🎮 mcp-gamehacking
The MCP server that turns Claude, Codex, and Cursor into a reverse-engineering team.
111 MCP tools · 59 RE/debug backends · 4,200+ skills · multi-agent mesh · zero-dep native parsers
Quickstart · Architecture · Comparison · Agent Mesh · MCP Hub · Ethics
Why this exists
Reverse engineering a modern game involves five static tools (Ghidra, IDA, Binary Ninja, radare2, Hopper), three debuggers (x64dbg, WinDbg, GDB/LLDB), a hex-editor, a memory scanner (Cheat Engine), an instrumentation framework (Frida), and a stack of format parsers (PE, ELF, Mach-O, DEX, Minidump, Unity AssetBundle, UE .pak). Switching between them costs hours. Teaching a model to drive even one of them well costs more.
This server:
- Aggregates 59 existing RE / debug MCP backends behind one connection —
smart_decompilepicks IDA when running, falls back to Ghidra, then Binja, then RetDec. - Ships 111 native MCP tools so most answers don't need an external backend at all — PE / ELF / Mach-O / DEX / WASM / Minidump / ZIP / .NET / IL2CPP metadata parsers, AoB signature scan, Shannon entropy, crypto-constant identification, PDB70 → Microsoft symbol server URL.
- Lets Claude, Codex, and Cursor collaborate through a shared mesh — DM, channels, task handoff, adversarial voting, shared KV knowledge-base, named locks for coordination. Zero-dep JSON persistence.
- Curates 4,200+ skills — 246 hand-written deep references on anti-cheat (BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron, Ricochet, mhyprot) and 3,985 archived open-source projects with full source dumps.
If you're on security-research, cheat-detection, defensive-engineering, or game-SDK work — this collapses a day of tool-shuffling into one MCP connection.
30-second quickstart
# clone + build
git clone https://github.com/whory/mcp-gamehacking && cd mcp-gamehacking
npm install && npx tsc
npm test # 20/20 should pass
# wire into Claude Code / Codex / Cursor (stdio mode)
# (add this JSON to your client's MCP config)
# { "mcp-gamehacking": { "command": "node", "args": ["/path/to/dist/index.js"] } }
# OR run over HTTP (Docker-friendly)
docker compose up
# OR drive it from the CLI (no MCP client needed)
./bin/mcp-gamehacking.mjs stats
./bin/mcp-gamehacking.mjs search battleye
./bin/mcp-gamehacking.mjs tools # list every registered MCP tool
Point your MCP client at it, then ask any of:
- "Analyze
C:\game\binary.exeand tell me what packer it uses." → callsanalyze_binary(entropy + Rich Header + Debug Directory + imports + crypto constants) - "Decompile
0x401000using every connected backend and spot disagreements." →hub_consensus_call matcher=decompile - "Alice, hand off driver.sys unpacking to Bob; Cursor review the result." → mesh orchestration
- "BM25 search 'battleye shellcode detection'." →
bm25_searchranks 4,230 docs by BM25 relevance
Architecture
flowchart LR
subgraph clients[" MCP clients "]
C1[Claude Code]
C2[Codex / ChatGPT]
C3[Cursor]
C4[Copilot CLI]
C5[custom]
end
subgraph server[" mcp-gamehacking (this repo) "]
direction TB
T[111 MCP tools]
M[Agent Mesh<br/>DM · channels · tasks · votes · KB · locks]
H[MCP Hub<br/>smart_decompile · consensus_call]
N[Native parsers<br/>PE · ELF · Mach-O · DEX · WASM · Minidump · ZIP · .NET]
S[Skill library<br/>4,200+ docs · BM25]
end
subgraph backends[" 59 RE / debug MCP backends "]
B1[Ghidra · IDA · Binja]
B2[x64dbg · WinDbg · GDB · LLDB]
B3[Cheat Engine · Frida]
B4[PCILeech · Memflow]
B5[Volatility · YARA · angr]
end
C1 & C2 & C3 & C4 & C5 -->|stdio or HTTP| server
server -->|hub_connect| B1 & B2 & B3 & B4 & B5
Verticals
The game-hacking framing is historical — the tooling covers every RE discipline:
Comparison
Ethics & responsible use
This project exists for security research, cheat detection, defensive engineering, game-preservation, and reverse-engineering education. Specifically:
- Anti-cheat engineers use it to understand bypass vectors and harden their systems.
