idapin-mcp
idapin-mcp
Windows 流水线,用于编译 IDA 的 idadbg PIN 工具,将其接入 IDA Pro,并向 任何支持 MCP 的 AI(Grok、Claude Desktop、Cursor、VS Code 等)暴露同一个 pintool,无需打开 IDA 图形界面。
本仓库包含完整的项目源码:Windows 版 pintool(pintool/)、MCP 服务器(src/idapin_mcp/)以及安装/构建流水线(scripts/)。
PIN 对正在运行的进程进行插桩。idadbg 使用 IDA pintool 协议(v9)进行通信。MCP 进程是该协议的 TCP 客户端,因此 AI 工具无需 IDA 图形界面。
Intel PIN(pin.exe)并未内置在本仓库中(Intel 许可)。scripts/setup.ps1 会下载 PIN 3.31 MSVC 工具包。
你将获得
路径 | 作用 |
|
|
| MCP stdio 服务器( |
| 下载 PIN → 构建 pintool → 修补 IDA |
| IDA + MCP 示例片段 |
AI client --stdio MCP--> python -m idapin_mcp --TCP--> pin.exe + idadbg*.dll --instrument--> target.exe
IDA Pro --dbg_pin.cfg--> pin.exe + same DLLs (optional GUI tracer)Related MCP server: frida-mcp
系统要求(Windows)
Windows 10/11 x64
Python 3.10+
Visual Studio 2017 或更高版本,且包含 MSVC x86/x64(2019、2022、2026 均可;构建脚本会选择最新的工具集)
Windows 10 SDK(随 VS 安装的任何 10.0.* 版本)
IDA Pro 7.x/8.x/9.x 可选,仅当你还想要 GUI PIN tracer 时
一次性联网,以下载 Intel PIN 3.31(
pin-external-3.31-98869-…-msvc-windows.zip)
如果你无法写入 C:\pin,则不需要管理员权限——可设置 -PinRoot "$env:LOCALAPPDATA\idapin-mcp\pin"(不含空格的路径对 PIN 更安全)。
单命令安装
在仓库根目录的 PowerShell 中执行:
Set-ExecutionPolicy -Scope Process Bypass
.\scripts\setup.ps1该脚本将:
创建
%LOCALAPPDATA%\idapin-mcp\venv并执行pip install -e .将 PIN 3.31 下载到
C:\pin(或你传入的路径)将
pintool/复制到PIN\source\tools\idapin,重定目标 VS 项目,构建 Win32 + x64 Release在其找到的每个 IDA 安装中修补
dbg_pin.cfg在 Grok、Claude Desktop、Cursor 和 VS Code 的用户配置中注册 MCP 服务器
然后重启 AI 客户端。
自定义 PIN 安装位置:
.\scripts\setup.ps1 -PinRoot "$env:LOCALAPPDATA\idapin-mcp\pin"分步说明(替代一键脚本):docs/windows-build.md。
MCP 工具(适用于任何 AI)
启动后,进程会在 PROCESS_STARTED 处挂起。先设置断点,再恢复执行。
工具 | 用途 |
| 在 Windows EXE 上启动 PIN + pintool |
| 会话与调试事件 |
| 软件断点 |
| 寄存器 / 内存 |
| 控制 |
| 已映射区段 |
| 指令跟踪 |
| 终止 PIN 进程树 |
示例提示词:
使用 idapin MCP:对
C:\Windows\System32\cmd.exe调用pin_launch,参数为/c echo hi,读取寄存器,然后执行pin_resume和pin_stop。
手动 MCP 配置片段:configs/mcp.example.json。各客户端专属说明:docs/ai-clients.md。
IDA Pro(GUI 跟踪器)
setup.ps1 会写入:
PIN_PATH = "C:\\pin\\pin.exe";
PIN_TOOL_PATH = "C:\\pin\\source\\tools\\idapin";
PIN_TOOL_OPTIONS = 1在 IDA 中:调试器 → 选择调试器 → PIN tracer,然后按 F9。详情请参阅:docs/ai-clients.md。
无头模式下的 idalib 无法启动 pin_user.dll;这正是本 MCP 要直接与 pintool 通信的原因。
许可证
采用分离式许可。MCP 服务器为 MIT 许可;pintool 则不是。
目录树 | 许可证 / 版权 |
| MIT — LICENSE |
| Hex-Rays 版权所有 2014–2019 — pintool/COPYRIGHT。非 MIT。以源码形式保留,因为 Intel 禁止再分发编译后的 PIN 工具。 |
Intel PIN 工具包( | Intel。本仓库不包含。请单独下载并接受 Intel 的许可协议。 |
请参阅 NOTICE。请勿将 pintool/ 重新授权为 MIT。
请勿提交 pin.exe、PIN 压缩包或编译后的 *.dll。
无需安装 Git,直接从浏览器发布到 GitHub:docs/publish-github.md。
Available Tools
15 toolspin_add_bptB
Add a software breakpoint at ea (hex or int).
