A Model Context Protocol (MCP) server for Binary Ninja, exposed as a core plugin. It allows AI agents to interact with Binary Ninja programmatically over HTTP.

The server starts automatically when Binary Ninja launches and listens on http://127.0.0.1:3142/mcp using the Streamable HTTP transport (JSON-RPC 2.0).

Requires CMake 4.2+, a C++23 compiler, and a Binary Ninja installation.

cmake --preset default
cmake --build --preset relwithdebinfo

cmake --install build --config RelWithDebInfo

This copies bnmcp-plugin.dll (and the example plugin) to your Binary Ninja plugins directory (%APPDATA%\Binary Ninja\plugins).

Copy or reference the included mcp.json in your editor. For example, in VS Code's .vscode/mcp.json:

{
  "servers": {
    "bn-mcp": {
      "url": "http://127.0.0.1:3142/mcp"
    }
  }
}

Start Binary Ninja before connecting your MCP client — the server is only available while Binary Ninja is running.

Other Binary Ninja plugins can register their own MCP tools with bn-mcp at runtime. Consumer plugins link against the bnmcp::client CMake target, which provides the import lib and include paths.

The API is defined in include/bnmcp/api.h and exported from bnmcp-plugin.dll. It provides both a C interface and a C++ convenience wrapper:

// C API
typedef const char* (*McpToolHandler)(const char* args_json, void* userdata);

bool McpRegisterTool(const char* name, const char* description,
                     const char* input_schema_json,
                     McpToolHandler handler, void* userdata);

// Resolve a view ID to a BinaryView (caller must free with BNFreeBinaryView).
BNBinaryView* McpGetView(const char* view_id);

// C++ wrapper
#include <bnmcp/api.h>

extern "C" {
BN_DECLARE_CORE_ABI_VERSION

BINARYNINJAPLUGIN bool CorePluginInit() {
  bnmcp::client::RegisterTool(
      "my_tool",
      "Description of what my tool does",
      {{"type", "object"},
       {"properties",
        {{"view_id", {{"type", "string"}}},
         {"name", {{"type", "string"}}}}},
       {"required", {"view_id", "name"}}},
      [](const nlohmann::json& args) -> nlohmann::json {
        auto bv = bnmcp::client::GetView(args["view_id"]);
        if (!bv) { /* error */ }
        // ... use bv ...
        return {{"content", {{{"type", "text"}, {"text", "result"}}}}};
      });

  return true;
}
}

Other plugins consume the API via FetchContent. The bnmcp::client target provides include paths, nlohmann_json, and the import lib for bnmcp-plugin.dll.

include(FetchContent)

FetchContent_Declare(bn-mcp
  GIT_REPOSITORY https://github.com/user/bn-mcp.git
  GIT_TAG main
)
FetchContent_MakeAvailable(bn-mcp)

add_library(my-plugin SHARED src/plugin.cpp)
target_link_libraries(my-plugin PRIVATE binaryninjaapi bnmcp::client)

If bn-mcp has been installed or its build tree is on CMAKE_PREFIX_PATH:

find_package(bnmcp REQUIRED)

add_library(my-plugin SHARED src/plugin.cpp)
target_link_libraries(my-plugin PRIVATE binaryninjaapi bnmcp::client)

See examples/list_functions/plugin.cpp for a complete example that registers a hello_world tool.

bnmcp-plugin.dll
  ├── Owns the HTTP server, JSON-RPC dispatch, and view management
  ├── Exports C API: McpRegisterTool(), McpGetView()
  └── Built-in tools: load/close/list views, functions, types, strings, xrefs, LLIL

include/bnmcp/api.h
  ├── C API declarations (dllimport for consumers, dllexport for the plugin)
  └── C++ wrapper: bnmcp::client::RegisterTool(), bnmcp::client::GetView()

other-plugin.dll
  ├── #include <bnmcp/api.h>
  ├── Links against: bnmcp-plugin import lib (via bnmcp::client CMake target)
  └── Calls bnmcp::client::RegisterTool() during CorePluginInit

All strings cross the DLL boundary as const char* — each side copies what it needs. No shared allocators, no ABI coupling beyond the C function signatures.

Tests use the bn-test framework (GTest compiled into a plugin DLL). Install bnmcp-tests.dll to the BN plugins folder and run via Plugin Commands → [bn-mcp] Run Tests.

MIT — see LICENSE.