- Red teams use it on binaries they are authorized to analyze.
- Students use it to learn how PE / ELF / IL2CPP / UE4 / Source2 actually work.
- Preservation groups use it to document archived game ecosystems.
It is not a cheat. It writes no code into any game. It automates no play. Use it against binaries you own or are authorized to analyze. Do not use it to grief, de-fraud, or harm other players.
Read SECURITY.md for responsible disclosure. By contributing you agree to CODE_OF_CONDUCT.md.
Features
Skill Library
- 177 hand-written skills -- deep technical references on injection, hooking, kernel drivers, anti-cheat internals, ESP/aimbot architecture, and more
- 3,985 archived projects -- full source code snapshots from the game security ecosystem (prefixed
ags-) - Each skill has a
SKILL.md(description, metadata, topics) and optionally asource.txt(complete source tree dump)
Agents
Subagents (161)
Plugins (114)
Prompts (148)
Tools (111 total)
Workflow Tools
Skill Tools
Component Tools
RE / Debug MCP Integrations (v4.1)
Launch and drive 43 external RE and debugging MCP servers directly from this server. Supported backends: GhidraMCP, SuperghidraMCP (pyghidra-mcp, +gui), Ghidrathon MCP, ida-pro-mcp, Hex-Rays IDA MCP, Binary Ninja MCP, radare2 MCP, x64dbg MCP Server, WinDbg MCP, Cheat Engine MCP, Frida MCP, Hopper MCP, REA, Vibe-RE, JADX MCP, angr MCP, Capstone MCP, PCILeech/MemProcFS MCP, Memflow MCP, Scylla MCP, dnSpyEx MCP, ReClass.NET MCP, Volatility3 MCP, Wireshark/tshark MCP, mitmproxy MCP, dotPeek MCP, Unicorn MCP, ret-sync MCP, BinDiff MCP, Diaphora MCP, Qiling MCP, unidbg MCP, Reko (OpenReality) MCP, QEMU trace MCP, LLDB MCP, GDB MCP, Burp MCP, YARA MCP, ClrMD MCP, Binja-Ghidra sync MCP, Dolphin DME MCP, Cemu IPC MCP.
Native TypeScript RE Tools (always available)
Zero-dependency Node TypeScript. No Python, no Ghidra, no IDA needed.
Vendored tool trees live under tools/vendor/ (currently vibe-re, ida-pro-mcp). External backends install via install_re_backend or describe_re_backend → "Install" section. tools/launchers/install-all.{ps1,sh} bootstraps every pip/npm backend in one shot.
Advanced Native Parsers
Workflow Tools
Agent Mesh — multi-agent collaboration
Lets Claude Code, Codex/ChatGPT, Cursor, Copilot, Gemini CLI and custom bots share one workspace through MCP: register, DM + channel broadcast, task handoff with status machine, adversarial voting on findings, shared KV knowledge base, named locks. Persistence to JSON (zero npm deps). See docs/agent-mesh.md.
Tools (15): mesh_agent_register, mesh_agent_list, mesh_agent_heartbeat, mesh_send, mesh_read, mesh_task_create, mesh_task_update, mesh_task_list, mesh_task_vote, mesh_kb_set, mesh_kb_get, mesh_lock_acquire, mesh_lock_release, mesh_lock_list, mesh_stats.
MCP Hub — aggregate backend MCPs
Our server connects to other MCPs (ghidra, ida, x64dbg, binja, radare2, cheat-engine, frida, …) as a CLIENT and re-exposes their tools. Composable: smart_decompile picks the first available decompiler backend; hub_consensus_call fans out across backends for adversarial comparison. See docs/mcp-hub.md.
Tools (6): hub_connect, hub_list, hub_call, hub_disconnect, smart_decompile, hub_consensus_call.
CLI
mcp-gamehacking stats # library counts
mcp-gamehacking lookup battleye # print SKILL.md
mcp-gamehacking search anti-cheat # keyword search
mcp-gamehacking tools # list every MCP tool
mcp-gamehacking health [url] # probe /healthz
mcp-gamehacking serve # start the MCP server
Path sandbox (security)
File-reading tools (pe_parse, elf_parse, aob_scan, zip_parse, …) obey MCP_FS_ALLOW and MCP_FS_DENY. Default is open mode. Set MCP_FS_ALLOW=/path/a,/path/b to restrict reads when exposing the server over HTTP.
HTTP transport, health, metrics
Set MCP_TRANSPORT=http to run the server over Streamable HTTP instead of stdio:
MCP_TRANSPORT=http MCP_HTTP_PORT=7777 MCP_HTTP_HOST=127.0.0.1 node dist/index.js
# → MCP endpoint: POST http://127.0.0.1:7777/mcp
# → readiness: GET http://127.0.0.1:7777/healthz
# → Prometheus: GET http://127.0.0.1:7777/metrics
Tests
npm test
Node's built-in test runner over tests/*.test.mjs (17 cases covering pattern parse, AoB scan, Shannon, string extraction, crypto-constant ID, signature make, PE parse, WASM parse, ELF rejection).
CI runs on push + PR (Node 18/20/22 matrix): .github/workflows/ci.yml.
Installation
Requirements
- Node.js 18+
- npm
Build
cd mcp-gamehacking
npm install
npm run build
Connect to Claude Code
Add to your MCP settings:
{
"mcpServers": {
"gamehacking": {
"command": "node",
"args": ["/path/to/mcp-gamehacking/dist/index.js"]
}
}
}
Connect to Claude Desktop
Add to claude_desktop_config.json:
{
"mcpServers": {
"gamehacking": {
"command": "node",
"args": ["/path/to/mcp-gamehacking/dist/index.js"]
}
}
}
Connect to Cursor
Add to .cursor/mcp.json:
{
"mcpServers": {
"gamehacking": {
"command": "node",
"args": ["/path/to/mcp-gamehacking/dist/index.js"]
}
}
}
Usage Examples
Research a technique
> research_technique("EPT hook")
Found 12 relevant skills (showing top 10):
- ags-budget-ept (score:7) -- BudgetEPT: stealthy inline EPT-like hooks...
- ags-hyper-deceit (score:6) -- HyperDeceit: HvcallCodeVa hook framework...
Analyze a project
> analyze_project("ags-kdmapper", focus="architecture")
# kdmapper
Most popular kernel driver mapper using iqvw64e.sys...
## Source Code (first 300 lines)
...
Search skills
> search_skills("valorant vanguard bypass")
Found 23 skills:
- vgk-internals-callbacks (score:7)
- ags-valorant-external (score:4)
Agent briefing
> get_agent_briefing("exploit-developer")
# Agent: exploit-developer
Kernel exploit and driver development agent...
## Available Subagents: offset-finder, detection-assessor
## Available Plugins: game-offset-db, technique-finder
Project Structure
mcp-gamehacking/
+-- src/index.ts # MCP server (16 tools)
+-- dist/ # Compiled JS
+-- skills/ # 4,161 skill directories
| +-- <hand-written>/ # 177 curated deep-dive skills
| +-- ags-*/ # 3,985 archived projects
| +-- SKILL.md # description + metadata
| +-- source.txt # full source tree snapshot
+-- agents/ # 75 agents across 7 categories
| +-- games/ (15) # CS2, Valorant, Fortnite, Apex, etc.
| +-- engines/ (10) # UE4/5, Unity, Source, CryEngine, etc.
| +-- anti-cheat/ (10) # EAC, BE, Vanguard, FACEIT, Byfron, etc.
| +-- kernel/ (10) # drivers, HV, firmware, DMA, EPT
| +-- techniques/ (10) # injection, hooking, obfuscation, etc.
| +-- tools/ (10) # IDA, Ghidra, WinDbg, Frida, x64dbg
| +-- core/ (10) # RE, exploits, cheatdev, malware, etc.