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | Address, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It says 'add' implies mutation but does not disclose permissions, persistence, target-state requirements, side effects, or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. The action and parameter are stated immediately, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter operation the core purpose is covered, but with no annotations or output schema the description should do more to explain target state, side effects, or how it relates to sibling breakpoint tools. It is adequate but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the sole parameter. The description adds minor value by noting 'hex or int', but the schema example already shows a hex address and no further format details are given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Add a software breakpoint at ea'. It clearly distinguishes the operation from deletion tools like pin_del_bpt, though it does not explicitly name or contrast with any sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, nor any prerequisites such as whether the debugger must be paused. Usage is only implied by the tool name and operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_del_bptB
Remove a software breakpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | Address, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not say whether the target must be paused, what happens if the breakpoint does not exist, whether the removal is reversible, or what errors may occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. Every word earns its place, and the action is immediately clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool, the description and schema together are minimally sufficient to invoke it. However, with no annotations and no output schema, it leaves behavioral gaps around error handling, prerequisites, and side effects that would help an agent call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single parameter ea is already documented with an example address in the schema. The description adds no syntax or meaning beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Remove) and resource (software breakpoint) in one clear sentence. It naturally differentiates from the sibling pin_add_bpt by opposite action, so an agent can distinguish it without opening another schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, prerequisites, or alternatives are given. The existence of pin_add_bpt is never referenced, so the agent must infer that this is the inverse operation rather than being routed explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_eventsB
Return (and optionally clear) queued debug events from the pintool.
| Name | Required | Description | Default |
|---|---|---|---|
| clear | No | Clear the queue after reading |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the burden. It discloses the optional queue-clearing behavior directly, which is useful, but omits details like the format of returned events, whether events accumulate, or any side effects beyond clearing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence introducing the tool and its key optional behavior, with no wasted words. It is front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description covers the core action. It could still explain how events are queued, whether the tool is safe to call multiple times, or what happens if the queue is empty.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'clear' is fully documented in the schema (100% coverage), and the description adds only the concept of clearing. Baseline 3 is appropriate when the schema already handles parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Return') and resource ('queued debug events from the pintool'), and the optional clear action is explicit. It doesn't differentiate from siblings, but its domain (debug events) is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the description: this tool is for retrieving queued debug events, relevant after launching or resuming a pintool. However, it does not state when to use it versus alternatives or any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_launchA
Start Intel PIN + idadbg on a Windows EXE (no IDA GUI). Leaves the process suspended at PROCESS_STARTED so you can set breakpoints, then call pin_resume.
| Name | Required | Description | Default |
|---|---|---|---|
| args | No | Command-line arguments for the target | |
| port | No | Pintool listen port (default 23946) | |
| target | Yes | Full path to the executable | |
| trace_insns | No | Enable instruction+register tracing | |
| connect_timeout | No | Seconds to wait for pintool listen/handshake |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the essential behavioral trait: the process is left suspended at PROCESS_STARTED rather than running, which is non-obvious and critical. This prevents the agent from assuming a running process after launch.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence front-loads the action and the suspended-state behavior. It is efficient but slightly compact; the handshake/port context is left entirely to the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-param launch tool with no annotations and no output schema, the description covers the key lifecycle behavior (suspended state) and the resume step. It does not mention port/connection handshake requirements which appear in the schema, but the critical agent-facing behavior is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 5 parameters are already documented in the schema with defaults and meanings. The description adds no syntax or format detail about the parameters themselves, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Start) and resources (Intel PIN + idadbg on a Windows EXE), and explicitly distinguishes the mode from alternatives by noting 'no IDA GUI'. An agent can tell exactly what this does relative to siblings like pin_status or pin_resume.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the follow-on tool (pin_resume) and the condition for using it ('Leaves the process suspended... so you can set breakpoints, then call pin_resume'). This routes the agent to the correct next action, which is the crux of a debugger launch tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_meminfoB
List mapped image/section ranges from the pintool.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It never states that this is a read-only operation, what the result looks like (list of ranges with addresses/permissions?), or whether the target must be paused first — all relevant for a debugging pintool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no filler and a clear front-loaded verb. It is appropriately sized for a no-argument tool, though there is little structure to evaluate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should describe what is returned (fields of each mapped range, ordering, whether addresses are absolute). It only gestures at the output with 'mapped image/section ranges', leaving the agent to guess the payload shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and the schema is empty, so there is nothing for the description to document beyond what it already says. Baseline 4 applies when there are no parameters to clarify.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (list) and resource (mapped image/section ranges from the pintool), which is clear enough for an agent to identify the operation. It does not explicitly differentiate itself from adjacent memory tools like pin_read_mem or pin_events, but the 'mapped ranges' wording implies a layout/map view rather than content retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use context, prerequisites, or alternatives. An agent must infer that this tool is for inspecting the process memory map rather than reading memory values, which is not stated anywhere in the definition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_pauseB
Pause the instrumented process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the mutation but says nothing about whether execution halts immediately, whether state is preserved, whether the pause is synchronous, or how it interacts with pin_resume.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is appropriately terse for a simple no-parameter action, though the terseness contributes to the behavioral gaps rather than being a structural flaw.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is low-complexity (zero parameters, no output schema, no annotations), so the description does not need to explain return values. Still, it omits the state relationship with sibling tools like pin_resume and pin_stop, leaving a meaningful contextual gap for an agent coordinating a debugging session.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing for the description to clarify beyond what the schema trivially provides. Baseline 4 applies for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Pause') and resource ('the instrumented process'), so the action is unambiguous. However, it does not differentiate itself from siblings like pin_stop or pin_resume, leaving the agent to infer that this is a reversible halt distinct from termination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, prerequisites, or alternatives. It never mentions pin_resume or pin_stop, so the agent gets no explicit direction on which pause-adjacent tool to choose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_read_memA
Read up to 1024 bytes of target memory. Returns hex.
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | Address | |
| size | No | Byte count (max 1024) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the maximum byte count and that output is hex, but says nothing about address validity, failure behavior, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and constraint, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with full parameter schema coverage, the description covers the essential result format and size limit. Minor gaps remain around address handling and failure modes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description restates the 1024-byte cap but adds no further meaning about address syntax or size behavior beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read'), resource ('target memory'), and scope ('up to 1024 bytes'), and distinguishes itself from sibling register reads by specifying memory rather than registers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no exclusions, and no mention of alternatives such as pin_read_regs or pin_write_mem. The description only implies its basic purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_read_regsC
Read general-purpose registers for a thread.
| Name | Required | Description | Default |
|---|---|---|---|
| tid | No | OS thread id (0 = last event / main) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the full behavioral burden. It implies a read but does not state the operation is side-effect free, whether it requires the target to be paused, what registers/format are returned, or how errors (e.g., invalid tid) are surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, appropriate for a one-parameter read tool. It is efficient, though extremely terse for a debugging primitive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, and a read tool whose result shape (which registers, register names, formatting) is entirely undocumented. An agent lacks enough context to interpret or act on the return value confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (tid) and schema description coverage is 100%, with the schema already explaining '0 = last event / main'. The description adds nothing beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and resource ('general-purpose registers') scoped to a thread. It is distinguishable from siblings like pin_read_mem and pin_write_mem by resource, though it does not explicitly contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites (e.g., whether the thread must be paused/stopped first), and no mention of the default tid=0 behavior in prose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_resumeA
Resume after an event. eid defaults to the last received event (PROCESS_STARTED=1, BREAKPOINT=5, STEP=6).
| Name | Required | Description | Default |
|---|---|---|---|
| eid | No | Event id to resume; omit to use last event |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It helpfully discloses the default behavior of eid (defaults to the last received event) and the meaning of event-type codes, but says nothing about prerequisites (the process presumably must be paused), side effects, or reversibility of resuming execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly packed sentences with the verb front-loaded and the default-parameter note following. No wasted words; the only mild deduction is that the parenthetical event-code list slightly burdens the second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter command with no output schema and no annotations, the description covers the parameter default and event codes but omits the operational state required to call it (must be stopped at an event). It is adequate but leaves a real gap for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so a baseline of 3 applies, but the description goes beyond the schema by enumerating what the eid values mean (PROCESS_STARTED=1, BREAKPOINT=5, STEP=6), which is not present in the parameter definition itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Resume') and the trigger context ('after an event'), which is enough to distinguish it from the opposite action pin_pause and from pin_step. However it never names a sibling, so the differentiation relies on the agent inferring the pause/resume pairing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'after an event' implies this is used to continue execution once stopped at a breakpoint/step, but there is no explicit when-to-use or when-not-to-use guidance and no reference to pin_pause, pin_step, or pin_stop as alternatives. Usage is only inferable from context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_set_traceB
Set tracing flags (TF_TRACE_INSN=2, TF_REGISTERS=0x10, TF_TRACE_EVERYTHING=0x40). Combine with bitwise OR.
