idapin-mcp
idapin-mcp
IDA의 idadbg PIN 도구를 컴파일하고 IDA Pro에 연동하며, 동일한 pintool을 IDA GUI를 열지 않고 MCP를 지원하는 모든 AI(Grok, Claude Desktop, Cursor, VS Code, …)에 노출하는 Windows 파이프라인입니다.
이 저장소에는 전체 프로젝트 소스가 포함되어 있습니다: Windows pintool(pintool/), MCP 서버(src/idapin_mcp/), 설치/빌드 파이프라인(scripts/).
PIN은 실행 중인 프로세스를 계측합니다. idadbg는 IDA pintool 프로토콜(v9)을 사용합니다. MCP 프로세스는 해당 프로토콜의 TCP 클라이언트이므로 AI 도구에 IDA GUI가 필요하지 않습니다.
Intel PIN(pin.exe)은 여기에 포함되어 있지 않습니다 (Intel 라이선스). scripts/setup.ps1이 PIN 3.31 MSVC 키트를 다운로드합니다.
제공 내용
경로 | 역할 |
|
|
| MCP stdio 서버 ( |
| PIN 다운로드 → pintool 빌드 → IDA |
| IDA 및 MCP 예제 스니펫 |
AI client --stdio MCP--> python -m idapin_mcp --TCP--> pin.exe + idadbg*.dll --instrument--> target.exe
IDA Pro --dbg_pin.cfg--> pin.exe + same DLLs (optional GUI tracer)Related MCP server: frida-mcp
요구 사항 (Windows)
Windows 10/11 x64
Python 3.10+
Visual Studio 2017 이상 MSVC x86/x64 포함 (2019, 2022, 2026 모두 작동하며, 빌드 스크립트는 최신 도구 집합을 선택합니다)
Windows 10 SDK (VS와 함께 설치된 10.0.* 버전)
IDA Pro 7.x/8.x/9.x 선택 사항, GUI PIN 트레이서도 원하는 경우에만
네트워크 1회, Intel PIN 3.31을 받기 위해 (
pin-external-3.31-98869-…-msvc-windows.zip)
C:\pin에 쓸 수 없다면 관리자가 필요하지 않습니다 — -PinRoot "$env:LOCALAPPDATA\idapin-mcp\pin"을 설정하세요 (공백이 없는 경로가 PIN에 더 안전합니다).
원커맨드 설정
저장소 루트의 PowerShell에서:
Set-ExecutionPolicy -Scope Process Bypass
.\scripts\setup.ps1이 명령은 다음을 수행합니다:
%LOCALAPPDATA%\idapin-mcp\venv를 만들고pip install -e .를 실행합니다.PIN 3.31을
C:\pin(또는 사용자가 지정한 경로)에 다운로드합니다.pintool/을PIN\source\tools\idapin에 복사하고, VS 프로젝트 대상을 재지정한 다음 Win32 + x64 Release로 빌드합니다.발견된 모든 IDA 설치에서
dbg_pin.cfg를 패치합니다.Grok, Claude Desktop, Cursor, VS Code 사용자 설정에 MCP 서버를 등록합니다.
그런 다음 AI 클라이언트를 다시 시작하세요.
사용자 지정 PIN 위치:
.\scripts\setup.ps1 -PinRoot "$env:LOCALAPPDATA\idapin-mcp\pin"통합 스크립트 대신 단계별로 진행하려면: docs/windows-build.md.
MCP 도구 (모든 AI용)
실행 후 프로세스는 PROCESS_STARTED에서 일시 중단됩니다. 중단점을 설정한 다음 재개하세요.
도구 | 용도 |
| Windows EXE에서 PIN + pintool 시작 |
| 세션 및 디버그 이벤트 |
| 소프트웨어 중단점 |
| 레지스터 / 메모리 |
| 제어 |
| 매핑된 섹션 |
| 명령어 트레이싱 |
| PIN 프로세스 트리 종료 |
예시 프롬프트:
idapin MCP 사용:
C:\Windows\System32\cmd.exe에서 인수/c echo hi로pin_launch실행, 레지스터 읽기, 그런 다음pin_resume및pin_stop실행.
