x64dbg-mcp
Production-level Model Context Protocol server for x64dbg reverse engineering and debugging
Versions
1.3.1latest1.1.31.1.21.1.1Tools 38
disassemble Disassemble instructions starting at an address or symbol.
analyze_function Analyze a function: boundaries, size, instruction count, call graph, and isLeaf flag.
get_cross_references Find all cross-references (xrefs) to or from an address.
list_functions List all recognized functions in the debuggee: address, name, size, module.
get_modules List all modules (main EXE + loaded DLLs): name, path, base address, size, entry point, sections.
get_imports List imported functions for a module: importing DLL name, function name, ordinal, IAT address.
get_exports List exported functions/symbols from a PE module's export table: name, ordinal, address, forwarder.
find_strings Find ASCII and Unicode strings in the debuggee's mapped memory.
get_pe_header Parse the PE header of a loaded module.
load_executable START HERE. Load a PE executable (.exe or .dll) and create a debugging session.
attach_to_process Attach to a running process by PID and create a debugging session.
continue_execution Resume a paused debuggee. Runs until the next breakpoint, exception, manual pause, or process exit.
pause_execution Interrupt a running debuggee. No-op if already paused — returns current state immediately.
step_into Single-step N instructions, following CALL instructions into callees.
step_over Single-step N instructions, treating each CALL as a single step (does not enter callees).
step_out Run until the current function returns (executes to its matching RET instruction).
terminate_session Stop the debuggee process and close the debugging session.
detach_session Detach the debugger from the process without killing it — the target process continues running.
wait_for_state Block until the session reaches a target state, then return a full snapshot.
get_status Query the current session/debugger state. Always safe — never changes debugger state.
list_sessions List all active debugging sessions: id, state, pid, architecture, executable, breakpointCount.
close_debugger Terminate all sessions and kill all tracked x64dbg/x32dbg processes.
collect_bp_args Loop: continue execution → hit breakpoint → read a memory expression → repeat N times.
execute_command Execute a raw x64dbg script command synchronously and return its console output.
read_memory Read raw bytes from the debuggee's virtual address space.
write_memory Patch bytes in the debuggee's virtual memory.
search_memory Search the debuggee's virtual memory for a byte pattern or string.
get_memory_map List all virtual memory regions of the debuggee process:
get_registers Read CPU register values of the active thread. REQUIRES: state='paused'.
get_call_stack Get the call stack (backtrace) of the current thread. REQUIRES: state='paused'.
get_threads List all threads in the debuggee process: TID, handle, entry address, TEB, state, priority, name.
save_memory_dump Dump a raw memory region from the debuggee to a file on disk.
create_minidump Create a Windows minidump (.dmp) of the debuggee process for offline analysis.
detect_packing Scan a PE module for signs of packing or obfuscation.
analyze_suspicious_apis Cross-reference the module's import table against a database of Windows APIs commonly used by malware.
detect_anti_debug Scan the module for common anti-debugging techniques.
check_section_anomalies Check PE sections for structural anomalies.
generate_security_report START HERE for malware triage. Run all four security checks in parallel and produce a consolidated report.
Permissions 4
network medium filesystem low shell high env_vars low