| Name | Required | Description | Default |
|---|---|---|---|
| flags | Yes | Bitmask. 0x12 = insn+regs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not disclose that this mutates process state, whether it requires the target to be paused, whether changes take effect immediately or on next launch, or what happens to previously set flags. The flag constants are useful but they are parameter data, not behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action, followed by the combinability rule. No filler, no repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The single required parameter is fully specified, so the core call is answerable. However, with no annotations and no output schema, and with siblings covering launch/pause/resume/read, the description should say more about when this is valid and what effect it has — that gap leaves the agent to infer operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already gives the 0x12 example, but the description adds the named constants (TF_TRACE_INSN=2, TF_REGISTERS=0x10, TF_TRACE_EVERYTHING=0x40) and the OR-combination rule that the schema does not encode since there are no enums. This meaningfully extends what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Set') and resource ('tracing flags'), and enumerates the concrete flag constants, so the agent can tell it apart from siblings like pin_trace_count or pin_status. It lacks any explicit sibling differentiation, but the purpose itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage hint is 'Combine with bitwise OR', which is a syntactic note rather than a when-to-use rule. It never says whether flags must be set before launch, while paused, or which of the pin_* siblings to prefer for inspecting trace results.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_statusB
PIN session status: connected, last event, paths.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses returned fields (connected, last event, paths), which is useful, but omits whether the operation is read-only, requires an active session, or has any auth or rate-limit constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence front-loads the purpose and returned fields with no wasted words. 'paths' is unexplained, but the overall structure is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description is the only source for return-value information. It lists key status fields but leaves their meaning and session prerequisites vague. It is minimally adequate for a zero-param status tool, but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics to document. Schema coverage is 100% but empty; the baseline for a no-parameter tool is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the resource (PIN session status) and lists key returned fields (connected, last event, paths), making it distinguishable from mutating siblings like pin_pause and pin_step. However, it lacks an explicit verb and does not directly name alternatives, so sibling differentiation remains implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no prerequisites, and no comparison to sibling tools such as pin_events or pin_meminfo. The agent must infer usage entirely from the name and returned fields.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_stepB
Single-step the given OS thread (tid 0 = last event thread).
| Name | Required | Description | Default |
|---|---|---|---|
| tid | No | OS thread id |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It does not state whether the call blocks until the step completes, whether the thread must already be halted, how other threads are affected, or what the result indicates — significant gaps for a tool that mutates execution state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the special-value convention appended in parentheses; no wasted words and the operation is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description covers the parameter's semantics adequately but omits preconditions (paused state) and timing/blocking behavior. It is minimally sufficient but leaves real gaps an agent would care about before invoking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema documents tid only as 'OS thread id'. The description adds genuine meaning by defining the special value tid 0 = last event thread, which the schema does not convey, so it exceeds the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('single-step') and resource ('the given OS thread'), which is clearly distinct from sibling operations like pin_resume, pin_pause, and pin_stop. It does not explicitly name or contrast with those siblings, so it falls short of the 5 bar.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the noun phrase 'single-step' in a debugging context, and the tid=0 convention hints at the common no-argument case. However, it never says when to step versus resume/pause, nor whether a precondition (thread must be paused/halted) is required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_stopA
Send EXIT to the pintool and kill the PIN process tree.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It clearly discloses the destructive outcome (kill the PIN process tree) and the mechanism (send EXIT), but omits whether termination is graceful, whether it waits for completion, permission requirements, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the core behavior efficiently and is appropriately sized for a zero-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-argument stop/kill tool with no annotations or output schema, the description is nearly complete—it conveys the essential destructive action. A bit more detail on side effects or reversibility would make it fully complete, but the core need is met.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, and the schema is empty with 100% coverage of that emptiness. Per the scoring rules for 0 params, the baseline is 4; the description adds no parameter information because there is none to add.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the action (send EXIT to the pintool) and the result (kill the PIN process tree), which clearly distinguishes it from siblings like pin_pause or pin_resume. However, it does not explicitly name or route to any alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as pin_pause, pin_resume, or pin_launch. It lacks any when/when-not conditions or prerequisites, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_trace_countB
Number of recorded trace events currently buffered.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It hints that the count is of 'currently buffered' events (implying a volatile snapshot), but says nothing about read-only nature, permissions, blocking behavior, or how the count relates to other trace operations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core concept without any extraneous wording. It is appropriately sized for a simple query tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool, the description should clarify the return value and its context. It gives the concept ('number of recorded trace events currently buffered') but omits details like numeric type, whether the buffer has a maximum, or how it interacts with pin_events, leaving clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics burden. The baseline for zero-param tools is 4, and the description does not need to add parameter information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific quantity (number of recorded trace events currently buffered), which is clear and concrete. However, it does not differentiate the tool from siblings like pin_events, which likely lists events rather than counting them, so an agent must infer the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as pin_events or pin_status. The description only defines what is returned, leaving usage context entirely implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pin_write_memC
Write hex bytes to target memory.
