X64dbg

io.github.bromoketPublished by GitHub account bromoketv2.3.0Updated Oct 24, 2026

MCP server for x64dbg debugger - 23 mega-tools for AI-powered reverse engineering and debugging

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Bridges an AI assistant to the x64dbg debugger, letting it set breakpoints, read memory, disassemble, trace and dump binaries on the user's machine.

What you can do
  • Control the debugger: run, step, pause, raw commands, scripts and expression evaluation
  • Inspect CPU and memory: registers, read/write/allocate/protect memory, memory map, call stack and SEH chain
  • Analyze code: disassemble, assemble, cross-references, basic blocks, control-flow graphs and loops
  • Manage breakpoints and tracing: software, hardware, memory, conditional and logging breakpoints, batch setup, trace logs and trace status
  • Work with symbols and search: labels, comments, bookmarks, AOB pattern and string scans, imports, exports and patches
  • Handle process, patching and dumping: threads and TEB, handles, TCP, PEB, anti-debug hiding, byte patches, PE dump and IAT fix
When to use it
Useful for reverse engineering and malware or anti-cheat analysis where you want an assistant to drive a live x64dbg session in plain language instead of writing scripts by hand. It suits desktop debugging of 32-bit and 64-bit Windows targets.
Requirements
Runs locally on Windows: the x64dbg MCP plugin (dp64/dp32) must be installed inside x64dbg and x64dbg must be running with a target open. The npm package x64dbg-mcp-server is launched via npx with Node.js. The plugin's REST API address is set with X64DBG_MCP_HOST and X64DBG_MCP_PORT (defaults to 127.0.0.1:27042).
Before you install
The assistant can write memory, patch bytes, dump modules and hide the debugger from anti-debug checks, which changes the target process and its files. The optional plugin token is passed via X64DBG_MCP_TOKEN; without it, other local processes may reach the localhost API. Intended for analysis of software you are authorized to inspect.

Installation

In SourceWeft

  1. Open X64dbg in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

x64dbg MCP Server

[npm version] [MCP Registry] [License: MIT]

Drive x64dbg with your AI. Talk to Claude, Cursor, Windsurf, Cline, or any MCP client in plain English and it sets breakpoints, reads memory, disassembles, traces, dumps PEs, and bypasses anti-debug — live, inside the debugger.

23 mega-tools over 153 REST endpoints, fully typed with Zod. A C++ plugin runs inside x64dbg; a tiny TypeScript server bridges it to your client over stdio. Everything stays on 127.0.0.1 — nothing leaves your machine.

Latest — v2.3.0

  • Hardened & crash-proof. A malformed HTTP request can no longer crash x64dbg; the plugin server drains connections cleanly on stop and ships an optional auth token (CORS is locked down).
  • Real data from more tools. imports/exports, symbols search/list, patches list, and strings now return actual parsed results instead of pointing you at a GUI view.
  • Live trace status. New /api/trace/status (+ tracing status) reports whether a trace is running, and the exception/trace tools now honor every parameter they accept.
  • Plus the v2.2.x fixes: x32dbg loads on current snapshots, and requests no longer time out on long operations.

Download the v2.3.0 plugins →

What it looks like

"Set a breakpoint on CreateFileW and run the program""Disassemble the current function and explain what it does""Search for 48 8B ?? 48 85 C0 in the main module and disassemble the hits""Hide the debugger and bypass the anti-debug checks""Trace into the VM dispatcher and log every instruction to a file""Dump the main module to disk and fix the import table"

Real use: tracing VMProtect'd code, finding anti-cheat scanner threads, decoding XOR'd class names, mapping detection logic — all by asking, no manual scripting.

Install

1 · Plugin (inside x64dbg)

Download x64dbg_mcp.dp64 / .dp32 from the latest release and drop them in:

x64dbg/x64/plugins/x64dbg_mcp.dp64    ← 64-bit targetsx64dbg/x32/plugins/x64dbg_mcp.dp32    ← 32-bit targets

…or build + install it yourself (auto-detects your x64dbg — no path editing):

powershell
.\build.ps1 -Install

Start x64dbg; the log shows [MCP] x64dbg MCP Server started on 127.0.0.1:27042.

2 · Server (your AI client)

No install — just point your client at npx. Claude Code:

json
{  "mcpServers": {    "x64dbg": {      "type": "stdio",      "command": "cmd",      "args": ["/c", "npx", "-y", "x64dbg-mcp-server"]    }  }}

Claude Desktop / Cursor / Windsurf / Cline use the same block without the cmd /c wrapper: { "command": "npx", "args": ["-y", "x64dbg-mcp-server"] }. Full per-client paths are in the reference.

3 · Go

Open a target in x64dbg and start talking to your assistant.

Tools at a glance

23 action-based tools spanning the whole debugger:

  • Control — run/step/pause, raw commands, scripts, expression eval
  • CPU & memory — registers (incl. AVX-512), read/write/alloc/protect, memory map
  • Stack — call stack, SEH chain, return addresses
  • Code analysis — disassemble, assemble, xrefs, basic blocks, CFG, loops
  • Breakpoints & tracing — software/hardware/memory/conditional/logging, batch, trace logs
  • Symbols & search — labels, comments, bookmarks, AOB pattern + string scan
  • Process & system — threads/TEB, handles, TCP, PEB, anti-debug hide
  • Patching & dumping — byte patches, PE dump, IAT fix, patch export

Every tool, action, and endpoint is documented in docs/REFERENCE.md.

Links

Security

The plugin binds to 127.0.0.1 only; the server talks pure stdio. All traffic stays on localhost — no remote access, no telemetry, no data leaves your machine. For defense against other local processes, set a token in the plugin's Settings and pass it via X64DBG_MCP_TOKEN — every request must then carry it.

Author

bromo — GitHub. Built with Claude Code. MIT.

Source: README.md at commit d8e6cac

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v2.3.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts