Huda (@AlAssaf_H) on X

What it is

A static source review, dated 19 October 2026, of three reverse-engineering MCP bridges: x64dbg-MCP, LaurieWired/GhidraMCP and IDA Pro MCP. The author did no dynamic exploitation or lab reproduction and claims no new CVE. The value is in the per-version and per-mode findings, which show where advisory text and current code disagree.

How it works

x64dbg-MCP. GHSA-4478-h5jv-647m (August 2026) covers missing authentication on the HTTP/SSE interface, which exposed process attachment, x64dbg command execution and memory read/write. The default bind was 0.0.0.0. GHSA-jgj3-97w2-9v9r is separate: the receive path handled Content-Length before the Bearer-token check. An oversized declared length overflowed the arithmetic in safety-checked Zig builds and panicked the process, which killed x64dbg. It is a DoS, not a demonstrated memory-corruption or code-execution primitive. It was reported fixed in v1.2.

Tag comparison for x64dbg-MCP:

The advisory names 1.0 as the patched version, yet the 1.0 tag source lacks the authentication changes. The author does not claim every published 1.0 binary was vulnerable.

GhidraMCP. The March 2026 audit (issue #141) described a port-only InetSocketAddress that binds the wildcard interface, plus missing authentication and prompt injection via binary content. The current extension/src/main/java/com/lauriewired/ghidramcp/http/BackendHttpServer.java binds with InetAddress.getLoopbackAddress(). It rejects requests carrying an Origin header and checks Host against permitted local names. The Python frontend defaults to loopback. Mutation tools remain: renaming functions, variables and data labels, changing prototypes and local variable types, and writing decompiler and disassembly comments.

IDA Pro MCP. The headless idalib server removes @unsafe tools unless --unsafe is passed, and --profile restricts the tool set. The repository tests show py_eval and py_exec_file in the GUI plugin's default registry. So "unsafe tools off by default" holds only for headless mode. The GUI plugin has configurable enabled tools and a browser-origin policy.

Preconditions / Affected

• x64dbg-MCP: tag 1.0 and v1.1 default to 0.0.0.0, and 1.0 has no token check. Reachability still depends on network topology and firewall policy. Only v1.2 combines token authentication with a loopback default and the reported Content-Length fix.
• GhidraMCP: reports based on the March 2026 audit describe superseded code.
• IDA Pro MCP: exposure depends on GUI versus headless mode and on the active tool restrictions.

What to do

• Verify the actual tag or binary you run, not the advisory's version label. For x64dbg-MCP, use v1.2 or later.
• Treat loopback binding and origin filtering as reducing reachability, not as client authorization. Local processes can still reach the service.
• For IDA Pro MCP, check which tools your mode registers, and restrict the GUI plugin's list or use headless without --unsafe.
• Treat decompiler and string output from hostile samples as untrusted data. Scope and audit write-capable tools separately from read-only ones.

Caveats

The author states that a string in a binary does not prove successful prompt injection, and the reviewed GhidraMCP issues (#140 and others) show no universal reproducible agent compromise. The 1.0 tag discrepancy is a source-versus-metadata observation, not proof about shipped binaries.