidra
• Consistent architecture — every bridge uses the same HTTP poll protocol
• Modular — only start the tools you need; each bridge connects independently

Features

55+ tools available to the AI, covering the complete reverse engineering workflow:

| Category | Prefix | Tools | What they do | |---|---|---|---| | Cheat Engine | ce_* | 22 tools | Memory scanning, read/write, disassembly, address list, speed hack, auto-assembler, Lua eval | | x64dbg | x64_* | 22 tools | Process attach, breakpoints, stepping, registers, memory, disassembly, modules, stack trace, labels, comments | | Ghidra | ghidra_* | 12 tools | Function listing, decompilation, disassembly, cross-references, renaming, comments, strings, imports/exports, segments | | Unified | re_* | 1 tool | re_status — shows which backends are connected |

Quick Start

1. Clone & build

git clone https://github.com/Travers9483/mcp-cheat-engine.git
cd mcp-cheat-engine
npm install
npm run build

2. Configure your AI client

"mcp": {
  "servers": {
    "re-mcp": {
      "type": "stdio",
      "command": "node",
      "args": ["C:/path/to/re-mcp/dist/index.js"],
      "env": {
        "CE_BRIDGE_PORT": "5874",
        "X64_BRIDGE_PORT": "5875",
        "GHIDRA_BRIDGE_PORT": "5876"
      }
    }
  }
}

{
  "mcpServers": {
    "re-mcp": {
      "command": "node",
      "args": ["C:/path/to/re-mcp/dist/index.js"],
      "env": {
        "CE_BRIDGE_PORT": "5874",
        "X64_BRIDGE_PORT": "5875",
        "GHIDRA_BRIDGE_PORT": "5876"
      }
    }
  }
}

3. Connect your tools

Each tool needs its bridge script running. You only need to start the tools you want to use:

Cheat Engine

1. Open Cheat Engine
2. Press Ctrl + Alt + L to open the Lua console
3. Paste the contents of bridges/cheat-engine/bridge.lua
4. Click Execute script

x64dbg

1. Open x64dbg
2. Ensure the Python plugin (x64dbgpy) is installed
3. Load bridges/x64dbg/bridge.py via the Script tab

Ghidra

1. Open Ghidra and load a binary in the CodeBrowser
2. Open Script Manager (Window → Script Manager)
3. Run bridges/ghidra/bridge.py

4. Start talking

Once the MCP server is active and at least one bridge is connected:

You: "What tools are connected?"
AI:  → calls re_status → "Cheat Engine and Ghidra are connected"

You: "List all functions containing 'Player' in Ghidra"
AI:  → calls ghidra_list_functions with filter "Player"

You: "Decompile the PlayerHealth function"
AI:  → calls ghidra_decompile

You: "Scan for the value 100 in Cheat Engine"
AI:  → calls ce_scan_first with value 100

Architecture

How it works

re-mcp runs as a single Node.js process that:

1. Connects to your AI client via MCP over stdio
2. Opens three HTTP servers (one per backend) on localhost
3. Each tool's bridge script polls its HTTP server for commands
4. Results flow back through the same HTTP channel

┌─────────────┐     stdio      ┌──────────────────────────────────────────┐
│ AI Assistant │ ◄════════════► │              re-mcp (Node.js)            │
│ (Copilot,    │    MCP JSON    │                                          │
│  Claude)     │                │  ┌──────────┐ ┌──────────┐ ┌──────────┐ │
└─────────────┘                │  │ CE Bridge │ │ x64 Brg  │ │ Ghidra   │ │
                               │  │ :5874     │ │ :5875    │ │ :5876    │ │
                               │  └────┬─────┘ └────┬─────┘ └────┬─────┘ │
                               └───────┼────────────┼────────────┼────────┘
                                       │ HTTP poll  │ HTTP poll  │ HTTP poll
                                 ┌─────▼─────┐ ┌───▼──────┐ ┌──▼───────┐
                                 │   Cheat    │ │  x64dbg  │ │  Ghidra  │
                                 │   Engine   │ │          │ │          │
                                 │  (Lua)     │ │ (Python) │ │ (Python) │
                                 └────────────┘ └──────────┘ └──────────┘

Bridge protocol

All bridges use the same simple HTTP protocol:

| Action | Direction | Payload | |---|---|---| | hello | Bridge → Server | { action: "hello" } | | poll | Bridge → Server | { action: "poll" } → { id, method, params } | | reply | Bridge → Server | { action: "reply", id, result } |