수동 MCP 스니펫: configs/mcp.example.json. 클라이언트별 참고 사항: docs/ai-clients.md.
IDA Pro (GUI 트레이서)
setup.ps1이 작성하는 내용:
PIN_PATH = "C:\\pin\\pin.exe";
PIN_TOOL_PATH = "C:\\pin\\source\\tools\\idapin";
PIN_TOOL_OPTIONS = 1IDA에서: 디버거 → 디버거 선택 → PIN 트레이서를 선택한 다음 F9를 누릅니다. 자세한 내용: docs/ai-clients.md.
헤드리스 idalib는 pin_user.dll을 시작할 수 없습니다. 그래서 이 MCP는 pintool과 직접 통신합니다.
라이선스
라이선스가 분리되어 있습니다. MCP 서버는 MIT이고, pintool은 MIT가 아닙니다.
트리 | 라이선스 / 저작권 |
| MIT — LICENSE |
| Hex-Rays 저작권 2014–2019 — pintool/COPYRIGHT. MIT가 아닙니다. Intel이 컴파일된 PIN 도구의 재배포를 금지하므로 소스 형태로 유지됩니다. |
Intel PIN 키트 ( | Intel. 이 저장소에 포함되어 있지 않습니다. 별도로 다운로드하고 Intel 라이선스에 동의하세요. |
NOTICE를 참조하세요. pintool/을 MIT로 재라이선스하지 마세요.
pin.exe, PIN zip, 컴파일된 *.dll을 커밋하지 마세요.
브라우저에서 GitHub에 게시(Git 설치 불필요): docs/publish-github.md.
Available Tools
15 toolspin_add_bptB
Add a software breakpoint at ea (hex or int).
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | Address, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It says 'add' implies mutation but does not disclose permissions, persistence, target-state requirements, side effects, or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. The action and parameter are stated immediately, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter operation the core purpose is covered, but with no annotations or output schema the description should do more to explain target state, side effects, or how it relates to sibling breakpoint tools. It is adequate but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the sole parameter. The description adds minor value by noting 'hex or int', but the schema example already shows a hex address and no further format details are given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Add a software breakpoint at ea'. It clearly distinguishes the operation from deletion tools like pin_del_bpt, though it does not explicitly name or contrast with any sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, nor any prerequisites such as whether the debugger must be paused. Usage is only implied by the tool name and operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_del_bptB
Remove a software breakpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | Address, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not say whether the target must be paused, what happens if the breakpoint does not exist, whether the removal is reversible, or what errors may occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. Every word earns its place, and the action is immediately clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool, the description and schema together are minimally sufficient to invoke it. However, with no annotations and no output schema, it leaves behavioral gaps around error handling, prerequisites, and side effects that would help an agent call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single parameter ea is already documented with an example address in the schema. The description adds no syntax or meaning beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Remove) and resource (software breakpoint) in one clear sentence. It naturally differentiates from the sibling pin_add_bpt by opposite action, so an agent can distinguish it without opening another schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, prerequisites, or alternatives are given. The existence of pin_add_bpt is never referenced, so the agent must infer that this is the inverse operation rather than being routed explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_eventsB
Return (and optionally clear) queued debug events from the pintool.
