{"id":"abd70452-9013-42de-aef3-5cd50df29b97","slug":"hxt9-x64dbg-mcp","kind":"mcp","name":"x64dbg-mcp","summary":"MCP server for x64dbg/x32dbg: native C++ plugin bridge + C# stdio server exposing 50+ tools (memory, registers, disasm, breakpoints, modules, threads, stack).","owner":"HxT9","repoUrl":"https://github.com/HxT9/x64dbg_mcp","license":"GPL-3.0","licenseTier":"strong-copyleft","trust":"community","stars":4,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-06-20T13:21:26.000Z","addedAt":"2026-10-14T05:28:10.122Z","logoUrl":"https://avatars.githubusercontent.com/u/58224596?u=328fe6971bc611a28f032ce7791d0d595c82c9cd&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","memory-knowledge"],"tags":["claude","debugger","reverse-engineering","x64dbg"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-14T10:49:17.529Z","sample":false,"url":"https://conduits.dev/tools/hxt9-x64dbg-mcp","language":"C++","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# x64dbg MCP\n\nAn [MCP](https://modelcontextprotocol.io) server that lets an LLM (Claude Code, etc.)\ndrive [x64dbg](https://x64dbg.com). It is split in two parts:\n\n```\nLLM  ──stdio(MCP)──►  x64dbgmcp (C#)  ──HTTP 127.0.0.1:8745──►  x64dbg_mcp.dp64 (C++ plugin)  ──►  x64dbg\n```\n\n* **`plugin/`** — a native x64dbg plugin. It embeds a tiny localhost HTTP server and\n  dispatches JSON requests onto the x64dbg bridge API (memory, registers, disasm,\n  commands, breakpoints, memory map). This is the only component that touches x64dbg.\n* **`mcp/`** — a C# MCP server (stdio) built on the official `ModelContextProtocol`\n  SDK. Each tool is a thin proxy to the plugin's HTTP endpoint.\n\n## Requirements\n\n* Windows, Visual Studio 2022 (MSVC) + CMake ≥ 3.20\n* .NET 10 SDK\n* An x64dbg checkout **that has been built** (the plugin links against\n  `bin/x64/x64dbg.lib` and `x64bridge.lib`). Default location: `..\\x64dbg` relative\n  to this repo.\n\n## Build\n\n```powershell\n# from the repo root\n./build.ps1                      # x64 / Release, installs the plugin and prints the register command\n./build.ps1 -Arch x86           # 32-bit plugin for x32dbg\n./build.ps1 -X64dbgRoot D:\\x64dbg\n```\n\nThis produces:\n\n* `<x64dbg>\\bin\\x64\\plugins\\x64dbg_mcp.dp64` (auto-installed)\n* `mcp\\app\\x64dbgmcp.dll` — the stable runtime folder Claude is registered against\n\n> The C# server is built into `mcp\\app` (not the default `bin\\`) because that is\n> the path the MCP registration points at. While a Claude session has the server\n> running, `mcp\\app\\x64dbgmcp.dll` is **locked** — rebuilding it fails with MSB3021.\n> Close the session (or `claude mcp remove x64dbg` + kill stray `dotnet.exe`)\n> before rebuilding the server, then re-add it.\n\nBuilding manually:\n\n```powershell\ncmake -S plugin -B plugin/build -G \"Visual Studio 17 2022\" -A x64 -DINSTALL_TO_X64DBG=ON\ncmake --build plugin/build --config Release\ndotnet build mcp -c Release\n```\n\n## Register with Claude Code\n\n```powershell\n# from the repo root, after building (use the absolute path to the built DLL)\nclaude mcp add --scope user --transport stdio x64dbg -- dotnet \"$PWD\\mcp\\app\\x64dbgmcp.dll\"\n```\n\nThen start x64dbg. On load the plugin logs:\n\n```\n[x64dbg_mcp] MCP bridge listening on http://127.0.0.1:8745/  (commands: mcp_port, mcp_status)\n```\n\n## Usage\n\n1. Launch x64dbg (the plugin auto-starts its server).