Supercharging Reverse Engineering: Using VS Code to Orchestrate Ghidra and HexStrike AI

06 May 2026

HexStrike AI Set-up:

Clone the Repository:

git clone https://github.com/0x4m4/hexstrike-ai.git

cd hexstrike-ai

Create a Virtual Environment:

python3 -m venv hexstrike-env

source hexstrike-env/bin/activate

Install Dependencies:

pip3 install -r requirements.txt

Launch the Server:

HexStrike usually runs on http://127.0.0.1:8889.

Verify it’s healthy by running: curl http://127.0.0.1:8889/health

Connect

Tab 1: Start the Core API Server This is the part that actually runs the hacking tools.

cd ~/hexstrike-ai

source hexstrike-env/bin/activate

python3 hexstrike_server.py

Tab 2: Start the MCP Bridge Now that the core is alive, restart the bridge so it can find it.

cd ~/hexstrike-ai

source hexstrike-env/bin/activate

python3 hexstrike_mcp.py

Ghidra MCP

Target: http://localhost:9090/sse

In VS Code, click on the third button to manage MCP servers.

Restart the MCP Server by letting Cline reload its configuration to see the new HexStrike Server. Click on the Manage MCP Servers button. If HexStrike does not show a green status light, click the Refresh or Restart button within that panel.

The green light next to hexstrike means the server is active and Cline is successfully connected to your pen-testing toolkit.

​​

​

Get an API key from openrouter.ai.

​

Feel free to try other models.

​

Prompt Example:

What is the main function?

What is the password?

Password or flag found in the exe in the Ghidra project.