| Name | Required | Description | Default |
|---|---|---|---|
| clear | No | Clear the queue after reading |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the burden. It discloses the optional queue-clearing behavior directly, which is useful, but omits details like the format of returned events, whether events accumulate, or any side effects beyond clearing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence introducing the tool and its key optional behavior, with no wasted words. It is front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description covers the core action. It could still explain how events are queued, whether the tool is safe to call multiple times, or what happens if the queue is empty.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'clear' is fully documented in the schema (100% coverage), and the description adds only the concept of clearing. Baseline 3 is appropriate when the schema already handles parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Return') and resource ('queued debug events from the pintool'), and the optional clear action is explicit. It doesn't differentiate from siblings, but its domain (debug events) is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the description: this tool is for retrieving queued debug events, relevant after launching or resuming a pintool. However, it does not state when to use it versus alternatives or any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_launchA
Start Intel PIN + idadbg on a Windows EXE (no IDA GUI). Leaves the process suspended at PROCESS_STARTED so you can set breakpoints, then call pin_resume.
| Name | Required | Description | Default |
|---|---|---|---|
| args | No | Command-line arguments for the target | |
| port | No | Pintool listen port (default 23946) | |
| target | Yes | Full path to the executable | |
| trace_insns | No | Enable instruction+register tracing | |
| connect_timeout | No | Seconds to wait for pintool listen/handshake |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the essential behavioral trait: the process is left suspended at PROCESS_STARTED rather than running, which is non-obvious and critical. This prevents the agent from assuming a running process after launch.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence front-loads the action and the suspended-state behavior. It is efficient but slightly compact; the handshake/port context is left entirely to the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-param launch tool with no annotations and no output schema, the description covers the key lifecycle behavior (suspended state) and the resume step. It does not mention port/connection handshake requirements which appear in the schema, but the critical agent-facing behavior is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 5 parameters are already documented in the schema with defaults and meanings. The description adds no syntax or format detail about the parameters themselves, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Start) and resources (Intel PIN + idadbg on a Windows EXE), and explicitly distinguishes the mode from alternatives by noting 'no IDA GUI'. An agent can tell exactly what this does relative to siblings like pin_status or pin_resume.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the follow-on tool (pin_resume) and the condition for using it ('Leaves the process suspended... so you can set breakpoints, then call pin_resume'). This routes the agent to the correct next action, which is the crux of a debugger launch tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_meminfoB
List mapped image/section ranges from the pintool.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It never states that this is a read-only operation, what the result looks like (list of ranges with addresses/permissions?), or whether the target must be paused first — all relevant for a debugging pintool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no filler and a clear front-loaded verb. It is appropriately sized for a no-argument tool, though there is little structure to evaluate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should describe what is returned (fields of each mapped range, ordering, whether addresses are absolute). It only gestures at the output with 'mapped image/section ranges', leaving the agent to guess the payload shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and the schema is empty, so there is nothing for the description to document beyond what it already says. Baseline 4 applies when there are no parameters to clarify.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (list) and resource (mapped image/section ranges from the pintool), which is clear enough for an agent to identify the operation. It does not explicitly differentiate itself from adjacent memory tools like pin_read_mem or pin_events, but the 'mapped ranges' wording implies a layout/map view rather than content retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use context, prerequisites, or alternatives. An agent must infer that this tool is for inspecting the process memory map rather than reading memory values, which is not stated anywhere in the definition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_pauseB
Pause the instrumented process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the mutation but says nothing about whether execution halts immediately, whether state is preserved, whether the pause is synchronous, or how it interacts with pin_resume.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is appropriately terse for a simple no-parameter action, though the terseness contributes to the behavioral gaps rather than being a structural flaw.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is low-complexity (zero parameters, no output schema, no annotations), so the description does not need to explain return values. Still, it omits the state relationship with sibling tools like pin_resume and pin_stop, leaving a meaningful contextual gap for an agent coordinating a debugging session.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing for the description to clarify beyond what the schema trivially provides. Baseline 4 applies for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Pause') and resource ('the instrumented process'), so the action is unambiguous. However, it does not differentiate itself from siblings like pin_stop or pin_resume, leaving the agent to infer that this is a reversible halt distinct from termination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, prerequisites, or alternatives. It never mentions pin_resume or pin_stop, so the agent gets no explicit direction on which pause-adjacent tool to choose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_read_memA
Read up to 1024 bytes of target memory. Returns hex.
