Cheat Engine MCP Bridge

AI-powered reverse engineering and memory analysis via the Model Context Protocol

43 MCP Tools · Hardware Breakpoints · DBVM Ring -1 Tracing · Named Pipe IPC

Quick Start · Features · Commands · Architecture · Contributing

What it does

Reverse engineering is manual work that needs deep domain expertise. This bridge hands an AI agent the same primitives through typed API calls: reading process memory, setting hardware breakpoints, tracing execution at hypervisor level, and dissecting structures.

Cheat Engine MCP Bridge connects Cheat Engine to AI agents (Claude, Cursor, Copilot, etc.) via the Model Context Protocol. A Lua script inside Cheat Engine creates a Named Pipe server; a Python MCP server translates tool calls to JSON-RPC commands over that pipe. AI agents never interact with Cheat Engine directly.

Platform: Windows only. Requires Cheat Engine 7.x attached to a target process.

Features

Install

3 steps to get an AI agent reversing your target process:

1. Load the Lua bridge in Cheat Engine: open ce_mcp_bridge.lua via the Lua script editor and run it.

2. Add the MCP server to your AI agent config (see MCP Client Configuration below for Claude Desktop, Claude Code and Cursor).

3. Verify the connection:

ping() to verify, then get_process_info() to confirm the target.

• Windows 10/11
• Cheat Engine 7.x installed
• Python 3.12+
• A target process attached in Cheat Engine

cd MCP_Server
pip install -r requirements.txt

Dependencies:

• mcp>=1.0.0: MCP SDK
• pywin32>=306: Windows Named Pipe API

1. Open Cheat Engine and attach to your target process.
2. Go to Memory View > Tools > Lua Script.
3. Open MCP_Server/ce_mcp_bridge.lua.
4. Click Execute.
5. The output panel should print [MCP v11.4.0] Bridge started.

Critical setting: Go to Settings > Extra > disable "Query memory region routines" to prevent BSOD when scanning protected pages.

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "cheatengine": {
      "command": "python",
      "args": ["C:\\path\\to\\MCP_Server\\mcp_cheatengine.py"]
    }
  }
}

Claude Code (.claude.json):

{
  "mcpServers": {
    "cheatengine": {
      "command": "python",
      "args": ["C:/path/to/MCP_Server/mcp_cheatengine.py"]
    }
  }
}

Cursor / VS Code (.cursor/mcp.json or MCP settings):

{
  "cheatengine": {
    "command": "python",
    "args": ["/path/to/MCP_Server/mcp_cheatengine.py"]
  }
}

Usage

The bridge exposes 43 MCP tools organized by category. See AI_Context/MCP_Bridge_Command_Reference.md for full parameter documentation with examples.

Process and Modules (6 tools)

Memory Read (6 tools)

Memory Write (3 tools)

Pattern Scanning (8 tools)

Disassembly and Analysis (8 tools)

Hardware Breakpoints (6 tools)

All breakpoints use hardware debug registers (DR0-DR3). Maximum 4 active at a time. Safe for anti-cheat environments.

DBVM Hypervisor: Ring -1 (4 tools)

Requires DBVM activated in Cheat Engine settings. Operates below the OS: invisible to anti-cheat.

Scripting (2 tools)

Configuration

To use a custom pipe name, update both PIPE_NAME in mcp_cheatengine.py and PIPE_NAME in ce_mcp_bridge.lua.

Architecture

flowchart TD
    AI["AI Agent\n(Claude / Cursor / Copilot)"]
    MCP["mcp_cheatengine.py\nPython MCP Server\nFastMCP + pywin32"]
    PIPE["Named Pipe\n\\\\.\\pipe\\CE_MCP_Bridge_v99\nLength-Prefixed JSON-RPC"]
    LUA["ce_mcp_bridge.lua\nLua Worker Thread\n(Async I/O)"]
    MAIN["CE Main Thread\nthread.synchronize()"]
    CE["Cheat Engine\nAttached to Target"]
    TARGET["Target Process\n(.exe)"]

    AI -->|"MCP Protocol\nJSON-RPC over stdio"| MCP
    MCP -->|"Named Pipe\nAsync Write/Read"| PIPE
    PIPE -->|"JSON-RPC Request"| LUA
    LUA -->|"thread.synchronize"| MAIN
    MAIN --> CE
    CE -->|"ReadProcessMemory\nWriteProcessMemory\nDebug APIs"| TARGET
    CE -->|"Response JSON"| LUA
    LUA -->|"JSON-RPC Response"| PIPE
    PIPE --> MCP
    MCP -->|"MCP Tool Result"| AI

Communication flow:

1. AI agent calls an MCP tool. Python MCP server receives the call.
2. Python serializes it as a length-prefixed JSON-RPC request and writes to the Named Pipe.
3. Lua worker thread reads the request and dispatches to the CE main thread via thread.synchronize.
4. CE executes the memory operation and returns the result.
5. Response travels back through the same pipe to the Python server, returned as an MCP tool result.

Why a worker thread? Blocking pipe I/O on the CE main thread would freeze the GUI. The Lua script uses a dedicated worker thread for all pipe I/O, and thread.synchronize ensures CE API calls run safely on the main thread.

Windows CRLF fix: The MCP SDK's stdio_server outputs CRLF on Windows, breaking JSON-RPC parsing. The Python server monkey-patches the SDK to force LF-only output before any MCP imports.

Project Structure

cheatengine-mcp-bridge/
  MCP_Server/
    mcp_cheatengine.py        # Python MCP server (FastMCP, 43 tools)
    ce_mcp_bridge.lua          # Lua bridge for Cheat Engine (Named Pipe JSON-RPC)
    test_mcp.py                # Test suite (36/37 tests passing)
    requirements.txt           # Python dependencies
  AI_Context/
    AI_Guide_MCP_Server_Implementation.md   # Architecture guide for AI agents
    CE_LUA_Documentation.md                 # Cheat Engine Lua API reference
    MCP_Bridge_Command_Reference.md         # Full command docs with examples
  README.md
  CHANGELOG.md
  CONTRIBUTING.md
  SECURITY.md
  CODE_OF_CONDUCT.md
  LICENSE

Development

python MCP_Server/test_mcp.py

Results (v11.4.0, requires CE attached with a running process):

Memory Reading:  6/6  passed
Process Info:    4/4  passed
Code Analysis:   8/8  passed
Breakpoints:     4/4  passed
DBVM Functions:  3/3  passed (graceful skip if DBVM inactive)
Utility:        11/11 passed
Skipped:         1    (generate_signature: long blocking scan)
-------------------------------------
Total:          36/37 PASSED

Contributing

See CONTRIBUTING.md for dev setup, code standards, and PR process.

License

MIT: see LICENSE.

Copyright (c) 2026 Hakan Topcu