{"slug":"mq1n/ghostmcp","name":"GhostMCP","description":"Injectable MCP server for AI-driven reverse engineering inside processes","category":"development","tags":[],"official":false,"stars":23,"transport":"stdio","install":null,"tools":[{"name":"read_memory","description":"Read memory from a target process with automatic type conversion"},{"name":"write_memory","description":"Write memory to a target process with automatic type conversion"},{"name":"enumerate_regions","description":"Enumerate memory regions with protection flags"},{"name":"pattern_scan","description":"Scan memory for AOB patterns with wildcard support"},{"name":"resolve_pointer_chain","description":"Resolve pointer chains for complex data structures"},{"name":"aob_scan","description":"Array of Bytes scanning with wildcard support"},{"name":"string_scan","description":"Scan memory for ASCII, Unicode, and UTF-8 strings"},{"name":"regex_scan","description":"Byte-level regex pattern matching"},{"name":"yara_scan","description":"Load and run YARA rules against memory"},{"name":"manage_signatures","description":"Store, import, and export named patterns in signature databases"},{"name":"dump_full_process","description":"Capture all committed memory regions of a process"},{"name":"dump_region","description":"Dump a specific address range from memory"},{"name":"dump_module","description":"Extract DLLs/EXEs with PE reconstruction"},{"name":"create_minidump","description":"Create a minidump in WinDbg-compatible format"},{"name":"incremental_dump","description":"Track changes between memory snapshots"},{"name":"binary_diff","description":"Compare dumps to find modifications"},{"name":"search_dump","description":"Search within dumps using AOB patterns"},{"name":"annotate_dump","description":"Bookmark and label interesting locations in dumps"},{"name":"reconstruct_pe","description":"Rebuild import tables with Scylla-style reconstruction"},{"name":"catalog_dumps","description":"Organize and manage multiple dumps"},{"name":"scan_value","description":"Perform Cheat Engine-style value scanning with 12 scan modes"},{"name":"iterative_scan","description":"Refine scan results across multiple scans"},{"name":"filter_scan","description":"Smart filtering for writable, executable, module-only, or custom ranges"},{"name":"fast_scan","description":"Alignment-based skipping for 4x+ speedup"},{"name":"track_scan_progress","description":"Real-time progress tracking with cancellation"},{"name":"export_scan_results","description":"Export scan results as JSON, CSV, or Cheat Engine XML"},{"name":"scan_pointers","description":"Multi-level pointer scanning with configurable depth"},{"name":"filter_static_pointers","description":"Filter to module-relative pointers that survive restarts"},{"name":"constrain_offsets","description":"Set max offset and alignment constraints for pointer scans"},{"name":"rescan_pointers","description":"Validate pointer paths after process restart with stability scoring"},{"name":"score_stability","description":"Track pointer validity across rescans (0.0-1.0 score)"},{"name":"compare_pointer_sessions","description":"Find common valid pointers between scan sets"},{"name":"resolve_pointer","description":"Follow pointer chains and read values at resolved addresses"},{"name":"export_pointers","description":"Export pointer results as JSON, CSV, or Cheat Engine .ptr format"},{"name":"paginate_pointers","description":"Paginate large pointer result sets with configurable limits"},{"name":"track_pointer_progress","description":"Real-time progress tracking with cancellation for pointer scans"},{"name":"disasm_at","description":"Disassemble code at a specific address using Capstone engine"},{"name":"disasm_function","description":"Disassemble an entire function"},{"name":"decompile","description":"Generate Hex-Rays style pseudo-C decompilation"},{"name":"list_modules","description":"List all DLLs with their exports and imports"},{"name":"resolve_symbols","description":"Load PDB symbols with DbgHelp and full stack walking"},{"name":"find_cross_references","description":"Find all CALL/JMP/LEA references to an address"},{"name":"extract_strings","description":"Pull ASCII/Unicode strings from any module"},{"name":"set_software_breakpoint","description":"Set INT3 breakpoint with automatic byte restoration"},{"name":"set_hardware_breakpoint","description":"Set hardware breakpoint via DR0-DR3 debug registers"},{"name":"single_step","description":"Execute instruction-by-instruction using trap flag"},{"name":"list_threads","description":"List all threads in the target process"},{"name":"suspend_thread","description":"Suspend a specific thread"},{"name":"resume_thread","description":"Resume a specific thread"},{"name":"read_registers","description":"Read all x64 registers (RAX-R15, RIP, RFLAGS)"},{"name":"write_registers","description":"Write to x64 registers"},{"name":"walk_stack","description":"Walk the call stack with symbol resolution"},{"name":"assemble_code","description":"Assemble and execute arbitrary code inside the target process"}],"env_vars":[],"auth_type":"none","github":"https://github.com/mq1n/GhostMCP","homepage":"","server_url":"","status":"active","source":"mcpservers.org","updated_at":"Mon May 25"}