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | Address | |
| size | No | Byte count (max 1024) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the maximum byte count and that output is hex, but says nothing about address validity, failure behavior, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and constraint, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with full parameter schema coverage, the description covers the essential result format and size limit. Minor gaps remain around address handling and failure modes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description restates the 1024-byte cap but adds no further meaning about address syntax or size behavior beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read'), resource ('target memory'), and scope ('up to 1024 bytes'), and distinguishes itself from sibling register reads by specifying memory rather than registers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no exclusions, and no mention of alternatives such as pin_read_regs or pin_write_mem. The description only implies its basic purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_read_regsC
Read general-purpose registers for a thread.
| Name | Required | Description | Default |
|---|---|---|---|
| tid | No | OS thread id (0 = last event / main) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the full behavioral burden. It implies a read but does not state the operation is side-effect free, whether it requires the target to be paused, what registers/format are returned, or how errors (e.g., invalid tid) are surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, appropriate for a one-parameter read tool. It is efficient, though extremely terse for a debugging primitive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, and a read tool whose result shape (which registers, register names, formatting) is entirely undocumented. An agent lacks enough context to interpret or act on the return value confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (tid) and schema description coverage is 100%, with the schema already explaining '0 = last event / main'. The description adds nothing beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and resource ('general-purpose registers') scoped to a thread. It is distinguishable from siblings like pin_read_mem and pin_write_mem by resource, though it does not explicitly contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites (e.g., whether the thread must be paused/stopped first), and no mention of the default tid=0 behavior in prose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_resumeA
Resume after an event. eid defaults to the last received event (PROCESS_STARTED=1, BREAKPOINT=5, STEP=6).
| Name | Required | Description | Default |
|---|---|---|---|
| eid | No | Event id to resume; omit to use last event |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It helpfully discloses the default behavior of eid (defaults to the last received event) and the meaning of event-type codes, but says nothing about prerequisites (the process presumably must be paused), side effects, or reversibility of resuming execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly packed sentences with the verb front-loaded and the default-parameter note following. No wasted words; the only mild deduction is that the parenthetical event-code list slightly burdens the second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter command with no output schema and no annotations, the description covers the parameter default and event codes but omits the operational state required to call it (must be stopped at an event). It is adequate but leaves a real gap for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so a baseline of 3 applies, but the description goes beyond the schema by enumerating what the eid values mean (PROCESS_STARTED=1, BREAKPOINT=5, STEP=6), which is not present in the parameter definition itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Resume') and the trigger context ('after an event'), which is enough to distinguish it from the opposite action pin_pause and from pin_step. However it never names a sibling, so the differentiation relies on the agent inferring the pause/resume pairing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'after an event' implies this is used to continue execution once stopped at a breakpoint/step, but there is no explicit when-to-use or when-not-to-use guidance and no reference to pin_pause, pin_step, or pin_stop as alternatives. Usage is only inferable from context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_set_traceB
Set tracing flags (TF_TRACE_INSN=2, TF_REGISTERS=0x10, TF_TRACE_EVERYTHING=0x40). Combine with bitwise OR.