+-- subagents/ # 161 subagents across 16 categories
| +-- offsets/ (10) +-- patterns/ (10)
| +-- code-analysis/(10) +-- anti-cheat/ (11)
| +-- kernel/ (10) +-- injection/ (10)
| +-- hooks/ (10) +-- rendering/ (10)
| +-- memory/ (10) +-- network/ (10)
| +-- game-data/ (10) +-- stealth/ (10)
| +-- reversing/ (10) +-- platform/ (10)
| +-- build/ (10) +-- testing/ (10)
+-- plugins/ # 114 plugins across 11 categories
| +-- game-offsets/ (11) +-- engine-sdks/ (10)
| +-- anti-cheat/ (10) +-- windows-int/ (10)
| +-- technique-ref/(13) +-- tool-finders/ (10)
| +-- code-gen/ (10) +-- binary-anal/ (10)
| +-- crypto/ (10) +-- detection/ (10)
| +-- rendering/ (10)
+-- prompts/ # 148 prompts across 14 categories
| +-- build/ (11) +-- write/ (16)
| +-- implement/ (11) +-- reverse/ (10)
| +-- bypass/ (10) +-- analyze/ (10)
| +-- design/ (10) +-- exploit/ (10)
| +-- compare/ (10) +-- debug/ (10)
| +-- generate/ (10) +-- migrate/ (10)
| +-- optimize/ (10) +-- setup/ (10)
+-- package.json
+-- tsconfig.json
Skill Categories
Hand-Written (177)
Archived Projects (3,985)
Sourced from awesome-game-security:
- 60+ games: CS2, Valorant, Fortnite, Apex, PUBG, Rust, R6, EFT, Overwatch, Genshin, etc.
- Techniques: injection, hooking, DMA/FPGA, driver comm, overlays, kernel exploits
- Anti-cheat research: BattlEye, EAC, Vanguard, VAC, FACEIT, Byfron
- Tools: IDA plugins, Ghidra scripts, debugger extensions, dumpers, unpackers
- Platforms: Windows kernel, Android (Zygisk/KernelSU/Magisk), iOS, Linux
Tech Stack
- Runtime: Node.js 18+
- Language: TypeScript
- Protocol: MCP via
@modelcontextprotocol/sdk - Transport: stdio
License
This project aggregates publicly available research materials and open-source project snapshots for educational and security research purposes.
mcp-gamehacking (RU)
MCP-сервер для геймхакинга и реверс-инжиниринга. База знаний из 4,100+ скиллов с полными архивами исходного кода, специализированными агентами и инструментами.
Возможности
- 177 вручную написанных скиллов -- инъекции, хуки, ядерные драйверы, внутренности античитов, архитектура ESP/аимбота
- 3,985 архивированных проектов -- полные снимки исходного кода из экосистемы игровой безопасности
- 75 агентов (7 категорий) -- по играм (CS2, Valorant, Fortnite, Apex...), движкам (UE, Unity, Source, CryEngine...), античитам (EAC, BE, Vanguard, FACEIT...), ядру (драйверы, HV, DMA, EPT), техникам (инъекции, хуки, обфускация), инструментам (IDA, Ghidra, WinDbg, Frida)
- 161 субагент (16 категорий) -- поиск офсетов, анализ кода, паттерны, диффы бинарников, grep по 3985 архивам, планирование хуков, восстановление структур, аудит драйверов, стелс, рендеринг, сеть и ещё 145
- 114 плагинов (11 категорий) -- базы офсетов по 10+ играм, справочники SDK, каталог уязвимых драйверов, детект-базы по каждому античиту, генераторы кода, анализаторы бинарников, крипто, рендеринг
- 148 промптов (14 категорий) -- байпасс каждого античита, билд ESP/аимбота/триггера, реверс Unity/UE/Source игр, написание драйверов/инжекторов/оверлеев, эксплуатация, HWID спуф, миграция, оптимизация, дизайн
- 16 MCP-инструментов -- воркфлоу-тулы, скиллы, компоненты
Установка
npm install
npm run build
Добавьте в настройки MCP-клиента:
{
"mcpServers": {
"gamehacking": {
"command": "node",
"args": ["/path/to/mcp-gamehacking/dist/index.js"]
}
}
}
Категории скиллов
- Ядро / Драйверы: CR3, SSDT, уязвимые драйверы, BYOVD
- Инъекции: рефлективная DLL, manual map, APC, thread hijack
- Античиты: Vanguard, BattlEye, EAC, PatchGuard, HVCI
- Игровые движки: Unreal, Source, Unity -- офсеты, нетвары, w2s
- Обфускация: VMProtect, Themida, OLLVM -- распаковка и деобфускация
- UEFI / EFI: буткиты, EFI-маперы, спуф SecureBoot
- DMA / FPGA: прямой доступ к памяти, IOMMU
- 60+ игр: CS2, Valorant, Fortnite, Apex, PUBG, Rust, R6, EFT и др.
Лицензия
Проект агрегирует публично доступные исследовательские материалы и open-source проекты в образовательных целях и для исследований безопасности.