Someone else had been building the same thing for a year; he got 4× the stars by launching two days later: x64dbg-mcp-server

A red-team researcher spent two days wiring x64dbg, the most common Windows debugger, into Claude Code. At least four people had done the same thing before him, the biggest at 747 stars; he reached 2,795 stars in 76 days. He won mainly not on features but on three things: he took an empty slot, made installation zero-barrier, and wrote a launch post that people liked to repost. Anyone wanting star growth for an open-source project can copy all three, but the x64dbg slot is gone, so the tool has to be a different one.

A tweet with 590k views

On Aug 2026 20, GitHub user duty1g forked AgentSmithers/x64DbgMCPServer, a C# x64dbg plugin that had been around for over a year and needed .NET to run. Two days later, in the afternoon of Aug 22 (UTC; it was already the early morning of the 23th in Beijing), he posted his Zig rewrite on X with an introduction:

🚀 x64dbg-MCP Server — fully automated, dynamic, agentic reverse engineering for x64dbg. 🧠 71 MCP tools … ⚡ Native Zig plugin — zero dependencies … 📦 x32 + x64

The post has reached 591k views and about 3,400 likes (X post page, 11-06). duty1g's real name is Marouane Belabbassi, and his bio says he is a Synack red team researcher who has been doing CTFs since 2011. His account isn't big: four days earlier he posted another tool, jspacket, which got only 10 likes and 1,400 views. So this one spread on the strength of the content itself, not borrowed followers.

The top reply in the comments reads: "Years ago, people would pay millions for this. Around 1999 years ago."

What it is

x64dbg is the most widely used open-source dynamic debugger on Windows, with 50k stars, and almost everyone doing malware analysis, CTFs, or game cracking uses it. This plugin exposes the debugger's operations (setting breakpoints, stepping, reading and writing memory, disassembly, PE analysis, finding the entry point, dumping modules) as 84 MCP tools, and also provides 22 kinds of debug event callbacks. Once an agent like Claude Code or Codex connects, it can debug programs on its own.

The most straightforward recap came from the Chinese account @lifcc in Oct 6: "Reverse engineering used to be: set breakpoints by hand ➡️ F7/F8 to step over ➡️ eyeball for the encryption function ➡️ dig through memory and the stack. Now: just tell Claude, 'Load the malware sample, break at the entry point, step 5 times, and extract the decrypted strings from memory.'"

Installation is a single step: copy the dist directory into the x64dbg directory, open x64dbg, and the service starts. No .NET, no Python, and no separate bridge process.

Four people had already done the same thing

(GitHub,11-06)

Adjacent slots already had leaders: IDA's MCP (mrexodia/ida-pro-mcp) with 13.4k stars, and Ghidra's (LaurieWired/GhidraMCP) with 11.8k stars. For the most-used Windows dynamic debugger slot, no project had passed a thousand stars in over a year. When he arrived, the spot had been shown to have demand, but nobody had yet taken hold of it.

The bromoket project is worth a closer look: it has more endpoints than duty1g (153), but only 138 stars. It shows that more features isn't enough; people also have to see it and be able to install it.

How the stars came

GitHub doesn't publish full daily curves. Trendshift recorded Sep 7 to Nov 6, 61 days, for +899 stars in total. Working backward, the first 16 days picked up roughly 1,900 stars (estimate), and about 70% of the stars came within two weeks of release.

(Star increments: Trendshift and GitHub daily data; views: X post pages)

Two points are worth remembering.

First, Chinese AI tool accounts dig the same project back up and write it up again every few weeks, and each write-up makes a small spike. These accounts like the launch-post format: one emoji per line, one selling point per line, with a picture.

Second, Zig is a niche language. Zig repos are few, and this one sat in the top 25 of Trendshift's Zig chart almost every day, ranking #1 on October 6 and 7. Similar tools written in C++ or C# get lost among the big-language charts and basically never chart. Choosing Zig wasn't necessarily about gaming the charts, but the result was a spot that people kept looking at.

It never made Hacker News, and there's no sign of paid promotion.

