Binary Analysis MCP

二元分析MCP

用于分析PE、ELF、Mach-O和COFF二进制文件的MCP服务器 科琳·利夫. 将绝对文件路径传递给任何工具，格式将自动检测。

工具

需求

• Python 3.10+
• 中列出的依赖关系 requirements.txt:

- mcp[cli] --模型上下文协议SDK - lief>=0.17.0 --二进制解析库

安装

git clone https://github.com/Ap3x/BinaryAnalysis-MCP.git
cd BinaryAnalysis-MCP
python -m venv .venv
# Windows
.venv\Scripts\activate
# macOS / Linux
source .venv/bin/activate

pip install -r requirements.txt

运行服务器

python server.py

服务器通过以下方式进行通信 标准 使用MCP协议。

MCP客户端配置

克劳德桌面版

将以下内容添加到您的Claude Desktop配置文件中：

• 窗户： %APPDATA%\Claude\claude_desktop_config.json
• macOS： ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "binary-analysis": {
      "command": "python",
      "args": ["C:/path/to/BinaryAnalysis-MCP/server.py"],
      "env": {}
    }
  }
}

如果你使用的是虚拟环境，直接指向venv Python：

{
  "mcpServers": {
    "binary-analysis": {
      "command": "C:/path/to/BinaryAnalysis-MCP/.venv/Scripts/python.exe",
      "args": ["C:/path/to/BinaryAnalysis-MCP/server.py"],
      "env": {}
    }
  }
}

克劳德代码（CLI）

在您的项目中 .mcp.json:

{
  "mcpServers": {
    "binary-analysis": {
      "command": "python",
      "args": ["C:/path/to/BinaryAnalysis-MCP/server.py"],
      "env": {}
    }
  }
}

通用MCP客户端（stdio）

任何兼容MCP的客户端都可以将服务器作为子进程启动：

{
  "command": "python",
  "args": ["/absolute/path/to/server.py"],
  "transport": "stdio"
}

示例用法

连接后，让您的MCP客户端使用绝对文件路径调用工具：

Claude Desktop analysing notepad.exe

Analyse the security hardening of C:\Windows\System32\notepad.exe

List all imported DLLs for /usr/bin/ls

Show me the PE headers of C:\Windows\explorer.exe

输出示例

get_binary_info — C:\Windows\System32\notepad.exe

{
  "file": "C:/Windows/System32/notepad.exe",
  "format": "PE",
  "entrypoint": "0x1400019b0",
  "imagebase": "0x140000000",
  "is_pie": true,
  "has_nx": true,
  "sections": 8,
  "imported_functions": 339,
  "exported_functions": 0,
  "libraries": 56,
  "machine": "AMD64",
  "subsystem": "WINDOWS_GUI",
  "has_signatures": false,
  "has_tls": false,
  "has_resources": true,
  "has_rich_header": true,
  "has_relocations": true
}

get_binary_security — C:\Windows\System32\notepad.exe

{
  "aslr_dynamic_base": true,
  "aslr_high_entropy_va": true,
  "dep_nx_compat": true,
  "seh": true,
  "guard_cf": true,
  "force_integrity": false,
  "appcontainer": false,
  "is_pie": true,
  "has_nx": true,
  "signed": false,
  "format": "PE"
}

get_binary_sections — C:\Windows\System32\notepad.exe

{
  "format": "PE",
  "image_base": "0x140000000",
  "entrypoint": "0x19b0",
  "count": 8,
  "sections": [
    {
      "name": ".text",
      "virtual_address": "0x1000",
      "size": 159744,
      "entropy": 6.2826,
      "virtual_size": 157410,
      "sizeof_raw_data": 159744,
      "characteristics": ["CNT_CODE", "MEM_EXECUTE", "MEM_READ"]
    },
    {
      "name": ".rdata",
      "virtual_address": "0x29000",
      "size": 45056,
      "entropy": 5.8039,
      "virtual_size": 42456,
      "sizeof_raw_data": 45056,
      "characteristics": ["CNT_INITIALIZED_DATA", "MEM_READ"]
    },
    {
      "name": ".data",
      "virtual_address": "0x34000",
      "size": 4096,
      "entropy": 1.624,
      "virtual_size": 10048,
      "sizeof_raw_data": 4096,
      "characteristics": ["CNT_INITIALIZED_DATA", "MEM_READ", "MEM_WRITE"]
    },
    {
      "name": ".rsrc",
      "virtual_address": "0x3a000",
      "size": 126976,
      "entropy": 7.0998,
      "virtual_size": 123344,
      "sizeof_raw_data": 126976,
      "characteristics": ["CNT_INITIALIZED_DATA", "MEM_READ"]
    }
  ]
}

*为简洁起见，截断为8节中的4节。*

项目结构

server.py              — entrypoint: imports tools, runs mcp
app.py                 — FastMCP instance
helpers.py             — parse_binary, hex_addr, safe_str, safe_enum, format_name, _error
tools/
  __init__.py          — imports all tool modules (triggers @mcp.tool registration)
  info.py              — get_binary_info
  headers.py           — get_binary_headers
  sections.py          — get_binary_sections
  imports.py           — get_binary_imports
  exports.py           — get_binary_exports
  libraries.py         — get_binary_libraries
  security.py          — get_binary_security + _pe_security, _elf_security, _macho_security
  certificates.py      — get_binary_signatures (PE Authenticode/x509, Mach-O LC_CODE_SIGNATURE)
  coff.py              — get_coff_info
tests/
  conftest.py          — shared fixtures and sample file paths
  test_helpers.py      — tests for helpers.py utilities
  test_info.py         — tests for get_binary_info
  test_headers.py      — tests for get_binary_headers
  test_sections.py     — tests for get_binary_sections
  test_imports.py      — tests for get_binary_imports
  test_exports.py      — tests for get_binary_exports
  test_libraries.py    — tests for get_binary_libraries
  test_security.py     — tests for get_binary_security
  test_coff.py         — tests for get_coff_info
binary-samples/        — test binaries (git submodule)
.github/workflows/
  tests.yml            — CI: runs pytest on push/PR to main

搭配得很好

此MCP与 GhidraMCP --暴露Ghidra逆向工程能力的MCP服务器。使用BinaryAnalysis MCP进行快速静态分类（标头、导入、安全标志），使用GhidraMCP进行更深入的反编译和控制流分析。

许可证

该项目根据 GNU通用公共许可证v3.0.