Skip to main content
Glama

disassemble

Inspect machine code from a binary file offset using Capstone, with architecture auto-detection and configurable instruction count and base address for static analysis.

Instructions

Disassemble a window of machine code from a file offset with Capstone.

arch: auto|x86|x64|arm|thumb|arm64 (auto detects from the file header).
count: number of instructions. base_addr: virtual address to show as the
first instruction's address (defaults to the file offset).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
archNoauto
pathYes
countNo
offsetNo
base_addrNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses the disassembly engine (Capstone) and the auto-arch-detection behavior, which is real context beyond the structured fields. However, it says nothing about permissions, error handling on malformed binaries, or the read-only safety profile an agent might want confirmed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence, followed by compact per-parameter notes with no filler. Structure is efficient; the arch value list is slightly dense but earns its space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the key input parameters are covered. The remaining gap is routing: nothing explains when to choose this over disassemble_entrypoint, which is the most important missing piece for an agent with this many siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate and largely does: it enumerates the arch values (auto|x86|x64|arm|thumb|arm64) that the schema leaves unconstrained, explains count and base_addr semantics, and implies the file-offset meaning of offset. Only path and the default for offset are left undocumented, which is minor given the schema provides defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Disassemble) and resource (a window of machine code from a file offset) and even names the engine (Capstone). It does not, however, distinguish itself from the sibling disassemble_entrypoint, so an agent cannot tell the two apart from the description alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no mention of alternatives such as disassemble_entrypoint or ghidra_decompile. The reader must infer that this is the arbitrary-offset variant versus the entrypoint variant without any help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.