| Name | Required | Description | Default |
|---|---|---|---|
| flags | Yes | Bitmask. 0x12 = insn+regs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not disclose that this mutates process state, whether it requires the target to be paused, whether changes take effect immediately or on next launch, or what happens to previously set flags. The flag constants are useful but they are parameter data, not behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action, followed by the combinability rule. No filler, no repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The single required parameter is fully specified, so the core call is answerable. However, with no annotations and no output schema, and with siblings covering launch/pause/resume/read, the description should say more about when this is valid and what effect it has — that gap leaves the agent to infer operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already gives the 0x12 example, but the description adds the named constants (TF_TRACE_INSN=2, TF_REGISTERS=0x10, TF_TRACE_EVERYTHING=0x40) and the OR-combination rule that the schema does not encode since there are no enums. This meaningfully extends what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Set') and resource ('tracing flags'), and enumerates the concrete flag constants, so the agent can tell it apart from siblings like pin_trace_count or pin_status. It lacks any explicit sibling differentiation, but the purpose itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage hint is 'Combine with bitwise OR', which is a syntactic note rather than a when-to-use rule. It never says whether flags must be set before launch, while paused, or which of the pin_* siblings to prefer for inspecting trace results.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_statusB
PIN session status: connected, last event, paths.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses returned fields (connected, last event, paths), which is useful, but omits whether the operation is read-only, requires an active session, or has any auth or rate-limit constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence front-loads the purpose and returned fields with no wasted words. 'paths' is unexplained, but the overall structure is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description is the only source for return-value information. It lists key status fields but leaves their meaning and session prerequisites vague. It is minimally adequate for a zero-param status tool, but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics to document. Schema coverage is 100% but empty; the baseline for a no-parameter tool is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the resource (PIN session status) and lists key returned fields (connected, last event, paths), making it distinguishable from mutating siblings like pin_pause and pin_step. However, it lacks an explicit verb and does not directly name alternatives, so sibling differentiation remains implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no prerequisites, and no comparison to sibling tools such as pin_events or pin_meminfo. The agent must infer usage entirely from the name and returned fields.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_stepB
Single-step the given OS thread (tid 0 = last event thread).
| Name | Required | Description | Default |
|---|---|---|---|
| tid | No | OS thread id |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It does not state whether the call blocks until the step completes, whether the thread must already be halted, how other threads are affected, or what the result indicates — significant gaps for a tool that mutates execution state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the special-value convention appended in parentheses; no wasted words and the operation is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description covers the parameter's semantics adequately but omits preconditions (paused state) and timing/blocking behavior. It is minimally sufficient but leaves real gaps an agent would care about before invoking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema documents tid only as 'OS thread id'. The description adds genuine meaning by defining the special value tid 0 = last event thread, which the schema does not convey, so it exceeds the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('single-step') and resource ('the given OS thread'), which is clearly distinct from sibling operations like pin_resume, pin_pause, and pin_stop. It does not explicitly name or contrast with those siblings, so it falls short of the 5 bar.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the noun phrase 'single-step' in a debugging context, and the tid=0 convention hints at the common no-argument case. However, it never says when to step versus resume/pause, nor whether a precondition (thread must be paused/halted) is required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_stopA
Send EXIT to the pintool and kill the PIN process tree.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It clearly discloses the destructive outcome (kill the PIN process tree) and the mechanism (send EXIT), but omits whether termination is graceful, whether it waits for completion, permission requirements, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the core behavior efficiently and is appropriately sized for a zero-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-argument stop/kill tool with no annotations or output schema, the description is nearly complete—it conveys the essential destructive action. A bit more detail on side effects or reversibility would make it fully complete, but the core need is met.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, and the schema is empty with 100% coverage of that emptiness. Per the scoring rules for 0 params, the baseline is 4; the description adds no parameter information because there is none to add.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the action (send EXIT to the pintool) and the result (kill the PIN process tree), which clearly distinguishes it from siblings like pin_pause or pin_resume. However, it does not explicitly name or route to any alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as pin_pause, pin_resume, or pin_launch. It lacks any when/when-not conditions or prerequisites, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_trace_countB
Number of recorded trace events currently buffered.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It hints that the count is of 'currently buffered' events (implying a volatile snapshot), but says nothing about read-only nature, permissions, blocking behavior, or how the count relates to other trace operations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core concept without any extraneous wording. It is appropriately sized for a simple query tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool, the description should clarify the return value and its context. It gives the concept ('number of recorded trace events currently buffered') but omits details like numeric type, whether the buffer has a maximum, or how it interacts with pin_events, leaving clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics burden. The baseline for zero-param tools is 4, and the description does not need to add parameter information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific quantity (number of recorded trace events currently buffered), which is clear and concrete. However, it does not differentiate the tool from siblings like pin_events, which likely lists events rather than counting them, so an agent must infer the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as pin_events or pin_status. The description only defines what is returned, leaving usage context entirely implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_write_memC
Write hex bytes to target memory.
