x64dbg-MCP Server

Install

Manual install

{
  "mcpServers": {
    "x64dbg": {
      "type": "http",
      "url": "http://localhost:9094/",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

This is third-party code. Review the repository files before installing.

What it does

The plugin loads into the x64dbg debugger and exposes its functions over MCP on top of HTTP, so a connected agent drives debugging programmatically. Through a set of tools the agent loads an executable or attaches to a process, sets software and hardware breakpoints, steps through instructions, reads registers, the call stack, modules and threads, disassembles code and searches memory for strings. It has reverse-engineering tools: finding the entry point after unpacking, dumping a module, PE analysis, reading function arguments and tracing. Memory can be read and also patched, and every tool response carries a debugger state line and a queue of events. The plugin is written in Zig, builds into a single dependency-free binary for x32 and x64, supports streamable HTTP and SSE transports, and requires a Bearer token on every request.

Who it is for. For reverse engineers, malware analysts and security researchers who work in x64dbg and want to drive debugging through an agent.

Example request

Load calc.exe, break at the entry point and show the current registers

Limitations

The plugin runs inside x64dbg, which means Windows, and needs the debugger installed. By default the server binds to 0.0.0.0, so when reachable over the network anyone with the token controls the debugger, so the token must be protected and the bind address limited. There is no npm or PyPI package: install by copying the built plugin into the x64dbg folder or by building from the Zig source. The tool grants full control over the debugged process, including memory writes and patches.

How to disable. Remove the plugin files from the x64dbg folder and restart the debugger. Delete the server entry from the MCP client configuration.

MCP

Transport

http, sse

Authentication

API key

Security check

• Grants full control over the debugged process: memory reads and writes, patches, arbitrary debugger commands
• The server listens on all interfaces by default and access is guarded only by a token

README in short

The README presents the plugin as a native MCP server for x64dbg that exposes debugger functions over HTTP and lets any compatible agent drive debugging: breakpoints, stepping, memory reads, register dumps and more. The plugin is built in Zig, dependency-free, into a single binary that cross-compiles to x32 and x64 from any host. It supports streamable HTTP and SSE transports and requires Bearer token authentication, generated on first run. The server starts automatically when x64dbg launches, and ports and token change in the config dialog. MIT licensed.

Related