Configuration

All settings are via environment variables:

| Variable | Default | Description | |---|---|---| | CE_BRIDGE_PORT | 5874 | HTTP port for Cheat Engine bridge | | X64_BRIDGE_PORT | 5875 | HTTP port for x64dbg bridge | | GHIDRA_BRIDGE_PORT | 5876 | HTTP port for Ghidra bridge | | RE_BRIDGE_HOST | 127.0.0.1 | Bind address for all bridges |

Tool Reference

Unified Tools

| Tool | Description | |---|---| | re_status | Show connection status for all backends |

Cheat Engine Tools (ce_*)

| Tool | Description | |---|---| | ce_status | Connection status and attached process info | | ce_list_processes | List all visible processes | | ce_attach_process | Attach to a process by PID or name | | ce_read_memory | Read a typed value from memory | | ce_write_memory | Write a typed value to memory | | ce_read_bytes | Read raw hex bytes | | ce_write_bytes | Write raw hex bytes | | ce_disassemble | Disassemble instructions at address | | ce_scan_first | Start a new memory scan | | ce_scan_next | Narrow the current scan | | ce_scan_results | Get results from current scan | | ce_scan_reset | Reset the scan state | | ce_list_entries | List address-list entries | | ce_add_entry | Add an entry to the address list | | ce_set_entry_value | Set value of an address-list entry | | ce_freeze_entry | Freeze/unfreeze an entry | | ce_auto_assemble | Run Auto-Assembler script | | ce_resolve_symbol | Resolve a symbol to absolute address | | ce_set_speedhack | Enable speed hack | | ce_list_windows | List CE's open windows | | ce_inspect_form | Dump a CE form's control tree | | ce_get_control / ce_set_control / ce_click_control | UI automation | | ce_eval_lua | Execute arbitrary Lua code |

x64dbg Tools (x64_*)

| Tool | Description | |---|---| | x64_status | Connection status and debuggee info | | x64_open | Open an executable for debugging | | x64_attach | Attach to a process by PID | | x64_detach | Detach from process | | x64_run / x64_pause | Resume or pause execution | | x64_step_into / x64_step_over / x64_step_out | Stepping | | x64_get_registers / x64_set_register | Register access | | x64_read_memory / x64_write_memory | Memory access | | x64_disassemble | Disassemble at address | | x64_set_breakpoint / x64_remove_breakpoint / x64_list_breakpoints | Breakpoint management | | x64_modules | List loaded modules/DLLs | | x64_stack_trace | Get call stack | | x64_add_comment / x64_add_label | Annotations | | x64_command | Execute arbitrary x64dbg command |

Ghidra Tools (ghidra_*)

| Tool | Description | |---|---| | ghidra_status | Connection status and loaded program info | | ghidra_list_functions | List all functions (with filter) | | ghidra_decompile | Decompile a function to C pseudocode | | ghidra_disassemble | Disassemble at address | | ghidra_get_xrefs_to / ghidra_get_xrefs_from | Cross-references | | ghidra_rename | Rename function or symbol | | ghidra_add_comment | Add comment at address | | ghidra_list_strings | List defined strings | | ghidra_list_imports / ghidra_list_exports | Import/export tables | | ghidra_list_segments | List memory segments | | ghidra_eval | Execute arbitrary Python in Ghidra |

Roadmap

• [x] Cheat Engine — Live memory scanning, read/write, disassembly
• [x] x64dbg — Live debugging, breakpoints, stepping, registers
• [x] Ghidra — Static analysis, decompilation, cross-references
• [ ] IDA Pro — Static analysis (IDAPython bridge)
• [ ] ReClass.NET — Structure/class editing

How it compares

| Feature | re-mcp | BinaryAnalysisMCPs | x64dbg-automate | ghidra-mcp | |---|---|---|---|---| | Unified server | ✅ One install | ❌ 3 separate servers | ❌ x64dbg only | ❌ Ghidra only | | Cheat Engine | ✅ | ❌ | ❌ | ❌ | | x64dbg | ✅ | ✅ | ✅ | ❌ | | Ghidra | ✅ | ❌ | ❌ | ✅ | | Cross-tool workflows | ✅ | ❌ | ❌ | ❌ | | Language | TypeScript | Python | Python/C++ | Java/Python | | AI client support | Any MCP client | Any MCP client | Any MCP client | Any MCP client |

Contributing

PRs, bug reports, and new bridge implementations are welcome! If you've built a bridge for another tool (IDA Pro, Binary Ninja, Frida, etc.), we'd love to integrate it.

License

MIT