IDA Pro MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@IDA Pro MCPlist all functions in the currently loaded IDB with addresses"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
IDA Pro MCP
本仓库维护者:Moer2831 · GitHub @Moer2831 · 仓库:https://github.com/Moer2831/ida-pro-mcp
直接来源是增强版 QiuChenly/ida-pro-mcp-enhancement,其上游为 mrexodia/ida-pro-mcp。本仓库在其基础上继续维护:保留 Broker 纯路由架构、客户端侧 SQLite 静态缓存接管层与严格类型协议,并新增 stdio 端自动拉起 Broker 等便利改动。
一套面向 IDA Pro 的 MCP(Model Context Protocol) 服务端,让大模型以结构化工具调用的方式读写 IDA IDB,用于逆向工程、二进制分析、Hook 开发等场景。
英文原版文档请参阅 README.en.md。本 README 描述的是在上游之上增强过的 Broker 架构与 SQLite 静态缓存接管层。版本改动记录见 CHANGELOG.md。
示例视频与 prompt:见 mcp-reversing-dataset。
快速开始(GUI IDA + 任意 MCP 客户端)
① 装到本机 Python 环境 pip install -e . (见"三、安装")
② 部署 IDA 插件 见"三、安装 → 部署 / 更新插件" (Windows 必须手动铺一次)
③ 配置 MCP 客户端 见"七、使用方式" (DSH / Cursor / Claude 各有配方)
④ 打开 IDA 加载二进制 插件自动连 Broker,缓存自动开始构建(不需要按 Ctrl+Alt+M)
⑤ 在客户端里调用工具 mcp__ida__decompile / list_funcs / find_regex / cache_status ...三个最容易踩的坑,先记住:
IDA 只扫描自己的插件目录(
%APPDATA%\Hex-Rays\IDA Pro\plugins),仓库目录它不认识; 改了仓库代码必须重新部署,否则 IDA 跑的还是旧拷贝(这是"改了没生效"的头号原因)。Broker 由 MCP 客户端启动:客户端以 stdio 启动
ida-pro-mcp时会在回环地址自动拉起 Broker, IDA 插件只负责注册与退避重连;没有客户端时请在终端手动ida-pro-mcp --broker。用 Output 窗口确认版本:出现
[MCP] 插件代码: ... (缓存 schema v2)与 带配置后缀的[MCP][cache] 守护线程启动 ... (scope=..., chunk=...)才算新版生效。
Related MCP server: IDA Pro MCP
一、项目亮点(本增强版 vs. 上游)
Broker 进程纯路由:独立监听
127.0.0.1:13337,IDA 实例与所有 MCP 客户端都只和它交互;多 Cursor 窗口、多 IDA 同时挂载不再抢端口。客户端侧 SQLite 静态缓存(
xxx.idb.mcp.sqlite):IDA 插件在 IDA idle 时由守护线程把字符串、函数、全局、导入、交叉引用全量落地到 IDB 旁的 SQLite 文件。缓存接管 tools/call:
find_regex / entity_query / list_funcs / list_globals / imports / refresh_cache / cache_status共 7 个工具在 IDA 插件进程内部被 直接用本地 SQLite 响应,完全不占用 IDA 主线程。严格类型协议:全部新增 API 的请求/返回走
TypedDict(FindRegexArgs / FindRegexResult / ToolSchema / McpToolCallResult等),消除"字段是否存在"之类的不确定性。Broker 注入虚拟工具:
refresh_cache与cache_status作为虚拟ToolSchema追加到tools/list结果中,模型可以直接看到并调用,但它们并不在 Broker 执行,最终仍被路由到指定 IDA 实例。idalib 无头模式:通过
idalib-mcp运行纯 headless 服务,支持--isolated-contexts做严格的每连接上下文隔离。stdio 端自动拉起 Broker(本仓库新增):MCP 客户端(Cursor / Grok / Claude / VS Code…)以 stdio 启动本进程时,若本机没有监听中的 Broker,会自动用隐藏窗口(Windows
Start-Process -WindowStyle Hidden)/ 独立会话(POSIXstart_new_session=True)拉起一个,避免"忘记先开 Broker"导致instance_list为空;该行为只对回环地址生效(127.0.0.1/localhost/::1),远程 Broker 不会被自动拉起,可用--no-auto-broker关闭。大库内存重写(2.1.0):缓存构建从"整库物化成 Python 对象 + 单事务全量重写"改为分块流式提取 + 影子表原子切换 + 表级指纹增量,峰值内存 O(全库) → O(块),且块间让出 IDA 主线程不再卡界面;查询侧补齐
ea索引、去掉多余的COUNT(*)全表扫描。完整清单见 CHANGELOG.md。零操作自启(2.1.0):缓存守护线程的生命周期绑定"当前 IDB"(
IDB_Hooks.loaded起、closebase停),与是否连上 Broker 解耦 —— 打开 IDB 就开始建缓存,不需要按 Ctrl+Alt+M,也不需要设任何环境变量;重连 Broker 也不会打断正在进行的构建。
二、环境要求
Python 3.11+(建议使用
idapyswitch切换到最新 Python)IDA Pro 8.3+(推荐 9.0+),不支持 IDA Free
支持任意标准 MCP 客户端:DSH(DeepSeek Harness)/ Cursor / Claude / Claude Code / Codex / VS Code / Gemini CLI / Cline 等
三、安装
pip uninstall ida-pro-mcp
pip install https://github.com/Moer2831/ida-pro-mcp/archive/refs/heads/main.zip本地开发安装:
cd ida-pro-mcp && uv venv && uv pip install -e .配置 MCP 客户端和 IDA 插件:
ida-pro-mcp --install安装完成后请完全重启 IDA 和 MCP 客户端。某些客户端(如 Claude Desktop)在后台常驻,需要从托盘图标退出。IDA 插件菜单需要先加载一个二进制文件才会出现。
部署 / 更新 IDA 插件(Windows)
IDA 只扫描两个插件目录,仓库目录它不认识:
<IDADIR>\plugins(系统级)%APPDATA%\Hex-Rays\IDA Pro\plugins(用户级,免管理员)
ida-pro-mcp --install 会优先创建符号链接,失败则退化为拷贝(Windows 默认没有符号链接权限)。
因此改了仓库代码必须重新部署,否则 IDA 加载的仍是旧拷贝 —— 典型症状是"缓存还在用老实现 / 没有新增功能"。
# 1) 完全退出 IDA(含 ida64 / idat64)
# 2) 删掉旧插件
$dep = "$env:APPDATA\Hex-Rays\IDA Pro\plugins"
Remove-Item "$dep\ida_mcp.py","$dep\ida_mcp","$dep\broker" -Recurse -Force -ErrorAction SilentlyContinue
# 3) 从仓库拷贝新版(把 $repo 换成你的克隆路径)
$repo = 'D:\path\to\ida-pro-mcp\src\ida_pro_mcp'
Copy-Item "$repo\ida_mcp.py" "$dep\ida_mcp.py" -Force
Copy-Item "$repo\ida_mcp","$repo\broker" $dep -Recurse -Force
# 4) 重新打开 IDA:Output 首行应出现 [MCP] 插件代码: ... (缓存 schema v2)等价做法(会同时刷新 MCP 客户端配置):ida-pro-mcp --install。
四、总体架构
下面这张图描述本增强版的所有运行时组件与数据流。
flowchart LR
subgraph Clients[MCP 客户端]
CurA[Cursor 窗口 A]
CurB[Cursor 窗口 B]
Claude[Claude / Codex / VS Code ...]
end
subgraph MCPProc[MCP 进程 - 每个客户端各一份]
direction TB
MA[ida-pro-mcp 进程 A - stdio]
MB[ida-pro-mcp 进程 B - stdio]
DispatchProxy[dispatch_proxy - tools/list 注入虚拟工具 / tools/call 走路由]
end
subgraph BrokerProc[Broker 进程 - 127.0.0.1:13337 - 唯一监听]
Registry[IDA 实例注册表]
Router[纯路由 HTTP + SSE]
end
subgraph IDAProc[IDA 插件进程]
Plugin[ida_mcp 插件 - handle_mcp_request]
CacheHandlers[cache_handlers - 本地拦截 7 个缓存工具]
Daemon[sqlite_cache 守护线程 - idle 时刷新]
DB[(xxx.idb.mcp.sqlite)]
IDAAPI[IDA / Hex-Rays API]
end
CurA -- stdio --> MA
CurB -- stdio --> MB
Claude -. stdio .-> MA
MA -- HTTP JSON-RPC --> Router
MB -- HTTP JSON-RPC --> Router
MA --> DispatchProxy
MB --> DispatchProxy
Router <-- HTTP 注册 + SSE 推送 --> Plugin
Plugin -- 先命中? --> CacheHandlers
CacheHandlers -- 只读 --> DB
Plugin -- 未命中 --> IDAAPI
Daemon -- 采集 --> IDAAPI
Daemon -- 批量写入 --> DB关键点:
MCP 进程不绑端口:每个客户端窗口自己启动一份
ida-pro-mcp(stdio),它们全部把请求通过 HTTP 丢给 Broker。Broker 只做路由:它不读 IDB、不读 SQLite,完全不碰业务逻辑;只负责把 JSON-RPC 请求按
instance_id扔给对应的 IDA 插件,并把 SSE 回写的响应拿回来。SQLite 读写都在 IDA 进程内:写由守护线程负责(idle 触发),读由
handle_mcp_request的拦截层负责(命中就查 DB,不再走 IDA API)。Broker 进程绝不 importsqlite_cache / sqlite_query。
五、一次 tools/call 的完整时序
sequenceDiagram
autonumber
participant LLM as 大模型 / MCP 客户端
participant MCP as ida-pro-mcp 进程 (stdio)
participant BRK as Broker 进程 127.0.0.1:13337
participant IDA as IDA 插件 handle_mcp_request
participant CACHE as cache_handlers + sqlite_query
participant HR as IDA / Hex-Rays
LLM->>MCP: tools/call find_regex(instance_id=...)
