Skip to main content
Glama

map_native_address

Read-onlyIdempotent

Maps module-relative addresses to local ELF PT_LOAD segments for Ghidra/REA follow-up, requiring page size; reports runtime address, RVA, virtual address, file offset; digest verifies identity.

Instructions

Map an observed module-relative address into an explicit local ELF’s PT_LOAD segments for REA/Ghidra follow-up. Requires the target page size. Reports separate runtime address, module RVA, ELF virtual address and possible file offset. File identity remains unverified unless the caller supplies a matching runtime artifact digest.

Input Schema

NameRequiredDescriptionDefault
pathYes
page_sizeYes
module_baseYes
expected_sha256No
runtime_addressYes
ghidra_image_baseNo
analysis_project_idNoOptional investigation to retain this tool result in. Does not prove target identity or causal relationships.
normalize_thumb_pointerNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.4.0

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive behavior, so the bar is lower. The description still adds real value: it lists what the result reports (runtime address, module RVA, ELF VA, possible file offset) and warns that file identity is unverified unless a matching digest is supplied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences with no filler, front-loading the core mapping action before the caveats. Well-structured and appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering the safety profile and no output schema, the description usefully explains the returned fields and the identity caveat. The remaining gap is coverage of several input parameters, but overall it's complete enough to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 13%, so the description must compensate, and it only partially does. It clarifies page_size (required, target page size), the digest's role for identity, and the address concepts, but leaves module_base, runtime_address, ghidra_image_base, and normalize_thumb_pointer unexplained beyond their schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('map an observed module-relative address') and resource (an explicit local ELF's PT_LOAD segments), plus the follow-up context (REA/Ghidra). It doesn't explicitly contrast with the very similar sibling address_to_file_offset, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'for REA/Ghidra follow-up' gives a situational hint and it states the page-size requirement, but it never says when to pick this over address_to_file_offset or address_name, nor when it's inapplicable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools