duty1g put x64dbg behind MCP as a native plugin and wrote it in Zig. The launch post calls it "fully automated, dynamic, agentic reverse engineering for x64dbg" and counts 71 MCP tools, 22 debugger event callbacks, zero dependencies, Streamable HTTP + SSE, x32 + x64.
Nothing to install on the analysis box
"No .NET, no Python, no runtime" is the line in the README, and on a machine you use to look at malware that matters more than any feature in the list. Analysis VMs rot the moment you start adding interpreters to them. This one is a single native plugin that auto-starts with x64dbg and speaks HTTP. The configuration dialog will bind to 0.0.0.0 to "listen on all interfaces (for WSL/remote access)" if your agent lives on the other side of WSL, and it takes one click to keep it on 127.0.0.1 instead, which is where mine stays inside an offline VM.
Live process, not a dump
mrexodia wrote x64dbg, and he also wrote ida-pro-mcp, the static reference implementation everybody else has been copying. A debugger plugin reaches what static tooling structurally cannot: OEP detection, module dumping, PEB and SEH inspection. The callbacks are republished as events too, so the agent hears about a breakpoint instead of polling for one.
As such, it goes on my machine. In a VM, bound to localhost, with no other MCP servers in the same session.