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | ||
| hex | Yes | Hex string without 0x, e.g. 90c3 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. For a memory-mutation tool it says nothing about required target state (paused vs running), whether writes to code/read-only regions are permitted, reversibility, or what the call returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no filler; the verb and object are front-loaded. It is efficient, though its brevity reflects under-specification rather than deliberate concision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a state-mutating tool with no annotations, no output schema, and one undocumented parameter, the description is too thin. An agent cannot tell what 'ea' means, what preconditions apply, or how failures/partial writes are reported.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only the 'hex' parameter is documented in the schema (with format and example); 'ea' has no description anywhere. With 50% schema coverage, the description needed to compensate by explaining that 'ea' is the target effective address and clarifying hex encoding on the wire, but it adds nothing beyond the name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Write') and resource ('hex bytes to target memory'), which clearly separates it from the sibling pin_read_mem. It does not, however, name or differentiate against other siblings or clarify scope beyond the literal operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus pin_read_mem or the other pin_* tools, and no stated prerequisites such as whether the target must be paused before writing. The agent is left to infer the context entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
15 tool updates
v0.1.0- First observed
pin_add_bpt - First observed
pin_del_bpt - First observed
pin_events - First observed
pin_launch - First observed
pin_meminfo - First observed
pin_pause - First observed
pin_read_mem - First observed
pin_read_regs - First observed
pin_resume - First observed
pin_set_trace - First observed
pin_status - First observed
pin_step - First observed
pin_stop - First observed
pin_trace_count - First observed
pin_write_mem
TDQS
Scored across 15 tools
Each tool targets a distinct debugger operation: session control (launch/status/resume/pause/step/stop), event retrieval, breakpoint add/del, register/memory read/write, and tracing. The only slight adjacency is pin_events vs pin_trace_count, but the descriptions clearly separate debug events from buffered trace events.
All tools use a uniform pin_ prefix in snake_case with predictable verb_noun or noun forms (pin_add_bpt, pin_read_mem, pin_set_trace, pin_status). No mixed conventions or casing inconsistencies.
15 tools is well-scoped for a debugger/instrumentation control surface, with each tool covering a necessary operation rather than redundant variants. The count supports full session lifecycle without bloat.
Core debugger coverage is strong: launch/attach, breakpoints add/remove, stepping, memory read/write, register read, memory map, tracing, and teardown. Notable gaps remain: no pin_write_regs (only read), no breakpoint enumeration/list, and no module/symbol lookup, which slightly limits register and breakpoint management workflows.
Maintenance
Related MCP Connectors
Reasoning, code, anti-deception, memory harness MCP tools. Stdio or HTTPS api.ejentum.com/mcp
Multiple MCP tools, persistent graph memory, token-saving data pointers, and more.
Live browser debugging for AI assistants — DOM, console, network via MCP.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceA headless IDA Pro MCP server that enables AI agents to automatically open, analyze, and query multiple binary files simultaneously without manual GUI interaction. It provides 36 tools for tasks like decompilation, disassembly, and cross-reference analysis through IDA's idalib library.12-
- FlicenseBqualityBmaintenanceA simple MCP server exposing persistent, scriptable Frida dynamic instrumentation to an AI agent for Windows reversing, malware/security analysis, and dynamic debugging.19-
- AlicenseNot gradedqualityBmaintenanceAn MCP server that exposes dynamic binary instrumentation, memory editing, pointer scanning, and scripting capabilities to AI agents, enabling real-time process inspection and modification.MIT
- AlicenseNot gradedqualityAmaintenanceHeadless reverse engineering MCP server integrating IDA Pro for static analysis and x64dbg for dynamic debugging via controlled MCP tools.3GPL 3.0