\n2. In Claude Code the `x64dbg` MCP server exposes these tools:\n\n| Tool | Purpose |\n|------|---------|\n| **Session** | |\n| `dbg_status` | debugging state, current `cip`, module/label |\n| `dbg_process_list` / `dbg_attach` / `dbg_detach` | list processes, attach/detach by PID |\n| `dbg_load` / `dbg_stop` / `dbg_restart` | load an exe (with args), stop, restart |\n| `dbg_command` | run any raw x64dbg command (escape hatch) |\n| **Execution** | |\n| `dbg_run` / `dbg_pause` / `dbg_step_into` / `dbg_step_over` / `dbg_step_out` | execution control |\n| **State** | |\n| `dbg_registers` / `dbg_set_register` | read GP registers / set one |\n| `dbg_threads` / `dbg_switch_thread` | list / switch threads |\n| `dbg_call_stack` / `dbg_read_stack` | backtrace / raw stack slots (symbolized) |\n| `dbg_eval` | evaluate an expression → value/hex |\n| **Memory** | |\n| `dbg_read_memory` / `dbg_write_memory` | read/write debuggee memory (hex) |\n| `dbg_read_string` | read an ASCII/UTF-16 string |\n| `dbg_memory_map` | memory regions (base/size/protect/info) |\n| `dbg_memory_base` | base+size of the region at an address |\n| `dbg_is_valid_ptr` | is an address readable |\n| `dbg_set_page_rights` | change page protection |\n| `dbg_mem_alloc` / `dbg_mem_free` | allocate/free memory in the debuggee |\n| `dbg_find_pattern` | search a range for a byte pattern (wildcards) |\n| **Code / modules** | |\n| `dbg_disassemble` | disassemble N instructions |\n| `dbg_assemble` | assemble & patch an instruction in memory |\n| `dbg_address_info` | describe an address (module/section/label/func/string/...) |\n| `dbg_branch_destination` | resolve a branch/call/jmp target |\n| `dbg_xrefs` | cross-references to an address |\n| `dbg_modules` / `dbg_module_sections` / `dbg_module_exports` | enumerate modules, sections, exports |\n| `dbg_symbols` | enumerate a module's symbols |\n| `dbg_labels` | list all labels |\n| `dbg_set_comment` / `dbg_set_label` | annotate addresses |\n| `dbg_patches` | list in-memory patches |\n| **Breakpoints** | |\n| `dbg_list_breakpoints` | all breakpoints |\n| `dbg_set_breakpoint` / `dbg_delete_breakpoint` | manage breakpoints (sw/hw/mem) |\n| **System** | |\n| `dbg_handles` | enumerate open handles |\n| `dbg_tcp_connections` | enumerate TCP connections |\n\nAnything not covered by a dedicated tool can be driven through `dbg_command`\n(e.g. `init C:\\path\\app.exe`, `bp kernel32.CreateFileW`, `g`).\n\n## Configuration\n\n* **Plugin port** — default `8745`. Change it with the x64dbg command\n  `mcp_port <n>`, or persist it in `x64dbg.ini`:\n\n  ```ini\n  [x64dbg_mcp]\n  port=8745\n  ```\n\n  `mcp_status` reports the current state.\n\n* **Server target** — the C# server connects to `http://127.0.0.1:8745/` by\n  default; override with the `X64DBG_MCP_URL` environment variable (must match the\n  plugin port).\n\n## Security note\n\nThe plugin binds to `127.0.0.1` only and is intended for local use. It exposes\nfull read/write/command control over whatever x64dbg is debugging — treat it as\nyou would the debugger itself. Don't expose the port beyond localhost.\n\n## Layout\n\n```\nx64dbg_mcp/\n├─ plugin/\n│  ├─ src/{plugin,http_server,rpc}.cpp + headers\n│  ├─ third_party/json.hpp          (nlohmann/json, vendored)\n│  └─ CMakeLists.txt\n├─ mcp/\n│  ├─ Program.cs                    (stdio MCP host)\n│  ├─ X64DbgClient.cs               (HTTP client to the plugin)\n│  ├─ X64DbgTools.cs                (the MCP tools)\n│  └─ x64dbgmcp.csproj\n├─ build.ps1\n├─ LICENSE\n├─ THIRD_PARTY.md\n└─ README.md\n```\n\n## License\n\nLicensed under the **GNU General Public License v3.0** — see [LICENSE](LICENSE).\n\nThe native plugin links against the x64dbg bridge and SDK (x64dbg is GPLv3), so\nthe project as a whole is distributed under GPLv3. Third-party components and\ntheir licenses are listed in [THIRD_PARTY.md](THIRD_PARTY.md).\n\n> **Disclaimer:** this is a debugging/reverse-engineering tool. Use it only on\n> software you are authorized to analyze. Provided \"as is\", without warranty.\n"}