x64dbg-mcp-server

x64dbg-MCP Server is a native MCP (Model Context Protocol) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Connect any MCP-compatible AI assistant and control x64dbg programmatically: set breakpoints, step through code, read memory, dump registers, and more.

Built with Zig — zero dependencies, single-binary output, cross-compiles to both x32 and x64 from any host. No .NET, no Python, no runtime — just drop the plugin into your x64dbg plugins folder and go.

MCP 2024-11-05 — Streamable HTTP + SSE transports, JSON-RPC 2.0.

Features

• 84 MCP Tools: Full debugger control — disassembly, stepping, breakpoints, memory allocation, registers, modules, threads, call stack, pattern scanning, string extraction, xrefs, symbols, bookmarks, PE analysis, OEP detection, module dumping, PEB/SEH inspection, tracing, and more.
• 22 Event Callbacks: Full debugger event coverage — init, stop, breakpoint, exception, step, attach/detach, DLL load/unload, threads, and more.
• Zero Dependencies: Pure native plugin, no runtime or framework needed.
• x32 and x64: Single codebase, builds both architectures from one command.
• Dual Transport: Streamable HTTP + SSE — compatible with any MCP client (new and legacy).
• Bearer Auth: Mandatory token authentication — auto-generated on first run, required on every request to prevent unauthorized access.
• Config Dialog: Change IP/port/token from the Plugins menu, auto-restarts the server on save.
• Auto-Start: MCP server starts automatically when x64dbg launches.
• Cross-Compile: Build Windows plugins from Linux, macOS, or WSL.

Install

Download the latest release or build from source:

1. Copy the contents of dist/ into your x64dbg root folder (deploys both x32 and x64)
2. Launch x64dbg

The MCP server starts automatically. Default ports:

• x64: 0.0.0.0:9094
• x32: 0.0.0.0:9095

Usage

Add to your MCP client config (.mcp.json, etc.):

Streamable HTTP (recommended):

{
  "mcpServers": {
    "x64dbg": {
      "type": "http",
      "url": "http://localhost:9094/",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

SSE (legacy clients):

{
  "mcpServers": {
    "x64dbg": {
      "type": "sse",
      "url": "http://localhost:9094/sse",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

If connecting from WSL or a remote machine, use the host's IP address and set the bind address to 0.0.0.0 in the config dialog.

Example — AI-assisted reverse engineering session:

You:    Load calc.exe and break at the entry point
AI: [calls LoadBinary, SetBreakpoint, run, WaitForPause]
        Loaded calc.exe, hit breakpoint at 0x7FF7A1234000 in calc.exe

You:    What are the current registers?
AI: [calls GetAllRegisters]
        RAX: 0x0, RCX: 0x7FF7A1234000, RDX: 0x1, ...

You:    Read 64 bytes at the current instruction pointer
AI: [calls ReadMemory]
        48 83 EC 28 E8 12 34 00 00 ...

You:    Step over the next 3 instructions and show me the stack
AI: [calls StepOver x3, GetCallStack]
        Stepped to 0x7FF7A1234010, call stack: ...

Tools

72 MCP tools covering the full x64dbg debugging workflow.

Always available

Requires active debug session

Configuration

Go to Plugins > x64dbg-MCP Server > Configure MCP Server... to change the bind address, port, and auth token.

• 0.0.0.0 — listen on all interfaces (for WSL/remote access)
• 127.0.0.1 — local-only access

Authentication

A Bearer token is auto-generated on first run and required on every request. The MCP server has full debugger control and can read/write process memory — all requests without a valid token receive 401 Unauthorized. Click Generate in the config dialog to rotate the token, or Copy to copy it to clipboard. Clients must include the token as an Authorization: Bearer <token> header.

Changes take effect immediately — the server auto-restarts on save. Config is persisted to mcp_config.json next to the x64dbg executable.

Building

Requires Zig 0.16-dev or later. Builds on Windows, WSL, Linux, or macOS.

zig build -Doptimize=ReleaseSafe --prefix dist

Output mirrors x64dbg's folder structure — copy the contents of dist/ into your x64dbg root to deploy both architectures at once:

dist/
├── x32/
│   └── plugins/
│       └── x64dbg-MCP-Server.dp32
└── x64/
    └── plugins/
        └── x64dbg-MCP-Server.dp64

Project Structure

├── build.zig                     # build config — x32 + x64 cross-compilation
├── build.zig.zon                 # package manifest
└── src/
    ├── main.zig                  # plugin entry point, menu, callbacks
    ├── core/
    │   ├── bridge.zig            # x64dbg SDK bindings (runtime-resolved)
    │   ├── config.zig            # Win32 config dialog and persistence
    │   └── mcp_server.zig        # HTTP server and JSON-RPC dispatch
    ├── mcp/
    │   ├── json.zig              # JSON writer and parser helpers
    │   └── tools.zig             # MCP tool definitions and handlers
    └── resources/
        └── icons.zig             # embedded PNG icon data

How It Works