| Name | Required | Description | Default |
|---|---|---|---|
| ea | Yes | ||
| hex | Yes | Hex string without 0x, e.g. 90c3 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. For a memory-mutation tool it says nothing about required target state (paused vs running), whether writes to code/read-only regions are permitted, reversibility, or what the call returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no filler; the verb and object are front-loaded. It is efficient, though its brevity reflects under-specification rather than deliberate concision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a state-mutating tool with no annotations, no output schema, and one undocumented parameter, the description is too thin. An agent cannot tell what 'ea' means, what preconditions apply, or how failures/partial writes are reported.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only the 'hex' parameter is documented in the schema (with format and example); 'ea' has no description anywhere. With 50% schema coverage, the description needed to compensate by explaining that 'ea' is the target effective address and clarifying hex encoding on the wire, but it adds nothing beyond the name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Write') and resource ('hex bytes to target memory'), which clearly separates it from the sibling pin_read_mem. It does not, however, name or differentiate against other siblings or clarify scope beyond the literal operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus pin_read_mem or the other pin_* tools, and no stated prerequisites such as whether the target must be paused before writing. The agent is left to infer the context entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
15 tool updates
v0.1.0- First observed
pin_add_bpt - First observed
pin_del_bpt - First observed
pin_events - First observed
pin_launch - First observed
pin_meminfo - First observed
pin_pause - First observed
pin_read_mem - First observed
pin_read_regs - First observed
pin_resume - First observed
pin_set_trace - First observed
pin_status - First observed
pin_step - First observed
pin_stop - First observed
pin_trace_count - First observed
pin_write_mem
TDQS
Scored across 15 tools
Each tool targets a distinct debugger operation: session control (launch/status/resume/pause/step/stop), event retrieval, breakpoint add/del, register/memory read/write, and tracing. The only slight adjacency is pin_events vs pin_trace_count, but the descriptions clearly separate debug events from buffered trace events.
All tools use a uniform pin_ prefix in snake_case with predictable verb_noun or noun forms (pin_add_bpt, pin_read_mem, pin_set_trace, pin_status). No mixed conventions or casing inconsistencies.
15 tools is well-scoped for a debugger/instrumentation control surface, with each tool covering a necessary operation rather than redundant variants. The count supports full session lifecycle without bloat.
Core debugger coverage is strong: launch/attach, breakpoints add/remove, stepping, memory read/write, register read, memory map, tracing, and teardown. Notable gaps remain: no pin_write_regs (only read), no breakpoint enumeration/list, and no module/symbol lookup, which slightly limits register and breakpoint management workflows.
Maintenance
Related MCP Connectors
Reasoning, code, anti-deception, memory harness MCP tools. Stdio or HTTPS api.ejentum.com/mcp
Multiple MCP tools, persistent graph memory, token-saving data pointers, and more.
Live browser debugging for AI assistants — DOM, console, network via MCP.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceA headless IDA Pro MCP server that enables AI agents to automatically open, analyze, and query multiple binary files simultaneously without manual GUI interaction. It provides 36 tools for tasks like decompilation, disassembly, and cross-reference analysis through IDA's idalib library.12-
- FlicenseBqualityBmaintenanceA simple MCP server exposing persistent, scriptable Frida dynamic instrumentation to an AI agent for Windows reversing, malware/security analysis, and dynamic debugging.19-
- AlicenseNot gradedqualityBmaintenanceAn MCP server that exposes dynamic binary instrumentation, memory editing, pointer scanning, and scripting capabilities to AI agents, enabling real-time process inspection and modification.MIT
- AlicenseNot gradedqualityAmaintenanceHeadless reverse engineering MCP server integrating IDA Pro for static analysis and x64dbg for dynamic debugging via controlled MCP tools.3GPL 3.0