pyghidra-scripting
Installation
SKILL.md
PyGhidra scripting via ReVa
ReVa exposes five MCP tools under the scripts provider that let an assistant write, edit, run, and inspect Python scripts inside the same Ghidra session ReVa is serving. The Python code runs under PyGhidra (CPython 3 + JPype), so it has the full Ghidra Java API available — the FlatProgramAPI, DecompInterface, FunctionManager, everything.
This skill teaches when to reach for these tools, how to structure the Python you send to run-script, and the pitfalls that bite in practice.
The five tools at a glance
| Tool | Purpose | Use when |
|---|---|---|
run-script |
Execute Python against a program. Inline code, or by scriptPath / scriptName. |
The dedicated ReVa MCP tools don't cover what you need, or you want one tight pass over the program. |
list-scripts |
Enumerate scripts across registered directories. Filterable by name/path; paginated. | Discovering what's already saved before writing a new one. |
read-script |
cat -n view of a script with offset / limit and a truncated flag. |
Reading an existing script before editing it. The numbered output is what edit-script lines up against. |
write-script |
Create a new .py file (or full overwrite with overwrite: true). User-writeable dirs only. |
Saving a reusable script. Never reach for this just to bundle inline code — use run-script with code for one-shot use. |
edit-script |
old_string → new_string replacement. Errors if old_string matches multiple places unless replace_all: true. |
Iterating on an existing script. Pair with read-script to see line context first. |
Reach-for-it triggers
run-script is the escape hatch. Use it when: