x64dbg_mcp

Overview

The x64dbg_mcp server provides comprehensive AI-powered debugging capabilities by integrating with the x64dbg debugger. It consists of a C++ plugin running inside x64dbg as a REST API server and a TypeScript MCP server implementing the protocol over stdio. This architecture allows AI assistants like Claude, Cursor, and Windsurf to control debugging operations, analyze code, and perform reverse engineering tasks through 151 endpoints organized into 23 mega-tools covering debugger control, CPU/memory operations, code analysis, breakpoints, tracing, symbols, process inspection, and dumping capabilities.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• x64dbg_debug

  Control execution flow and query debugger state

  Try:Run the programTry:Pause executionTry:Step into the next instruction
• x64dbg_command

  Execute raw x64dbg commands, batch scripts, and expression evaluation

  Try:Evaluate expressionTry:Execute debugger commandTry:Run initialization script
• x64dbg_registers

  Read/write CPU registers including GPR, flags, and AVX-512

  Try:Show all registersTry:Set the value of RAXTry:Get current flags status
• x64dbg_memory

  Full memory operations: read, write, allocate, protect, and memory map

  Try:Read 128 bytes at addressTry:Write NOPs to memoryTry:Allocate a new memory page
• x64dbg_disassembly

  Disassemble instructions, whole functions, or assemble new code

  Try:Disassemble current functionTry:Show instructions at addressTry:Assemble new instructions
• x64dbg_analysis

  Cross-references, function boundaries, basic blocks, source mapping

  Try:Show cross-references to this functionTry:Get function boundariesTry:Find basic blocks
• x64dbg_breakpoints

  Full breakpoint management: software, hardware, memory, conditional, logging

  Try:Set breakpoint on CreateFileWTry:Configure logging breakpointTry:List all breakpoints
• x64dbg_symbols

  Symbol resolution, labels, comments, bookmarks

  Try:Resolve symbol addressTry:Set label for addressTry:Get comment at address
• x64dbg_search

  AOB/byte pattern scan, string search, symbol autocomplete

  Try:Search for byte patternTry:Find string in memoryTry:Search for symbols
• x64dbg_process

  Process info, PID, PEB, elevation status, debugger version

  Try:Get process informationTry:Show PEB dataTry:Check if process is elevated
• x64dbg_threads

  Thread enumeration, TEB access, thread control

  Try:List all threadsTry:Switch to thread IDTry:Get thread information
• x64dbg_dumping

  PE analysis, module dumping, IAT reconstruction, patch file export

  Try:Dump main module to diskTry:Get PE header informationTry:Export patch file

Comparable tools

Installation

x64dbg/
  x64/plugins/x64dbg_mcp.dp64    <-- for 64-bit debugging
  x32/plugins/x64dbg_mcp.dp32    <-- for 32-bit debugging

{
  "mcpServers": {
    "x64dbg": {
      "command": "npx",
      "args": ["-y", "x64dbg-mcp-server"]
    }
  }
}

FAQ

Which AI clients are compatible with x64dbg_mcp?

The server works with Claude Code, Claude Desktop, Cursor, Windsurf, Cline, and any other MCP-compatible client that supports stdio transport.

How does the communication between the MCP server and the plugin work?

The TypeScript MCP server communicates with the C++ plugin via HTTP localhost (127.0.0.1:27042). The plugin exposes 151 REST endpoints that the MCP server routes requests to through stdio transport.

Compare x64dbg_mcp with