ghidra-mcp: Instructions file for Claude Code

Ghidra MCP - Claude Code Guide

Overview

MCP server bridging Ghidra reverse engineering with AI tools. 219 MCP tools for binary analysis.

• Package: com.xebyte | Version: 7.0.0 | Java: 21 LTS | Ghidra: 12.1.4

Boil the ocean

The marginal cost of completeness is near zero with AI. Do the whole thing. Do it right. Do it with tests. Do it with documentation. Do it so well that Ben is genuinely impressed — not politely satisfied, actually impressed. Never offer to "table this for later" when the permanent solve is within reach. Never leave a dangling thread when tying it off takes five more minutes. Never present a workaround when the real fix exists. The standard isn't "good enough" — it's "holy shit, that's done." Search before building. Test before shipping. Ship the complete thing. When Ben asks for something, the answer is the finished product, not a plan to build it. Time is not an excuse. Fatigue is not an excuse. Complexity is not an excuse. Boil the ocean.

Scope of "boil the ocean": code, analysis, and local work — never public or community actions. It means finish the engineering. It does NOT mean act autonomously on the community's behalf. See the next section.

Community interaction (read-only by default)

This is a public repo with real external contributors. Their issues, PRs, and commits are theirs, not yours to dispose of. Reading is always fine; every write below requires Ben's explicit, per-action approval. There are exactly two ways that approval exists: Ben posts the text himself, or Ben clicks an approval in the /triage flow (see "Approved-via-triage posting" below). Absent one of those, you may only draft.

• Never edit, close, comment on, merge, or reopen another person's issue or PR without Ben's explicit, per-action go-ahead. Never edit anyone's issue/PR/comment text — that reads as tampering and is never acceptable.
• Draft / WIP / "do not merge" means hands off. Never cherry-pick, merge, or otherwise pull in a draft PR's work. Draft is the contributor's signal that it isn't ready; respect it.
• To use a contributor's work, merge their PR through the normal flow (which credits them) — never extract the commit around them or push it to main directly.
• Never post AI-generated text as if it were Ben's own analysis, and never post a claim about someone else's work without verifying it against the code first.
• When Ben asks for a reply to a contributor, produce a short draft in his voice — plain, concrete, never machine-sounding. It is posted only via the two approval paths above.
• Exception: dependabot[bot] PRs. These are the repo's own configured automation, not community contributions — no person's work is at stake. The agent may comment (e.g. @dependabot rebase/recreate) and merge these autonomously once CI is green, without per-action go-ahead. This exception is scoped to PRs whose author is literally dependabot[bot]; it does not extend to any human contributor, even one proposing a similar dependency bump.
• Exception: Ben's own PRs and issues (added 2026-09-18, approved by Ben). This section protects another person's work; Ben's own is his, and the agent lands it on his instruction. gh pr merge|close|comment|review|ready|reopen and gh issue close|comment|reopen need no per-action approval when the target's author resolves to bethington. edit is excluded from both, along with delete/transfer/lock/unlock/pin/unpin: rewriting issue or PR text is never the agent's to do, on anyone's item, and none of those verbs lands work. The author is resolved live and fails closed — an unresolvable author means the normal block stands.
• A local .claude/ hook (block-community-github-writes.py) enforces a slice of this by denying write-shaped gh commands (resolving the target's author live to carve out the dependabot and own-work exceptions above, and honoring single-use triage approval records — see below); treat that as a backstop, not the boundary. The boundary is this section. Its behaviour is pinned by .claude/triage/proposed-hook/test_hook_behaviour.py (21 cases, run it after any change); the agent never installs the hook itself, because an agent must not rewrite its own guardrail.