There was also a broader wave behind it: the aggregator reverse-engineering MCP morluto/rea, launched in April 2026, climbed to 437k stars, and from October on X was full of lists like "20 repos that let AI do reverse engineering." Those lists confirmed x64dbg itself, but I haven't verified whether they listed this plugin directly. Its second surge, through 10 and into November, lined up with this wave.

Why it held up

Reposts bring people in, but what keeps them depends on the thing itself. The release was downloaded 9,839 times in total, and v1.6 alone had 3,430 downloads (GitHub, 11-06), which shows plenty of people actually installed it, not just starred it. Over two and a half months it shipped 8 releases, with 0 open issues.

The Japanese author's relay specifically noted: there are several MCPs for x64dbg, and this one stresses Zig's single file and no runtime requirement. The biggest pain point with similar tools is that they're hard to install, and it turned that pain point directly into its selling point.

What happened to the copycats

Starting in late August, a batch of same-named small libraries appeared: Zekiog/z-x64dbg-mcp (8/27), Evelynkaz/x64dbg-mcp (8/30), yangshun2005/x64dbg-mcp-server-cn (9/15, Chinese version), each with only single-digit stars. Once the leader was established, doing the same thing for the same tool got almost no attention.

If it were you

B. Building an x64dbg tool now is already late. The playbook is worth copying, but you have to find the next empty slot yourself, and bet that the slot hasn't been absorbed by an aggregator project like REA.

Who it's for: developers who know one specialized desktop tool well (reverse engineering, security, hardware, audio/video, CAD all count) and can write native plugins; ideally someone already inside that community, with a place to launch.

Who it's not for: anyone who wants to build yet another x64dbg, IDA, or Ghidra MCP (those three slots already have leaders); anyone who only writes Python glue and needs users to install a separate runtime (exactly the approach this plugin beat); anyone who wants to make money from it (this category earns stars and reputation).

How to do it: find a tool where the MCPs for adjacent tools each have over ten thousand stars, but the tool itself has no project with a thousand stars yet. In reverse engineering you could look at dnSpy/ILSpy, Frida, Cutter, ImHex; WinDbg's largest existing one is 1.7k (svnscha/mcp-windbg), so there's still room (inference). It must be a single-file plugin you can drag in and use right away, and the tool set should cover the full loop: set breakpoints, run, wait for a stop, read state, so an agent can get through the whole thing on its own. Put a sample conversation in the README so people can see at a glance what the AI is doing. Writing in a niche language like Zig or Odin also gets you onto the language charts.

How to get users: write the launch post in list style, starting with an emoji, one number per line, with a demo image, and tag it #MCP #ReverseEngineering. Once it's out, actively send the link to Chinese AI tool accounts and Japanese security accounts, and they'll write it up again every few weeks. At the same time, submit to Reddit r/MCPservers and the various MCP directories.

When to launch: the earlier the better. The "AI reverse engineering" heat has been peaking since October, and every backend an aggregator like REA adds removes one empty slot. Ideally you launch before the heat fades, i.e., before the first quarter of 2027 (inference).

Signs you misjudged it: ① the tool you picked already has a good backend in REA, or the vendor has released an official MCP (IDA already has an official one, HexRaysSA/ida-mcp); ② the launch post passes 100k views but the stars are still under 300 two weeks later, meaning the tool's users aren't on X; ③ after November, no Chinese accounts relay this plugin anymore and the daily stars drop to single digits, meaning the heat has passed.

Data and sources

• GitHub: duty1g/x64dbg-mcp-server repo page, README, releases (11-06:2,795 stars, 319 forks, 8 releases, 9,839 downloads); star counts and creation dates of similar repos (11-06).
• Trendshift: trendshift.io/repositories/176409 (daily stars from 9/7 to 11/6 and Zig chart ranking); growth before 9/7 is back-calculated.
• X: @duty_1g launch post (2026-08-22; views and likes from the post page), reposts by @LinearUncle, @NFTCPS, @mylifcc, @dandanetha, @MalwareBibleJP, @Dinosn.
• Web: hermes-ai.net (2026-08-24), Reddit r/MCPservers, mcpmarket, SourceForge mirror.
• Unverified: whether the REA list posts directly listed this plugin; who drove the small wave of growth from September 26 to 28.