Note over MCP: dispatch_proxy 判断工具名命中 IDA 白名单
MCP->>BRK: HTTP JSON-RPC 转发
Note over BRK: 按 instance_id 查注册表
BRK-->>IDA: 通过 SSE 通道下发请求
IDA->>CACHE: is_cache_tool(req)?
alt 命中缓存拦截名单
CACHE->>CACHE: 打开 .mcp.sqlite (只读) 并检查 meta.status
alt status == ready
CACHE->>CACHE: SQL + REGEXP 查询
CACHE-->>IDA: TypedDict 结构化结果
else status != ready 或 DB 缺失
CACHE-->>IDA: JSON-RPC error -32001 缓存未就绪,稍后重试或 refresh_cache
end
else 未命中 (普通 IDA 工具)
IDA->>HR: 走 ida_mcp 正常 dispatch
HR-->>IDA: 结果
end
IDA-->>BRK: JSON-RPC response
BRK-->>MCP: HTTP 响应
MCP-->>LLM: tools/call 结果缓存未就绪时不会回退到实时 IDA API,而是直接向模型报错并提示稍后重试或先调用 refresh_cache。这是一种有意的硬性语义:避免在大模型未知状态下拿到"半新半旧"数据造成误判。
六、SQLite 缓存守护线程生命周期
stateDiagram-v2
[*] --> 未连接
未连接 --> 已连接: IDA 注册到 Broker
已连接 --> 首次写入: 守护线程检测 auto_is_ok() + hex-rays 初始化完成
首次写入 --> 写入中: status=building
写入中 --> 就绪: 全量写入完成 status=ready
就绪 --> 写入中: IDB 保存 / refresh_cache 触发 / 30 分钟兜底轮询
写入中 --> 错误: 采集或写入异常
错误 --> 写入中: 下一次 idle 自动重试
就绪 --> [*]: IDA 关闭 / 断开
写入中 --> [*]: IDA 关闭 / 断开缓存文件名固定为
<idb 路径>.mcp.sqlite,随 IDB 一起落盘。meta表记录status(building / ready)、last_updated等。使用 WAL 模式,允许写入进行中仍被只读
file:...?mode=ro连接查询(读到旧快照)。cache_status查询不抛错:文件缺失时返回{exists: false, status: "missing"}。重新索引触发时机(三种,任一满足即触发,触发后等待 IDA idle 再执行全量重建):
IDB 保存:IDA 每次保存数据库(Ctrl+S 或自动保存)时,
IDB_Hooks.savebase回调立即唤醒守护线程,确保重命名、新增函数等变更实时同步。主动调用
refresh_cache:MCP 客户端显式触发,绕过所有检查直接重建。30 分钟兜底轮询:定时唤醒时检查 IDB 文件 mtime,若与上次重建时一致则跳过,避免无意义的全量扫描。
七、使用方式(Broker 模式)
多个 IDA 实例、多个客户端窗口并用时,它们共享同一个 Broker(每个 IDA 用 instance_id 注册,互不抢端口)。
Broker 由客户端进程自动拉起,也可以手动常开:
现状说明:Broker 没有空闲自动退出 —— IDA 全部关闭后它仍会驻留,下次客户端启动直接复用(不会反复重启)。 插件本身不会拉起 Broker,它只负责注册与退避重连。
# 1. 启动 Broker(可选:客户端启动时会自动拉起本机 Broker)
uv run ida-pro-mcp --broker
# 或自定义端口
uv run ida-pro-mcp --broker --port 13337
# 2. 启动 MCP 客户端(Cursor / Claude / VS Code / DSH…),它们会通过 stdio
# 启动自己的 ida-pro-mcp 进程,并向上面的 Broker 发请求
# 3. 打开 IDA、加载二进制 —— 插件会自动注册并开始建缓存
# (只有自动连接失败时才需要按 Ctrl+Alt+M 手动重连)在 DSH(DeepSeek Harness)中配置
DSH 用 @deepseek-ai/dsh-mcp-client 把外部 MCP 服务器桥接成原生工具,工具名形如
mcp__<serverName>__<tool>。在 profile 的补丁层 $DSH_HOME/profiles/<profile>/cordis.patch.yml
里必须用 insert: 包一层 —— 顶层直接写 - id: ... 会被当成"覆盖一个不存在的行"而被忽略
(dsh --dump-config 会打印 patch: entry "..." not found):
- insert:
- id: mcp-ida
name: '@deepseek-ai/dsh-mcp-client'
config:
serverName: ida
transport: stdio
command: 'D:\path\to\ida-pro-mcp\.venv\Scripts\ida-pro-mcp.exe'webprofile 是patchReload: live:保存即生效,不需要重启 DSH。配好后模型侧会出现
mcp__ida__decompile、mcp__ida__list_funcs、mcp__ida__find_regex、mcp__ida__cache_status等工具(本机实测 66 个)。校验:
dsh --profile web --dump-config(组合树里应出现mcp-ida且无 patch 警告)。临时停用:给该行加
disabled: true。
远程访问
当 MCP 客户端(Cursor / Claude)运行在另一台机器上时,--broker 直接绑定 0.0.0.0,一个端口同时处理 IDA 插件和远程 MCP 客户端:
uv run ida-pro-mcp --broker --port 13337在远程机器的 MCP 客户端配置中:
{
"mcpServers": {
"ida-pro-mcp": {
"url": "http://<IDA机器的IP>:13337/mcp"
}
}
}IDB 打开后,在 IDA 中按 Ctrl+Alt+M,连接地址填 http://<机器IP>:13337。
安全提示:远程模式下 CORS 会自动放宽为
*。建议仅在可信网络中暴露端口,或配合 VPN/SSH 隧道使用。
多实例模式
同时分析多个二进制:打开多个 IDA,分别按 Ctrl+Alt+M 连上 Broker。
工具 | 说明 |
| 列出所有已连接 IDA 实例( |
| 获取指定实例的详细信息 |
本增强版不再提供"当前活动实例"的隐式状态,也没有 instance_switch / instance_current。每次调用业务工具(如 decompile、xrefs_to、find_regex 等)时都必须在 arguments 里显式带 instance_id,由 Broker 精确路由到目标 IDA。这样做是为了避免多个 MCP 客户端共享同一个 Broker 时相互踩隐式状态。
八、命令行参数
参数 | 说明 |
| 安装 IDA 插件 + 各 MCP 客户端配置 |
| 卸载 IDA 插件 + 各 MCP 客户端配置 |
| 启用调试器等不安全工具( |
| 启动 Broker HTTP 服务器(0.0.0.0),同时提供 MCP 协议端点和 IDA 注册端点 |
| 当前 MCP 进程要连的 Broker 地址,默认取环境变量 |
| 关闭 stdio 模式下的 Broker 自动拉起(仅当 |
| Broker 监听端口,默认 13337 |
| 打印当前 MCP 配置 |
Broker 地址也可由环境变量指定:
IDA_MCP_BROKER_URL=http://127.0.0.1:13337 ida-pro-mcp启用调试器工具
{
"mcpServers": {
"ida-pro-mcp": {
"command": "uv",
"args": ["run", "ida-pro-mcp", "--unsafe"]
}
}
}九、缓存相关工具
工具 | 语义 | 错误行为 |
| 正则搜索字符串表,含 xrefs | status != ready 时抛 |
| 统一实体查询,kind ∈ | 同上 |
| 函数列表,可带 xrefs | 同上 |
| 全局变量列表 | 同上 |
| 导入表列表 | 同上 |
| 唤醒目标 IDA 的缓存守护线程,立即返回 | 永不抛错 |
| 查询缓存文件是否存在、 | 文件不存在时返回 |
错误码约定:
-32001:缓存未就绪 / 文件缺失-32000:未提供instance_id或没有活动 IDA 实例-32602:参数错误(如entity_query.kind非法)-32603:SQLite 查询内部异常
十、非缓存工具总览
以下工具仍走 IDA API 正常 dispatch,由插件进程通过 @idasync 在 IDA 主线程执行。
下列工具均为代码中真实注册的工具名(以仓库 api_*.py 中的 @tool 定义为准),若有出入请以源码为准。
核心查询
lookup_funcs(queries)按地址或名称获取函数int_convert(inputs)十进制 / 十六进制 / 字节 / ASCII / 二进制互转decompile(addr)/disasm(addr)反编译 / 反汇编xrefs_to(addrs)/xref_query(queries)/xrefs_to_field(queries)交叉引用callees(addrs)被调用函数func_profile(queries)快速获取函数画像(prolog / 返回 / 基本块摘要等)
修改
set_comments(items)反汇编与伪代码视图同时写注释patch_asm(items)汇编级补丁declare_type(decls)在 IDB 本地类型库声明 C 类型define_func(items)/define_code(items)/undefine(items)函数 / 代码定义控制
内存读取
get_bytes(addrs)/get_int(queries)/get_string(addrs)/get_global_value(queries)
栈帧
stack_frame(addrs)/declare_stack(items)/delete_stack(items)
结构体
read_struct(queries)/search_structs(filter)
高级分析
py_eval(code)在 IDA 上下文执行任意 Pythonanalyze_function(addr, ...)单函数深入分析(反编译 + 汇编 + xrefs + 调用关系 + 基本块 + 常量 + 字符串)analyze_batch(queries)批量版analyze_functionanalyze_component(...)以入口为根的组件级分析(调用树 + 数据流摘要)diff_before_after(...)前后快照差异分析trace_data_flow(...)数据流追踪
模式搜索
find_bytes(patterns)字节模式搜索(支持48 8B ?? ??)insn_query(queries)按助记符 / 操作数语义的指令序列查询find(type, targets)立即值 / 字符串 / 数据与代码引用统一搜索
控制流 / 类型 / 导出 / 图
basic_blocks(addrs)set_type(edits)/infer_types(addrs)export_funcs(addrs, format)导出为json / c_header / prototypescallgraph(roots, max_depth)
批量
rename(batch)函数 / 全局 / 局部 / 栈变量统一批量改名patch(patches)批量字节修补put_int(items)批量写整数
调试器(需 --unsafe)
控制:
dbg_start / dbg_exit / dbg_continue / dbg_run_to / dbg_step_into / dbg_step_over断点:
dbg_bps / dbg_add_bp / dbg_delete_bp / dbg_toggle_bp寄存器:
dbg_regs / dbg_regs_all / dbg_gpregs / dbg_regs_named / dbg_regs_remote / dbg_gpregs_remote / dbg_regs_named_remote栈 / 内存:
dbg_stacktrace / dbg_read / dbg_write
十一、MCP 资源(只读状态)
按 MCP 规范暴露的 ida:// 资源:
ida://idb/metadataIDB 元数据(路径、架构、基址、哈希)ida://idb/segments段与权限ida://idb/entrypoints入口点(main / TLS 回调等)ida://cursor当前光标 + 所在函数ida://selection当前选区ida://types本地类型ida://structs所有结构 / 联合ida://struct/{name}结构字段ida://import/{name}按名查导入ida://export/{name}按名查导出ida://xrefs/from/{addr}从地址出发的交叉引用
十二、SSE 传输与无头 idalib
本增强版的 ida-pro-mcp 主入口默认通过 stdio 连接 MCP 客户端,Broker 模式 (--broker) 则直接提供 HTTP 端点(默认 0.0.0.0:13337),单端口承载全部功能:
uv run ida-pro-mcp --broker该端口同时提供:
/mcp— Streamable HTTP(MCP 客户端连接)/sse— MCP SSE 传输/register,/events等 — IDA 插件注册与 SSE 通道
无头模式由 idalib-mcp 提供(需安装 idalib)。可以启动时指定一个二进制:
uv run idalib-mcp --host 127.0.0.1 --port 8745 path/to/executable也可以不带初始文件启动,之后用 idalib_open(...) / idalib_close(...) 动态打开和关闭数据库:
uv run idalib-mcp --host 127.0.0.1 --port 8745stdio 客户端可使用:
uv run idalib-mcp --stdioidalib-mcp 是一个 supervisor:每个打开的数据库由独立 idalib worker 进程承载。若请求的 IDB 已经在运行插件的 GUI IDA 中打开,idalib-mcp 会优先路由到该 GUI 实例;GUI 实例消失后,下次请求会在可行时回退到无头 worker。需要让回退看到 GUI 中的改动时,请先保存 IDB。
工具可通过当前 MCP 上下文绑定的数据库执行,也可以显式传 database 参数指定 session ID、文件名或输入路径:
uv run idalib-mcp --stdio --max-workers 4每个 worker 都是独立进程、各自加载一整份数据库,默认上限 4(--max-workers / IDA_MCP_MAX_WORKERS)。历史上会话只在显式 idalib_close 时才释放,长期挂着的 worker 会一直占内存;现在可以开启空闲回收:
uv run idalib-mcp --max-workers 2 --idle-ttl 600 --idle-sweep 30--idle-ttl SEC(环境变量IDA_MCP_IDLE_TTL_SEC,默认0= 关闭):会话空闲超过该秒数后自动close_database()释放内存。--idle-sweep SEC(环境变量IDA_MCP_IDLE_SWEEP_SEC,默认30,最小1):回收线程的扫描周期。绑定在活跃上下文上的会话永远不会被回收(需先
idalib_unbind());正在自动分析的会话也会跳过。
idalib_open("/path/to/binary_a.exe", session_id="binary_a")
idalib_open("/path/to/library.dll", session_id="library")
decompile("main", database="binary_a")
xrefs_to("ImportantExport", database="library")需要严格的每传输上下文隔离时启用 --isolated-contexts:
uv run idalib-mcp --isolated-contexts --host 127.0.0.1 --port 8745 path/to/executable--isolated-contexts 的语义:
每个传输上下文(
/mcp的Mcp-Session-Id、/sse的session、stdio 的stdio:default)都有自己独立的 session 绑定。未绑定上下文调用 IDB 依赖工具会直接失败,避免跨 Agent 误操作。
多 Agent 想共享同一 session 时,可以传
database=...或通过idalib_switch(session_id)主动加入。
上下文管理工具:
idalib_open(input_path, ...)打开并绑定idalib_switch(session_id)切换绑定idalib_current()查当前绑定idalib_unbind()解绑idalib_list()列表,带is_active / is_current_context / bound_contexts / backend / pid
worker 控制:
--max-workers N:最大同时打开的数据库 worker 数(0表示无限制,默认4)IDA_MCP_MAX_WORKERS:--max-workers的环境变量默认值
十三、提示工程建议
大模型在进制转换、数学计算、混淆代码上容易出错。务必:
明确要求使用
int_convert工具做进制转换,不要让模型手算。必要时配合 math-mcp 做复杂运算。
混淆代码先做预处理再交给 LLM:字符串解密、导入哈希、控制流平坦化、代码加密、反反编译技巧。
用 Lumina 或 FLIRT 把开源库、C++ STL 先解掉。
一个适用于 crackme 场景的最小提示:
你的任务是在 IDA Pro 中分析一个 crackme。你可以使用 MCP 工具获取信息。总体策略:
- 先用 decompile / disasm 审阅反编译与汇编
- 对可疑代码加注释,然后把变量、参数、函数重命名为具有描述性的名字
- 必要时修正类型(尤其是指针、数组)
- 绝对不要自己做进制转换,一律用 int_convert
- 不要暴力破解,只从反汇编和简单 python 脚本中推导结论
- 分析完成后写一份 report.md,最后把找到的密码交给用户确认十四、常见问题
Q:IDA 插件连接失败 / instance_list 空?
先单独启动 Broker:
uv run ida-pro-mcp --broker(保持运行)再启动 Cursor / Claude / VS Code 等
在 IDA 里按 Ctrl+Alt+M 连接
如端口冲突:
ida-pro-mcp --broker --port 13338,并确保 IDA 插件与 MCP 客户端的broker-url一致
Q:调用 find_regex / list_funcs 等返回 -32001?
说明本地 .mcp.sqlite 还没写好,属于正常初始化期。可以:
调用
cache_status(instance_id=...)查看status与各表计数。调用
refresh_cache(instance_id=...)主动唤醒缓存守护线程。稍等片刻后重试。
Q:缓存文件在哪?能删吗?
就在 IDB 旁边:<idb 路径>.mcp.sqlite(和 .mcp.sqlite-wal / -shm 同目录)。随时可删;下次 IDA idle 时会重建。
Q:uv pip install -e . 提示 "Failed to clone files; falling back to full copy"?
这只是 uv 的 warning(reflink 跨卷失败),构建其实成功。本项目 pyproject.toml 已内置 [tool.uv] link-mode = "copy" 消除该提示。
Q:支持 IDA Free 吗?
不支持,IDA Free 没有插件 API。
Q:按 G 键跳转失败?
请更新到最新版本后重启 IDA:
uv pip install -e .Q:IDA 里报 [MCP] HTTP POST 失败 http://127.0.0.1:13337/register: <urlopen error [WinError 10061]>?
10061 = 连接被拒绝,即本机此刻没有 Broker 在监听,属于预期提示(不是插件故障):
启动 MCP 客户端(DSH / Cursor / Claude…)后它会自动拉起 Broker,插件会指数退避自动重连;
或者手动常开一个:
ida-pro-mcp --broker;确认是否在跑:
Get-NetTCPConnection -LocalPort 13337 -State Listen(日志见~/.ida-pro-mcp/broker-<port>.log)。
Q:缓存报 status=error, reason=Function can be called from the main thread only?
这是 2.1.0 之前的插件在 IDB 装载早期用 is_idaq() 误判"是否需要派发到主线程"导致的。
先确认 IDA 加载的是新版(Output 首行 [MCP] 插件代码: ... (缓存 schema v2)),否则按"三、安装 → 部署 / 更新 IDA 插件"重新铺一次。
Q:改了仓库代码,但 IDA 行为没变?
插件是拷贝部署到 %APPDATA%\Hex-Rays\IDA Pro\plugins 的,重新部署并重启 IDA 才会生效(同理,schema v2 这行是判断依据)。
十五、大库使用建议(内存与性能)
2.1.0 起,本节描述的实现已重写:缓存构建改为分块流式 + 影子表原子切换 + 表级指纹增量,峰值内存从 O(全库) 降到 O(块)。下面的"机制"描述的是当前实现; 历史实现(整库物化 + 单事务全量重写)的问题见 CHANGELOG.md。
当前实现的内存模型
提取在
broker/cache_extract.py里按游标切片:每块经一次execute_sync(..., MFF_READ)派发到 IDA 主线程,块间让出消息循环, 因此 GUI 不会长时间卡死;块大小按实测耗时自适应(默认目标 150 ms/块)。写入在
broker/cache_writer.py里进影子表<table>__new,最后一次事务内DROP→RENAME→ 建索引原子切换:读者要么看到旧快照、要么看到新快照, 不存在"表被清空"的窗口。每个表组会先做一遍"只哈希不建对象"的指纹(
shape默认 /full可选), 指纹未变则整组跳过写库。触发时机仍是三个:插件连接 Broker 后首次 IDA idle、每次保存 IDB (
IDB_Hooks.savebase())、30 分钟兜底轮询(IDBmtime未变则跳过)。 守护线程本身在打开 IDB 时就会启动(IDB_Hooks.loaded),关闭库时停止, 与 Broker 连接无关 —— 所以默认用法下你什么都不用做。缓存文件写在 IDB 旁边(
<xxx.i64>.mcp.sqlite及-wal/-shm); 构建结束会做一次wal_checkpoint(TRUNCATE),WAL 不会长期留着。
配置项(环境变量)
变量 | 默认 | 说明 |
|
| 设为 |
|
|
|
|
| 每块行数上限;峰值内存 ≈ 单块大小 |
|
| 每块目标耗时,用于自适应调整块大小(越小越不卡 UI) |
|
| 单表行数上限;超限则放弃该表本轮刷新(保留旧快照)并标记 |
|
| 进程 RSS 上限;超限则停止本轮刷新(保留旧快照)并降级为 |
|
|
|
|
|
|
建议
大库优先用
minimal范围 + 关掉增量以外的默认值:IDA_MCP_CACHE_SCOPE=minimal能直接砍掉最占空间的交叉引用表; 需要交叉引用时再切回full(切换会自动重建)。内存吃紧就给护栏:
IDA_MCP_CACHE_MAX_RSS_MB=2048, 超限时本轮刷新会放弃并保留旧快照,而不是把 IDA 拖爆。不想建缓存就用开关,不要再用"把 .mcp.sqlite 变成目录"的偏方: 设置
IDA_MCP_DISABLE_CACHE=1即可,语义清晰且可观测。无头模式(
idalib-mcp)不启动缓存守护线程,内存主要取决于并发 worker 数 (默认 4,见--max-workers/IDA_MCP_MAX_WORKERS):单库分析建议设为 1, 并开启空闲回收(--idle-ttl 600 --idle-sweep 30,见"十二、SSE 传输与无头 idalib")。让模型优先用分页工具:7 个缓存工具都支持
LIMIT/OFFSET; 避免用py_eval在 IDA 里遍历全库,也不要一次性索取"全部函数 / 全部字符串"。
排障与基准
cache_status现在会回报progress(阶段/表/已处理行/耗时/峰值 RSS)、partial、last_error、degraded_reason、tables_skipped、counts_source与schema_version。status=partial表示"还没有可用快照",status=ready+partial=1表示"有旧快照可用,但本轮刷新有问题"。基准(不需要 IDA,可在 CI 里当门禁):
python -m ida_pro_mcp.benchmark --rows 200000 --legacy python -m ida_pro_mcp.benchmark --rows 200000 --assert-peak-mb 64输出会给出"分块(新)"与"全量物化(旧)"的 Python 峰值内存、耗时与查询延迟, 并说明 RSS 列是进程级读数(权威指标是
tracemalloc峰值)。
十六、开发
核心实现位置:
src/ida_pro_mcp/server.py主 MCP 服务端入口(stdio / broker 双模式分发)src/ida_pro_mcp/idalib_server.pyidalib 无头服务端src/ida_pro_mcp/ida_mcp.pyIDA 插件入口与handle_mcp_requestsrc/ida_pro_mcp/ida_mcp/api_*.py所有业务工具与资源(纯 IDA 侧)src/ida_pro_mcp/broker/server.pyBroker HTTP + 注册表 + SSEsrc/ida_pro_mcp/broker/manager.pydispatch_proxy路由 + 虚拟工具注入src/ida_pro_mcp/broker/sqlite_cache.py插件侧 idle 守护 + 写入src/ida_pro_mcp/broker/sqlite_query.py插件侧只读查询(强类型)src/ida_pro_mcp/broker/cache_handlers.pytools/call的本地缓存拦截src/ida_pro_mcp/broker/cache_types.py全部协议TypedDict(JsonRpcRequest / Response / Error / ToolSchema / *Args / *Result)src/ida_pro_mcp/broker/cache_config.py缓存构建配置与环境变量解析(纯逻辑)src/ida_pro_mcp/broker/cache_extract.py游标式分块提取 + 表级指纹(无 IDA 依赖,可假后端单测)src/ida_pro_mcp/broker/cache_backend.pyIDAPython 后端适配器与主线程派发(run_on_ida_main)src/ida_pro_mcp/broker/cache_writer.py分块写入 + 影子表原子切换 + meta/进度src/ida_pro_mcp/broker/cache_rss.py零依赖 RSS 读数(内存护栏用)src/ida_pro_mcp/benchmark.py缓存层基准(峰值内存/耗时/查询延迟,可作 CI 门禁)
新增工具只需:
在对应的
api_*.py里写一个@tool+@idasync函数,带完整 Python 类型注解;用
Annotated[...]写参数说明,函数 docstring 就是暴露给模型的 tool description;MCP 服务端会自动扫描
api_*.py并注册,无需手动改 schema。
运行测试:
uv run ida-mcp-test tests/crackme03.elf -q
uv run ida-mcp-test tests/typed_fixture.elf -qMCP inspector 调试:
uv run mcp dev src/ida_pro_mcp/server.py覆盖率:
uv run coverage erase
uv run coverage run -m ida_pro_mcp.test tests/crackme03.elf -q
uv run coverage run --append -m ida_pro_mcp.test tests/typed_fixture.elf -q
uv run coverage report --show-missing不需要 IDA 的回归测试(CI 也是跑这一套):
cd tests && python -m unittest discover -s . -p "test_*.py" -v
python -m ida_pro_mcp.benchmark --rows 200000 --legacy --assert-peak-mb 64真 IDA(idalib)端到端集成测试,需要 IDADIR 指向 IDA 安装目录,否则自动跳过:
set IDADIR=D:\IDA
cd tests && python -m unittest test_cache_idalib -v十七、与其它 IDA MCP 的差异
市面上已有数个 IDA Pro MCP 实现,本仓库在上游 mrexodia/ida-pro-mcp 的基础上重点做了两件事:
把 Broker 做成纯路由,解决多客户端并发问题;
在客户端侧引入 SQLite 静态缓存,把高频只读查询从 IDA 主线程移走,让大模型在大规模分析场景下不再因 IDA API 往返而被拖慢。
其他实现(便于对比选型):
https://github.com/QiuChenly/ida-pro-mcp-enhancement 上游增强版(本仓库的直接来源,Broker 与 SQLite 缓存即出自这里)
https://github.com/taida957789/ida-mcp-server-plugin 仅 SSE,IDAPython 装依赖
https://github.com/fdrechsler/mcp-server-idapro TypeScript,新增功能需大量样板
https://github.com/MxIris-Reverse-Engineering/ida-mcp-server 自定义 socket,样板重
欢迎 PR 补充。
十八、许可证
见 LICENSE。
署名
本仓库维护者:Moer2831(Moer2831/ida-pro-mcp)
上游增强版作者:QiuChenly(ida-pro-mcp-enhancement)
上游原作者:mrexodia(ida-pro-mcp)
本项目源自上游 ida-pro-mcp,由 QiuChenly 增强实现 Broker 路由架构、SQLite 静态缓存接管与严格类型协议等特性,本仓库在其基础上继续维护并新增 stdio 端自动拉起 Broker 等改动。如在论文、博客或工具中使用,请同时署名上游作者、上游增强版作者与本仓库维护者。
Available Tools
66 toolsanalyze_batchC
Run comprehensive analysis over one or more target functions.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Comprehensive per-function analysis with selectable sections | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'Comprehensive analysis' is vague: it does not state what is returned, defaults for the many include_* flags, whether it is read-only, or any cost/latency characteristics of batching.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence, front-loaded with the verb and scope. It is efficient, though for a tool with such a rich option set it is arguably too terse to be fully useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex batch tool with a large per-query option schema, no output schema, and no annotations, the one-line description is not sufficient. It omits what the analysis yields, how results are aggregated across queries, and defaults for the include_* section flags.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (including the include_* flags and instance_id routing guidance) is documented in the schema itself. The description adds nothing beyond the schema, which is the correct baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (analyze) and resource (target functions), and 'one or more' signals a batch variant of the per-function analysis. It does not name analyze_function explicitly, so sibling differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Only 'one or more target functions' hints at when to use this over analyze_function; there are no explicit when/when-not conditions, no mention of alternatives, and no prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_componentC
Analyze related functions as a group: per-function summaries, internal call graph, shared data.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Function addresses (comma-separated or list) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It never states that this is a read-only operation, whether it is expensive/slow on large address sets, any limit on the number of addrs, or whether results are cached. For an analysis tool with zero annotation coverage this is a real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with a clear verb-resource pair and an enumeration of return content; nothing is wasted. It is terse to the point of omitting useful guidance, but structurally sound.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description does tell the agent what comes back (per-function summaries, internal call graph, shared data), which is helpful without an output schema. However, given no annotations and no usage constraints, the definition is only minimally sufficient for a tool that takes an arbitrary set of addresses.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are documented in the schema, including the routing purpose of instance_id. The description adds no format or constraint details (e.g. how many addresses are reasonable, whether addresses must belong to one component), so it lands at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Analyze) and resource (related functions as a group), and enumerates the three outputs, which separates it from the singular analyze_function and the bulk analyze_batch. It does not directly name those siblings, so the differentiation is inferable rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance is given. With siblings like analyze_function, analyze_batch, and callgraph in the list, the agent must guess why it would pick this grouped analysis over a single-function analysis or a call-graph query. Only the phrase 'as a group' implies a selection condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_functionB
Compact single-function analysis: pseudocode, strings, constants, callers, callees, xrefs, blocks.
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Function address or name | |
| include_asm | No | Include full disassembly (default: false, saves tokens) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it partially does so by flagging 'Compact' and (via the schema) the token-saving default for disassembly. However, it never states that this is a read-only operation, whether results are cached, or what the response shape looks like, leaving meaningful gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence that leads with the scope ('Compact single-function analysis') and then lists the returned artifacts. Nothing is wasted, though the noun-list style is terse enough that it reads more like a schema than guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter read-only analysis tool with full schema coverage but no output schema, the enumeration of returned artifacts largely substitutes for a return-value spec, and the compact/token caveat covers the one behavioral nuance. Missing sibling differentiation and any explicit invocation prerequisites keep it short of a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema documents all three parameters including the token-saving intent of include_asm and the instance routing requirement. The description adds no syntax, address-format, or routing detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('single-function analysis') and enumerates exactly what it returns: pseudocode, strings, constants, callers, callees, xrefs, blocks. It does not differentiate itself from near siblings like decompile, analyze_batch, or analyze_component, so an agent cannot tell from the text alone why this one fits rather than those.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance and no mention of alternatives, despite siblings such as analyze_batch (for multiple functions) and decompile (for single-purpose output) being obvious candidates. The word 'single-function' loosely implies scope, but nothing tells the agent when to prefer this over the alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
append_commentsC
Append comments at addresses, deduping exact text by default.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral disclosure burden. It mentions deduping exact text by default, but that same detail is already in the schema. It does not disclose permissions required, whether it modifies the database persistently, how it interacts with existing comments, or whether a save is needed afterward.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It is appropriately sized for a concise tool summary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and a required routing parameter, the description is too sparse. It omits when to use the tool, the necessity of providing `instance_id` or calling `instance_list`, and any post-append persistence implications.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%. The description maps loosely to `addr`, `comment`, and `dedupe` via 'at addresses,' 'comments,' and 'deduping,' but adds little beyond the nested schema descriptions. The required `instance_id` routing parameter is not mentioned in the description, leaving a gap the schema partially fills.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Append comments at addresses.' It also notes deduping behavior. However, it does not explicitly differentiate from the sibling tool `set_comments`, which would help an agent choose correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives like `set_comments`, nor are prerequisites (e.g., required `instance_id`, calling `instance_list` first) mentioned in the description. Usage is only implied by the verb 'append.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
basic_blocksC
Return function CFG blocks with offset/max_blocks pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | 函数地址。获取该函数的基本块及控制流。支持 hex、符号名。 | |
| offset | No | Skip first N blocks (default: 0) | |
| max_blocks | No | Max basic blocks per function (default: 1000, max: 10000) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden and largely drops it. It does not state that the call is read-only/non-mutating, does not mention the required IDA instance routing or instance_list prerequisite, and says nothing about output shape, ordering, or behavior when max_blocks truncates a function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler wastes nothing. It is terse to the point of under-specification, but that is a completeness problem rather than a structure problem.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter tool with no annotations and no output schema, the description is far too thin. It never explains that addrs accepts multiple addresses or functions, what a returned block contains, or the routing prerequisite for instance_id, all of which the agent needs to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents addrs, offset, max_blocks, and instance_id in detail, which sets the baseline at 3. The description's mention of 'offset/max_blocks pagination' adds a light framing of their combined purpose but no syntax or semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: returns function CFG basic blocks, which is more precise than a generic 'analyze' tool. It does not, however, distinguish itself from adjacent siblings such as disasm, analyze_function, or func_profile, so an agent must infer the boundary itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use or when-not-to-use guidance and names no alternative. The only usage signal is implicit in the word 'CFG', leaving the agent to guess how this differs from disasm or analyze_function.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cache_statusA
查询指定 IDA 实例的本地 SQLite 静态缓存状态 (status / last_updated / 各表计数)。当 status != 'ready' 时,find_regex / entity_query / list_funcs / list_globals / imports 等工具将返回错误并提示稍后重试。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses the returned fields and a key side effect: dependent tools return errors and prompt retries when the cache is not ready. It does not cover permissions or whether the call itself mutates state, but for a status query it adds meaningful operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the purpose and return fields, then quickly states the conditional failure behavior. Every sentence carries useful information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, so the description must explain return values and behavior. It does so adequately by listing the status fields and describing the dependent-tool failure mode. It could mention how to resolve a non-ready cache (e.g., refresh_cache) for fuller completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage and fully documents the single required instance_id parameter, including guidance to use instance_list first. The description adds no parameter-level detail beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: querying the local SQLite static cache status of a specified IDA instance. It also enumerates return fields (status, last_updated, table counts). However, it does not explicitly differentiate from the sibling refresh_cache tool, which is the closest alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when the tool matters by explaining that dependent tools (find_regex, entity_query, list_funcs, etc.) fail when status is not 'ready'. It does not explicitly say when to call cache_status versus alternatives, nor does it mention refresh_cache as a remedy, leaving usage context only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
calleesB
Return unique callees per function, capped by limit.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | 函数地址。该函数内调用的目标列表。支持 hex、符号名、逗号分隔。 | |
| limit | No | Max callees per function (default: 200, max: 500) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses that results are unique and capped, but omits read-only safety, permission requirements, mutation behavior, error handling, and other operational traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with zero waste. Appropriately sized for a simple query tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description should ideally clarify return structure or ordering. It states the return content ('unique callees per function') but lacks detail about result format or pagination beyond the limit cap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds the notion of 'unique callees' but the parameters (addrs, limit, instance_id) are already fully documented in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Return') and resource ('unique callees per function'), plus the cap behavior. It's clear what it does, but it does not explicitly differentiate from siblings like callgraph or xrefs_to.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no when-to-use guidance, no alternatives, and no preconditions beyond what the schema already states (instance_id routing). An agent is left to infer when this tool is preferable to callgraph or xrefs_to.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
callgraphC
Build bounded callgraph from roots with depth/node/edge limits.
| Name | Required | Description | Default |
|---|---|---|---|
| roots | Yes | 起始函数地址或名称。从该函数开始遍历调用图。支持 hex、符号名。 | |
| max_depth | No | Maximum depth for call graph traversal | |
| max_edges | No | Max edges across the graph (default: 5000, max: 200000) | |
| max_nodes | No | Max nodes across the graph (default: 1000, max: 100000) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| max_edges_per_func | No | Max edges per function (default: 200, max: 5000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but only mentions that the graph is 'bounded' with limits. It does not disclose whether the operation is read-only, whether it modifies the IDB, what happens when limits are reached, or the return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with zero filler. It is appropriately sized for a brief summary, though the overall definition is under-specified for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given six parameters, two required, no annotations, no output schema, and a crowded sibling landscape, the description is far too sparse. It omits the required instance_id routing, usage context, and any behavioral traits, leaving major gaps that the schema alone cannot fill for an agent selecting a tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all six parameters including defaults and maxes. The description alludes to depth/node/edge limits, which map to three parameters, but adds no new meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb 'Build' and resource 'callgraph', with modifier 'bounded from roots'. It distinguishes itself from simple list tools like callees by implying traversal, but does not explicitly name or differentiate from any sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no when-to-use guidance, no prerequisites, and no alternatives. It simply states what the tool does, leaving the agent to infer when a bounded callgraph traversal is preferable to related tools like callees.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
declare_stackC
Create stack variables from typed stack declarations.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a mutation ('create') but says nothing about permissions, whether existing declarations are overwritten, reversibility, error behavior, or that requests are routed to a specific IDA instance. That is thin for a write operation with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste, which is good structure. But it is under-specified rather than genuinely concise, packing in too little for a mutation tool with two required parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations, with 50% parameter coverage and a bare one-line description. For a tool that mutates a database's stack layout, the agent lacks enough context on scope, routing, and side effects to call it confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: the nested item fields (addr, offset, name, ty) are documented in the schema, and instance_id carries a detailed routing note. The top-level description adds nothing about the 'items' shape, batch/Single item acceptance (anyOf), or instance_id routing, so it fails to compensate for the uncovered half.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Create stack variables' from 'typed stack declarations'. An agent understands the core action (defining stack variables on a function). However, it does not distinguish itself from close siblings like stack_frame, delete_stack, or set_type, so it's clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no reference to alternatives such as stack_frame or delete_stack. The agent gets no signal about which stack-manipulation tool to pick or in what context this one applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
declare_typeC
Declare C type definitions in local type library.
| Name | Required | Description | Default |
|---|---|---|---|
| decls | Yes | C type declarations | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, and it discloses very little. It does not say whether existing types are overwritten, whether declarations persist without an idb_save call, what happens on parse errors, or what the operation returns. 'Local type library' hints at scope but leaves the mutation semantics unexplained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, which is appropriately sized for the surface it covers. It is efficient, though the brevity here reflects under-specification rather than tight writing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with zero annotation coverage, no output schema, and several closely related type-mutation siblings, the description is too thin. An agent cannot tell from the text alone when to reach for declare_type versus set_type or type_apply_batch, nor what the effect on the IDB will be.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no information about decls beyond restating 'C type definitions', and notably does not explain the anyOf shape (single string vs array of strings) or whether multiple declarations are applied atomically.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a clear verb+resource: declaring C type definitions into the local type library. An agent knows what kind of operation this is. However, it does not distinguish itself from close siblings like set_type, type_apply_batch, or enum_upsert, so the boundary of its purpose is left implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all. The sibling list contains set_type, type_apply_batch, infer_types, and enum_upsert, and the description never says when declaring types here is preferable to those alternatives or what prerequisites apply beyond the schema's note about instance_id.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decompileB
反编译函数为伪代码(C 风格)。输入地址或符号名。返回 addr,code。失败返回 error。
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | 函数地址或名称。支持: 0x401000、401000、sub_401000、start、main。 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| include_addresses | No | Append /*0xNNNN*/ markers per line (default: true). Set false to save tokens. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses return fields (addr, code) and the failure mode (error), which goes beyond a bare decompile claim. However it says nothing about permissions, cost, or whether it is a safe read-only operation, leaving gaps given zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the operation, followed by input and output expectations. No filler, though the terseness leaves little room for context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description helpfully states the return shape (addr, code) and error behavior, and the schema richly documents the instance_id routing requirement including a pointer to instance_list. Complete enough for an agent to call it correctly, though usage-vs-sibling context is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (addr, instance_id, include_addresses) are already fully documented in the schema, including accepted address formats. The description adds no parameter detail beyond what the schema supplies, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('反编译函数为伪代码', decompile a function to C-style pseudocode) and names the output format, which distinguishes it from the assembly-producing sibling disasm. It does not name siblings directly, but the C-style pseudocode deliverable gives an agent enough to tell it apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of when to prefer decompile over disasm or analyze_function, and no preconditions stated. The accepted input forms (address or symbol) are given, but that is input format, not usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
define_codeC
Convert bytes to code instruction(s) at address(es).
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a mutation of the IDB (marking bytes as code), but does not disclose side effects, permission/routing requirements, reversibility, or interaction with existing disassembly. This is a significant gap for a database-mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the action front-loaded and zero filler. Efficient, though the minimalism contributes to the coverage gaps elsewhere.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description should clarify what 'convert' modifies, whether it changes disassembly, and any routing steps. It leaves the agent guessing about effects and requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%; the schema already documents the items subfields (addr, end) and the instance_id routing parameter. The description's 'at address(es)' loosely maps to items but adds no syntax, format, or batching detail beyond the schema. Baseline 3 is appropriate given the schema handles the specifics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (convert) and resource (bytes to code instructions) with address scoping. An agent can tell this marks code at addresses, distinct from define_func which creates a function. It does not explicitly name or contrast with sibling tools like define_func or undefine, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use, when-not-to-use, prerequisites, or alternatives (e.g., define_func, patch_asm, undefine). The agent must infer usage purely from the name and the surrounding tool list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
define_funcB
Define functions; IDA infers bounds unless end is provided.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations the description carries the full burden, and it does disclose one genuine behavioral trait: IDA infers bounds by default and only uses explicit bounds when 'end' is given. That is a useful default-behavior note, but the description says nothing about permissions, IDB mutation effects, reversibility, or failure behavior for what is a mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence pairs the verb+resource first and the behavioral caveat second, with zero filler. Its brevity reflects under-specification rather than verbosity, but the structure itself is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and half its parameters undocumented, the description is too thin. It omits what changes in the IDB, what constitutes success, and any prerequisites, leaving an agent without enough context to invoke it confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, so the description should compensate; it only partially does by referencing the 'end' parameter's effect. The 'addr' parameter and the 'start:end' syntax are left to the schema rather than clarified in the description, adding little beyond structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource ('Define functions'), which is clearly distinct from the broader sibling define_code. It does not, however, explicitly contrast itself with nearby siblings such as define_code or undefine, so the differentiation is implicit rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use, when-not-to-use, or alternative-tool guidance. The only conditional clause concerns the optional 'end' behavior, not tool selection, leaving the agent to infer all usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_stackC
Delete stack variables by name or offset.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it discloses almost nothing. It does not state that deletion is destructive/irreversible, whether it removes only the definition or also associated comments/types, what happens if the named variable does not exist, or any permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the verb and resource front-loaded and zero filler. Nothing bloated or redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation with no annotations, no output schema, and only half the parameters documented, the description is too thin. It should at minimum flag the destructive/irreversible nature and any coupled effects on dependent declarations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%; the items property itself is undocumented while nested fields (addr, name) and instance_id carry descriptions. The description's mention of 'offset' does not map cleanly to the schema's 'addr' field ('Function address'), which introduces ambiguity rather than resolving it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Delete) and resource (stack variables), plus the identification modes (name or offset), so the agent knows precisely what the tool targets. It does not differentiate itself from stack-manipulation siblings like declare_stack or stack_frame, which is the only gap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use, when-not-to-use, or alternatives guidance. The agent must infer that this is the inverse of declare_stack and when deletion is appropriate versus re-declaration, with nothing stated explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
disasmA
反汇编函数为汇编指令。输入地址或符号名。返回 addr,asm(行列表),cursor。支持 offset/分页。
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | 函数地址或名称。支持: 0x401000、start、main。 | |
| offset | No | Skip first N instructions (default: 0) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| include_total | No | Compute total instruction count (default: false) | |
| max_instructions | No | Max instructions per function (default: 5000, max: 50000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose the return shape (addr, asm line list, cursor) and that offset/pagination and total-count options exist, which is useful. It does not state that this is a read-only, side-effect-free operation, nor describe truncation behavior at the 5000/50000 instruction limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short clauses, front-loaded with the core action and followed by input, output, and paging details. Nothing is padded, though the listing style is terse rather than prose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only disassembly tool with no output schema, the description usefully enumerates the return fields and the pagination mechanism, and the schema covers every parameter including instance routing. Only the failure/truncation semantics are unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters are already documented in the schema (including the instance_id routing note). The description adds only the accepted address/symbol forms and confirms pagination, which largely duplicates the schema; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('反汇编函数为汇编指令' – disassemble a function into assembly instructions) and names the accepted input forms (address or symbol name). An agent can distinguish this from sibling 'decompile' since raw instruction output is clearly implied. It stops short of explicitly contrasting itself with that sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the raw-instruction framing suggests use when assembly rather than source-level output is needed, and the mention of offset/pagination hints at iterative reads. There is no explicit when-to-use, when-not-to-use, or named alternative such as 'decompile'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
entity_queryC
Query IDB entities with typed filters, projection, and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Generic entity query with filtering, projection, and pagination | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'Query' implies a read, but it never states read-only semantics, whether results are paginated by default, what the response shape is, or any limits. For a tool with no annotation coverage this is a meaningful omission.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It earns its brevity, though the extreme terseness leaves important behavior unstated rather than being a model of efficient completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool accepting batch/nested query objects across five entity kinds, with no output schema and no annotations, one sentence is not enough. Return values, pagination behavior, and how the typed queries compose are all left to the schema and inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every query field (kind, regex, filter, sort_by, min/max_addr, etc.) and the instance_id. The description's mention of filters/projection/pagination merely echoes the schema categories without adding syntax or semantics, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a verb (Query) and a resource (IDB entities) plus the categories of capability (filters, projection, pagination), so the basic purpose is legible. However, 'typed filters' is vague jargon and it does nothing to separate this generic tool from the many sibling query tools (func_query, imports_query, xref_query, type_query, list_globals). An agent cannot tell from the description alone which query tool to reach for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use, when-not-to-use, or alternative-tool guidance at all. With a dense family of sibling query tools, the absence of routing guidance is a real gap; the agent must fall back on guesswork or the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enum_upsertB
Create or extend local enums in an idempotent way.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Create enums if missing and upsert enum members without destructive replacement | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries full burden. It usefully discloses idempotency and non-destructive member upsert (reinforced by the schema's 'without destructive replacement'), but says nothing about permissions, how conflicting member values are resolved, or what happens to members omitted from the call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler, and the idempotency guarantee is stated immediately. It is arguably too terse given this is a mutating operation, but it is not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an upsert tool with no annotations and no output schema, the definition leaves real gaps: nothing about failure modes, partial-failure behavior, or what the result reports. The rich schema covers inputs well, but the operational semantics of the write remain underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter is documented nominally (queries, name, members, bitfield, instance_id). The description adds no parameter-level meaning beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (create/extend), resource (local enums), and a behavior (idempotent). 'Local enums' scopes it apart from general type tools like declare_type or set_type, but it never names a sibling, so the agent must infer the boundary itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no exclusions, and no mention of the sibling type-management tools (declare_type, set_type, type_apply_batch) that an agent would naturally weigh against this one. The only routing hint is in the instance_id schema text, not the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_funcsB
导出函数数据。format: json(含 asm/code/xrefs)、c_header、prototypes。输入地址或符号名。
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | 函数地址或名称。支持 hex、符号名(start/main)。导出为 json/c_header/prototypes。 | |
| format | No | Export format: json (default), c_header, or prototypes | json |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description carries the full burden. It adds useful disclosure that the json format bundles asm/code/xrefs, but says nothing about read-only nature, size/limit behavior, or how c_header/prototypes differ in output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and formats with no filler. It is terse to the point of being sparse but every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description only partially compensates, explaining what json contains but not what c_header or prototypes return, nor read-only/auth behavior. Adequate but with clear gaps for a tool with three documented params.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents addrs, format, and instance_id including the routing note. The description restates the input as address or symbol name and the format list, adding no semantics beyond the schema; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (export) plus resource (function data) with the supported formats named, so the agent knows exactly what the tool produces. It does not, however, differentiate itself from siblings like decompile, disasm, or list_funcs that also surface function content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no alternatives named; the agent must infer that this is the export tool versus decompile/disasm on its own. There are no exclusions or conditions that would route it away from a sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
findC
Search strings/immediates/refs for targets with offset/limit pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| type | Yes | Search type: 'string', 'immediate', 'data_ref', or 'code_ref' | |
| limit | No | Max matches per target (default: 1000, max: 10000) | |
| offset | No | Skip first N matches (default: 0) | |
| targets | Yes | Search targets (strings, integers, or addresses) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses pagination via offset/limit, which is useful, but says nothing about what is returned, error behavior, or the required instance routing/auth context (only in the schema). For a search tool over multiple target types this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though arguably too terse given the tool's five parameters and multiple search modes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter search tool with no annotations and no output schema, the description is minimally adequate. The rich schema carries parameter detail, but the description omits return-shape expectations and disambiguation from closely named siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents type, limit, offset, targets, and instance_id. The description adds only a terse mention of pagination and target categories, which the schema states more precisely. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a verb (search) and resource scope (strings/immediates/refs), which is more specific than the generic name 'find'. However, with siblings like find_bytes, find_regex, search_text, and func_query, the description never explicitly says how this tool differs from those alternatives, leaving the agent to infer differentiation from the target-type list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or named alternatives are given. The target types hint at the domain, but there is no guidance on choosing 'find' over find_bytes/find_regex/search_text, nor any prerequisites despite instance_id being required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_bytesC
Search byte patterns (supports ??) with offset/limit pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max matches per pattern (default: 1000, max: 10000) | |
| offset | No | Skip first N matches (default: 0) | |
| patterns | Yes | Byte patterns to search for (e.g. '48 8B ?? ??') | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It notes wildcard support and pagination, but both are already documented in the schema; it says nothing about whether the operation is read-only, how results are returned, or any instance-routing requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is tightly structured and front-loads the core action. It wastes no words, though its brevity leans toward under-specification rather than earned conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description does not explain the return format or result shape, nor does it mention the required instance_id routing requirement highlighted in the schema. For a search tool with several sibling alternatives, this leaves meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are documented in the input schema. The description only alludes to offset/limit pagination, which the schema already explains, so it adds no parameter meaning beyond the structured field documentation. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Search') and resource ('byte patterns'), and adds that wildcard '??' is supported. This distinguishes it from textual search siblings, but it does not explicitly differentiate itself from related byte-reader tools like get_bytes or pattern-search alternatives like find_regex.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus siblings such as find_regex, find, search_text, or get_bytes. The description only implies usage from the verb, with no conditions, prerequisites, or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_regexA
在二进制字符串中按正则搜索。返回 addr,string。不区分大小写。用于找硬编码字符串。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max matches (default: 30, max: 500) | |
| offset | No | Skip first N matches (default: 0) | |
| pattern | Yes | 正则表达式,在 IDA 识别的字符串中搜索。例: 'error|fail'、'password' | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the return shape and case-insensitive matching, but does not state that the operation is read-only, whether it searches all binary data or only IDA-recognized strings, or any other execution constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four short, front-loaded clauses that each add a distinct piece of information: search method, return fields, case behavior, and use case. There is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity read-only search tool with rich parameter descriptions but no output schema or annotations, the description gives the essential result fields and matching behavior. It could be slightly more complete by clarifying the search scope and read-only nature, but no critical information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents pattern, instance_id, limit, and offset. The description adds no parameter-specific syntax or format details beyond what the schema provides, making the baseline score of 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb (search), resource (binary strings), method (regex), return fields (addr, string), and case-insensitivity, so an agent can tell it apart from byte-search or general-search siblings. It does not explicitly name the closest alternative tools, so it falls just short of the top score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a clear intended use case: finding hardcoded strings. It does not state when not to use it or name alternatives such as find_bytes or search_text, so no exclusions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_xref_signaturesA
Find signatures for code locations that reference an address. For each input address, finds all code cross-references TO it, generates a unique signature at each xref site, and returns the shortest ones. Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Number of shortest signatures to return per address (default: 5) | |
| addrs | Yes | Address(es) or name(s) to find XREF signatures for (e.g. a data address referenced by code) | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| max_length | No | Maximum signature length in bytes (default: 250) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does explain the algorithm and output selection ('returns the shortest ones'), which is genuinely useful, but says nothing about permissions, rate limits, or failure modes (e.g., what happens when an address has no xrefs). Adequate but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core action, then the mechanism, then the ideal use case. No wasted text. Slightly more compact than strictly necessary but well structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations, so the description must cover behavior and returns. It explains the returned artifact (shortest signatures per address) and the format options come from the schema, leaving the definition reasonably self-sufficient, though it omits what is returned when no xrefs are found.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters (top, addrs, format, max_length, instance_id) including defaults and enum-like format values. The description adds no parameter-level detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('find signatures for code locations that reference an address') and clarifies the mechanism (finds code xrefs TO each address, generates a signature at each site). It implicitly distinguishes itself from direct signature siblings like make_signature by noting it serves addresses 'that can't be signatured directly,' though it does not name a sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear usage context: 'Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly.' This steers the agent toward the right scenario, but it stops short of naming alternatives (e.g., make_signature/make_signature_for_function) or stating when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
func_profileC
Profile functions with summary metrics and optional sampled details.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Function profiling query (supports name/address filters + pagination) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It hints at output shape (summary metrics, sampled details) but says nothing about read-only nature, cost/performance of profiling multiple functions, sampling behavior, or limits. For a profiling tool over potentially many functions, this is a notable gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no waste. It is efficient, though its brevity is partly responsible for the gaps in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and a rich nested query parameter, the description should do more to explain return contents and sampling. As written it is too thin for the complexity of the tool and its ambiguous positioning among many function-related siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the queries object documents every field (addr, filter, sort_by, include_lists, etc.), so the baseline is 3. The description adds no meaning beyond what the schema already spells out.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (profile) and resource (functions) plus a high-level sense of the output (summary metrics + sampled details). However, it does not distinguish itself from closely related siblings like analyze_function, func_query, or list_funcs, leaving the agent unclear on when this profiling view is preferred.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus analyze_function, func_query, or list_funcs. No prerequisites or exclusions are provided. The only usage-related clue is embedded in the instance_id schema description, not the tool description itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
func_queryB
Query functions with richer filtering than list_funcs.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Richer function query (size/type/name filters + pagination) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing: not that this is a read-only query, not pagination semantics (count=0 meaning all, offset), and not the result shape. For a query tool with zero annotation coverage this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is efficient, though the brevity arguably sacrifices needed detail rather than trimming fat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a complex nested anyOf schema (array or single object queries), no output schema, and no annotations, yet the description says nothing about return format or the array-vs-object flexibility. It is too thin for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each nested filter (count, offset, sort_by, min/max_size, name_regex, has_type) individually documented, so the baseline is 3. The description adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Query functions") and explicitly distinguishes itself from the sibling list_funcs by claiming richer filtering. It does not enumerate which filters make it richer, but the schema covers that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "richer filtering than list_funcs" implies when to prefer this tool, but there is no explicit when-to-use/when-not guidance or statement of prerequisites beyond the instance_id note in the schema. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_bytesA
从内存读取原始字节。输入格式: 对象{addr,size}、数组、或字符串'addr:size'(例'0x401000:16'、'0x401000:16, 0x402000:8')。返回 addr,data(hex)。
| Name | Required | Description | Default |
|---|---|---|---|
| regions | Yes | 内存区域。格式: {addr,size}、数组、或字符串'addr:size'(例'0x401000:16'、'0x401000:16, 0x402000:8')。 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It implies a read-only operation and discloses the return shape ('返回 addr,data(hex)'), which is useful. But it says nothing about permission/auth needs, read limits, or behavior on unmapped addresses, leaving real gaps for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, front-loaded sentences: purpose first, then input format, then return. Dense and waste-free, though the input-format sentence largely restates the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity two-parameter read tool with no output schema, the description covers purpose, accepted input forms, and the return shape (addr + hex data). The instance_id routing requirement is handled by the schema. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description's format examples for 'addr:size' duplicate what the schema already documents for the regions parameter, adding no meaning beyond the structured field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: '从内存读取原始字节' (read raw bytes from memory). This clearly distinguishes it from get_int, get_string, and find_bytes by the raw-byte scope. However, it does not explicitly contrast with those siblings, so a 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the purpose — read raw memory regions. There is no explicit guidance on when to prefer this over get_int/get_string/disasm, nor any stated prerequisites beyond the schema-embedded instance_id note. Adequate but with a clear gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_global_valueA
按地址或符号名读取全局变量值。自动识别 hex 地址 vs 名称。需 IDA 已定义该全局类型。
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | 全局变量地址或名称。例: '0x403000'、'globalVar'、'isDemoVersion'。按类型解析返回值。 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but does disclose two meaningful behaviors: automatic hex-vs-name detection and the requirement that IDA already defines the global type. It does not say what happens when the type is undefined (error vs raw read) or how the value is rendered, so key failure behavior is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, front-loaded sentences covering purpose, input handling, and prerequisite with zero filler; the core action is stated first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter read tool with no annotations and no output schema, the definition covers purpose and a prerequisite but omits return-value shape and error behavior, which the absent output schema would otherwise have to carry.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented with examples in the schema, establishing a baseline of 3. The description's auto-detection note adds marginal interpretation guidance for `queries` but no new syntax or constraint beyond what the schema shows.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (read a global variable's value) plus the two accepted input forms. It is clearly distinguishable from list_globals (enumeration) and patch/put_int (mutation), though it doesn't explicitly name those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides one real prerequisite – the global's type must already be defined in the IDA database – which is useful usage context. However, it gives no explicit guidance on when to prefer this over get_int/get_bytes for reading a global, so the when-to-use decision is left implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_intB
从指定地址按类型读整数。支持有符号(i)无符号(u)、8/16/32/64位、大小端(le/be)。返回 addr,ty,value。
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | 整数读取: {addr,ty}。ty 格式: i8/u8/i16le/i16be/u32le/u64。例: {addr:'0x401000',ty:'u32le'} | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the return fields (addr,ty,value) and supported integer types, but says nothing about read-only safety, error handling for invalid addresses, or any side effects. For a read tool the risk is low, yet key behavioral context is still missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded: purpose first, then supported types, then return values. Every sentence contributes, though it could be slightly more structured (e.g., separating usage from output). No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple integer-reading tool with 100% schema coverage and no output schema, the description covers the core operation and return format adequately. However, it omits when-to-use guidance relative to sibling tools and does not mention any behavioral caveats. It is minimally sufficient but not rich.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters in detail (including type examples and address format). The description repeats type information but adds no new semantics beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: '从指定地址按类型读整数' (read integer from specified address by type). It distinguishes this from sibling readers like get_bytes or get_string by focusing on typed integer reads, and it names the return fields addr,ty,value. An agent can tell it apart easily.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus alternatives such as get_bytes, get_string, or int_convert. There are no prerequisites, exclusions, or routing hints. The agent must infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_stringB
从地址读取 IDA 识别的字符串(C/宽字符)。返回 addr,value。若该址无字符串则 error。
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | 地址,支持 hex/十进制/逗号分隔。例: '0x403000' 或 '0x403000, 0x403010' | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; it usefully discloses that C and wide-char strings are both handled and that a missing string yields an error. However, it omits read length/truncation limits, encoding details, and any auth or rate considerations, leaving real behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence front-loads the action, then the return shape, then the error case – no wasted words. It is efficient, though very terse for a tool that could benefit from a touch more routing context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter tool with no output schema, the description does state the return values (addr, value), which is helpful. It leaves the error payload format and the string-length behavior unspecified, so it is adequate rather than complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (addrs with hex/decimal/comma-separated syntax, and instance_id) are already fully documented in the schema. The description adds nothing beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: read the IDA-recognized string (C/wide char) at an address. It is clearly distinguishable from siblings like get_bytes, get_int, and get_global_value. It stops short of explicitly naming a sibling to route against, so not a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given. There is no mention of when to prefer this over get_bytes or get_int, nor any prerequisite beyond the schema's instance_id note. The error-on-missing-string note is behavioral, not a usage rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
idb_saveC
Save active IDB to disk, optionally to a provided path.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Optional destination path (default: current IDB path) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It says the IDB is saved to disk but does not disclose whether this overwrites an existing file, requires a selected instance, is reversible, or what happens on failure – significant gaps for a write operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler; the optional path clause is placed after the core action. It is appropriately sized, though very sparse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple save tool with no annotations and no output schema, the description covers the essential action but omits prerequisites (active instance) and post-save behavior. It is minimally adequate rather than complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented in the schema, including the default path behavior. The description's phrase 'optionally to a provided path' merely restates what the schema already conveys, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Save) and resource (active IDB) with a clear target (disk), so an agent can tell what the tool does. It does not explicitly differentiate itself from siblings, though no sibling shares the save-to-disk behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to save, whether an active/selected instance is required, or how this relates to cache tools like refresh_cache and cache_status. Usage is only implied by the name and purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
importsA
列出导入表。返回 addr, imported_name, module。用于查动态链接/API 调用。
| Name | Required | Description | Default |
|---|---|---|---|
| count | Yes | 返回数量,0 表示全部 | |
| offset | Yes | 起始索引,从 0 开始 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It helpfully discloses the return fields (addr, imported_name, module) even though no output schema exists, and the read-only nature is implied by '列出'. It says nothing about pagination interactions between count/offset or instance-routing behavior, leaving real gaps for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, densely packed sentences with zero filler. The core purpose is front-loaded and the return fields and use case follow immediately, so nothing needs trimming.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with full schema coverage and documented return fields, this is nearly complete. The one missing piece is disambiguation from the similarly named `imports_query` sibling, which matters given the crowded sibling list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented in the schema (including count=0 meaning all, offset origin, and the instance_id routing note). The description adds no parameter-level meaning beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 「列出导入表」 (list the import table), which is unambiguous on its own. However, it does not distinguish itself from the sibling tool `imports_query`, which an agent could easily confuse it with. Clear purpose, but no sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
「用于查动态链接/API 调用」 gives an implied use case (inspecting dynamic linking / API calls) but never states when to prefer this tool over the near-named `imports_query` sibling, nor any exclusions or prerequisites. Usage context is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
imports_queryB
Query imports with richer filtering than imports(offset,count).
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Import query with import/module filters and pagination | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, yet it discloses nothing behavioral: no read-only confirmation, no return shape, no pagination/limit semantics, no instance-routing caveats. 'Query' implies a read, but that is inference, not disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the differentiating claim front-loaded and zero filler. It is arguably under-specified rather than bloated, but on the conciseness axis itself it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read query tool with full schema coverage and no output schema, the parameter story is adequate. However, with no annotations and no explanation of filter syntax or result content, an agent gets only minimal context about what 'richer filtering' yields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (filter, module, count, offset, instance_id all documented in-schema), so the baseline is 3. The description only hints that filter/module exist via 'richer filtering' and adds no syntax or semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a clear verb+resource ('Query imports') and explicitly positions itself against the sibling tool 'imports(offset,count)' by claiming richer filtering. It falls short of 5 because 'richer filtering' is left vague rather than naming the filter/module dimensions the agent would actually use.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It names the alternative tool ('imports') and the condition that selects this one (need for richer filtering), which is real routing guidance. It lacks any when-not-to-use or detail on what the additional filtering consists of, so it stops short of 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
infer_typesC
Infer and apply likely types at target addresses.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Addresses to infer types for | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden. 'Apply' implies a mutation of the IDB, but the description never states whether changes are reversible, what 'likely types' are based on, what gets modified, or any permission/scope constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short, front-loaded sentence with no filler. It is efficient, though its brevity contributes to the behavioral gaps noted elsewhere.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Parameters are fully covered by the schema, but for a mutation tool with no annotations and no output schema, the description leaves key behavioral questions (reversibility, inference basis, scope of modification) unanswered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both addrs and instance_id documented in the schema, including a detailed routing note for instance_id. The description adds nothing beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (infer and apply) plus resource (types) and location (target addresses), which is more informative than a bare name restatement. However, it does not differentiate itself from close siblings like set_type, declare_type, or type_apply_batch, so an agent must infer the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus the many type-related siblings (declare_type, set_type, type_apply_batch). The agent gets no signal about automatic-inference vs manual-setting workflows, leaving selection to guesswork.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
insn_queryC
Query instructions with mnemonic/operand filters and scoped scans.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Instruction query with mnemonic/operand filters and scoped scan | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden for a read tool with batching, pagination, and scan limits. It hints that scans are scoped but omits that a scopeless scan requires allow_broad, that count is capped at 5000, and how offset/count interact for paging. Those facts live only in the schema descriptions, so the sentence adds little.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words, and the filtering capability is stated first. It is efficient, though the brevity borders on under-specification for a tool with this many options.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with an anyOf batch/object input, many nested filters, no output schema, and no annotations, the description leaves key operational details unaddressed: batch semantics, result shape, pagination behavior, and the allow_broad requirement. It is not complete enough to guide correct invocation on its own.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both top-level parameters and all nested filter fields are documented in the schema itself, establishing a baseline of 3. The description restates the two filter families (mnemonic/operand, scope) but adds no semantics beyond what the schema already supplies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource (query instructions) plus the two filtering axes (mnemonic/operand filters, scoped scans). An agent can tell it is a filtered instruction search rather than a plain linear listing. However, it offers no differentiation from close siblings like disasm, find_bytes, or func_query, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of when to prefer this over disasm/find_bytes/func_query, and no note about the scopeless-scan constraint that gates broad searches. The agent must infer usage entirely from the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
instance_infoA
获取指定实例详情。instance_id 来自 instance_list。返回 binary_path,idb_path,base_addr,processor 等。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, but it only implies a safe read via the verb '获取' (get). It does not state read-only nature, error behavior for unknown IDs, or whether the instance must be selected first. For a low-risk single-parameter getter this is adequate but thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the purpose, then the parameter source, then the return fields. No filler and nothing redundant in structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the enumerated return fields are somewhat redundant but harmless. For a single-required-parameter read tool with no annotations, the description covers input provenance and output nature, leaving only minor gaps such as error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate; it does so by explaining the provenance of instance_id ('来自 instance_list'), which is genuinely useful semantics beyond the bare string type. With only one obvious parameter, this is close to sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (get details of a specified instance) and implicitly contrasts with the sibling listing tool by naming instance_list as the source of the ID. It is clear, though it does not explicitly state what makes it distinct from other retrieval tools like list_funcs or imports.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives implied usage guidance by stating that instance_id comes from instance_list, which tells the agent the prerequisite step. However, it gives no when-not guidance, no mention of what happens with an invalid or stale ID, and no alternatives for other instance-related operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
instance_listA
列出所有已连接的 IDA/Hopper 实例。无需加载 IDB。返回 instance_id,name,binary_path,idb_path,base_addr。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry behavioral disclosure. It usefully notes that no IDB load is required, which is a real workflow constraint, but it never explicitly states that this is a safe read-only operation with no side effects. The returned field list duplicates what the output schema already provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and front-loaded: one sentence states the action and scope, followed by a short prerequisite note and return-field list. No words are wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool with an output schema, the return values and basic behavior are covered. However, the description does not help an agent choose between this tool and the similarly named sibling 'list_instances', leaving a significant selection gap given the crowded tool namespace.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there are no parameter semantics to explain. The description does not need to compensate for any parameter documentation gap, making a baseline of 4 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('列出') and resource ('已连接的 IDA/Hopper 实例') with the scope '所有'. However, it does not distinguish this tool from the sibling 'list_instances', which appears to serve the same purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase '无需加载 IDB' implies a lightweight, always-available usage context, but the description gives no explicit when-to-use guidance, no exclusions, and no comparison to alternatives like list_instances, instance_info, or select_instance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
int_convertA
数值进制转换。输入任意格式数(0x/十进制),输出 decimal/hex/ascii/binary。禁止 LLM 手算进制,必须调用此工具。
| Name | Required | Description | Default |
|---|---|---|---|
| inputs | Yes | 要转换的数: 字符串'0x41'/'255'、数组['0x41','255']、对象{'text':'0x1000','size':32}。输出 decimal/hex/ascii/binary。LLM 切勿自行做进制转换,请用此工具。 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses output formats (decimal/hex/ascii/binary) and input flexibility, but omits side-effect profile, determinism, error behavior, or instance/auth requirements beyond what the schema already states. This is adequate but leaves notable gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences: purpose first, then input/output formats, then usage mandate. It is front-loaded and contains no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple conversion tool with no output schema and no annotations, the description covers purpose, input/output formats, and usage. It omits some behavioral details, but the schema's 100% coverage handles instance routing and parameter documentation, making it complete enough overall.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description mentions input and output formats, but these are already documented in the schema's inputs description, and it adds no extra syntax or semantic detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource ('数值进制转换') and specifies accepted input formats and output formats, so the tool's purpose is clear. However, it does not explicitly differentiate int_convert from sibling tools like get_int or put_int, so it falls short of full sibling routing guidance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states when to use the tool ('禁止 LLM 手算进制,必须调用此工具') and frames it as the required path for base conversion. It does not name alternative tools or describe when not to use it, but the directive is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_funcsA
列出函数。支持 glob 过滤、分页。'0:50'=offset:count(列表索引,非地址)。
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | 查询: glob过滤'main'、分页简写'0:50'(表示从第0个起取50个,非地址范围)、对象{filter,offset,count}。 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry behavioural disclosure. It adds useful pagination semantics and clarifies that '0:50' is a list index rather than an address range, but it does not state read-only safety, result ordering, or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three terse sentences, front-loaded with the tool's purpose and then key syntax. Every sentence earns its place, with no repetitive or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter list tool with full schema coverage and no output schema, the description covers the core operation and pagination shorthand. It is not fully complete because it omits guidance on choosing among sibling function-querying tools and provides no safety or return-shape context, which matters since no annotations exist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 even though the description mentions filter and pagination. The description mostly repeats the schema's own field explanations and adds no semantic detail beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('列出函数') and notes glob filtering and pagination. It does not differentiate from sibling tools such as func_query, lookup_funcs, or export_funcs, so it earns a 4 rather than a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for glob filtering and pagination, giving an agent some context. However, it does not name alternatives or state when to use this tool instead of related function-querying siblings, leaving selection guidance implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_globalsA
列出全局变量。支持 glob 过滤、分页。'0:20'=offset:count(列表索引,非地址)。
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | 查询: glob'g_'、分页'0:20'(offset:count 列表索引,非地址)、对象{filter,offset,count}。 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully clarifies that '0:20' means offset:count as list indices, not addresses, which prevents a real misuse. However it does not disclose the read-only/no-mutation nature, rate limits, or return shape, leaving a gap for an annotation-free tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely tight and front-loaded: purpose first, then capabilities, then the one clarifying note about pagination semantics. Every clause earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter read/list tool with no output schema and full schema coverage, the description covers the core operations (glob + pagination). With no annotations, a bit more on the read-only nature and result format would make it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents filter/offset/count and instance_id thoroughly. The description mirrors the '0:20' offset:count syntax but adds no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('列出全局变量' / list global variables) and adds capability scope (glob filtering, pagination). It is distinguishable from get_global_value (single value retrieval) in practice, but the description does not explicitly name or contrast a sibling, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: it says glob filtering and pagination are supported but never states when to use this tool vs get_global_value or the other *_query/list_* siblings, nor any exclusions. Adequate for a simple listing tool but leaves routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_instancesA
List all discovered IDA Pro instances with their binary name, port, and reachability status.
Use this to see which IDA databases are currently open and available for analysis. The 'active' field indicates which instance is currently handling your tool calls.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and no output schema, the description carries the full burden and does disclose the shape of the result plus the meaning of the 'active' field, which is genuinely useful semantics beyond structured data. It omits permission requirements, whether there is any side effect, and any relation to the instance_id routing requirement, so it is not complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the operation and then the usage context, with no filler. The second sentence slightly restates the 'reachability status' idea already implied in the first, a minor redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers return fields adequately given there is no output schema, but for a required-instance_id tool it omits how an agent obtains that ID and how this differs from instance_list/instance_info, both of which are live siblings performing overlapping work.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is a single required parameter, so the baseline is 3; the description adds nothing about instance_id beyond what the schema says. Notably, the description never mentions that an instance_id must already be known, which is the tool's sole input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List all discovered IDA Pro instances') and enumerates the returned fields (binary name, port, reachability status). An agent understands the operation immediately, but the description never differentiates this tool from the near-duplicate sibling 'instance_list', leaving ambiguity about which to call.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
One sentence gives context ('Use this to see which IDA databases are currently open and available for analysis'), which implies when to use it. However, it gives no when-not guidance and never addresses the obvious alternative 'instance_list' (or 'instance_info'/'select_instance'), even though the sibling set contains a highly similar name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_funcsA
按地址或名称查找函数。输入: 地址(0x401000/sub_401000)或符号名(main,start)。输出: addr,name,size。支持批量。
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | 函数地址或名称。支持: 字符串'0x401000'、逗号分隔'main, start'、数组['0x401000','main']、或对象数组[{'addr':'0x401000'}]。 | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose useful behavior: accepted input forms and the exact output fields (addr, name, size), plus batch support. However it says nothing about permissions, instance routing requirements, or error behavior on a miss.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely tight four-clause structure: purpose, input formats, output fields, batch note. Front-loaded with the core action and no wasted sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two required params and no output schema, the description usefully compensates by naming the returned fields (addr, name, size) and noting batch support. The instance_id routing requirement is left to the schema, which is acceptable given its detailed description there.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (queries accepts string/comma-list/array/object forms, instance_id routing) are fully documented in the schema. The description's input examples largely mirror the schema, adding little beyond the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource in '按地址或名称查找函数' (look up functions by address or name), which is clear. It doesn't explicitly distinguish itself from siblings like list_funcs or func_query, so an agent must infer the difference between a targeted lookup and a listing/query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'input: address or symbol name' phrasing implies when the tool is applicable (you already have an identifier), but it names no alternatives or exclusions. Sibling tools list_funcs/func_query exist and are not referenced.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_signatureB
Create unique byte signatures for addresses. Generates the shortest unique signature starting at each address by walking instructions and wildcarding operands. Useful for finding stable patterns that survive recompilation.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Address(es) or name(s) to create unique signatures for (e.g. '0x401000', 'main', or ['0x401000', 'sub_402000']) | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| max_length | No | Maximum signature length in bytes before giving up (default: 1000) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| wildcard_operands | No | Wildcard instruction operands for relocatable signatures (default: true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the generation strategy (shortest unique signature, instruction walking, operand wildcarding), but omits whether signatures are persisted to the IDB or merely returned, and says nothing about failure behavior when no unique signature is found within max_length.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences with the core action front-loaded and the mechanism/benefit trailing. No filler, though the third sentence is somewhat redundant with the purpose statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a compute-style tool with no output schema and no annotations, the description explains generation but not the returned shape, failure conditions, or the IDB side-effect question. It is adequate but leaves meaningful gaps given the lack of structured support.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters including the specific enumerations for format. The description's mention of 'wildcarding operands' loosely maps to the wildcard_operands parameter but adds no syntax, defaults, or format meaning beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Create unique byte signatures for addresses') and clarifies the generation mechanism (walking instructions, wildcarding operands). However, it does not differentiate from close siblings make_signature_for_function and make_signature_for_range, leaving the agent to infer that this is the address-level variant.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage signal is 'Useful for finding stable patterns that survive recompilation,' which is a benefit statement rather than a when-to-use rule. There is no mention of alternatives (the two sibling signature tools) or of when this tool would not be the right choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_signature_for_functionA
Create unique byte signatures for function entry points. Resolves each name/address to a function, then generates the shortest unique signature starting at the function start.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Function address(es) or name(s) to create signatures for (e.g. 'main', '0x401000', or ['main', 'sub_402000']) | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| max_length | No | Maximum signature length in bytes before giving up (default: 1000) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| wildcard_operands | No | Wildcard instruction operands for relocatable signatures (default: true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses a two-step behavior ('resolves each name/address to a function, then generates the shortest unique signature'), but says nothing about what happens if resolution fails, whether the IDB is modified, or whether output is capped (the max_length parameter implies truncation/give-up but is not explained here).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core action front-loaded and the resolution/selection behavior second. No filler and no redundancy with schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with no annotations and no output schema, the description covers the main action but omits what a returned signature looks like, how multi-address input is handled in the response, and error behavior. The instance_id routing note lives only in the schema (in a different language), not in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all five parameters including formats, max_length default, and wildcard_operands. The description adds one genuinely useful semantic — that each name/address is resolved to a function before signing — but nothing about the format or wildcard options beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource ('Create unique byte signatures for function entry points') and adds a scoping qualifier ('starting at the function start'), which distinguishes it in spirit from make_signature_for_range. However, it never names the closest siblings (make_signature, make_signature_for_range) so differentiation is inferential rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the agent can infer this is for generating signatures for whole functions rather than ranges. There is no statement of when to prefer this over make_signature_for_range or find_xref_signatures, and no prerequisites or failure conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_signature_for_rangeA
Create a byte signature for a specific address range (e.g. a selected region). Unlike make_signature, this does NOT guarantee uniqueness — it simply encodes the bytes in the range with optional operand wildcarding.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | End address or name (exclusive, e.g. '0x401020') | |
| start | Yes | Start address or name (e.g. '0x401000') | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| wildcard_operands | No | Wildcard instruction operands for relocatable signatures (default: true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose a meaningful trait: the result is NOT guaranteed unique, unlike make_signature. But it omits operational context such as the instance-routing requirement (instance_id must be supplied and chosen via instance_list) and whether the operation is read-only or mutating. Useful but incomplete behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with the core purpose and the differentiating constraint front-loaded ahead of the caveat. Zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with full schema coverage, no output schema, and no annotations, the description covers purpose, scope, and the non-uniqueness caveat adequately. The main residual gap is the instance-routing prerequisite, which the description never surfaces.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents start, end, format, instance_id, and wildcard_operands. The description only restates the range concept and hints at operand wildcarding ('optional operand wildcarding'), adding little beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ('Create a byte signature for a specific address range') with a concrete example, and it explicitly distinguishes itself from the sibling make_signature by naming it and stating the key difference (no uniqueness guarantee). An agent can tell this apart from make_signature and make_signature_for_function without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear selection condition: use this when you want to encode a byte range without requiring uniqueness, e.g. a selected region. It names the alternative make_signature and the tradeoff. It does not, however, address when to prefer make_signature_for_function over this tool, leaving one sibling relationship implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patchC
Patch bytes at memory addresses with hex data
| Name | Required | Description | Default |
|---|---|---|---|
| patches | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden, yet it discloses nothing about behavior: no indication that patching mutates the IDB/binary, whether changes are reversible, permission requirements, or failure modes if an address is invalid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler; the verb and resource come first. It is efficient but arguably under-specified rather than earning high marks for structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation tool with no annotations, no output schema, and half its parameters undocumented, the description is too thin. An agent needs reversibility, scope-of-effect, and instance-routing context that is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50% and the description adds nothing beyond 'hex data', which is already stated in the schema's data field. It does not clarify the anyOf shape (single patch object vs. array of patches) or how multiple patches are applied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (patch) plus resource (bytes at memory addresses) and format (hex data), so the agent knows it writes raw bytes. It does not, however, distinguish itself from the sibling patch_asm, which an agent could easily confuse with it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance and names no alternatives. The only routing hint lives in the instance_id schema blurb (call instance_list first), not in the description itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_asmC
Patch assembly instructions at addresses
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden, and it discloses almost nothing: it does not say the operation mutates the IDB, whether changes require an explicit `idb_save`, whether patches are reversible, or how failures on invalid addresses are handled. For a mutation tool with zero annotation coverage this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single six-word sentence with no wasted phrasing and the action is front-loaded. That brevity, however, comes at the cost of under-specification rather than efficient density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter mutation tool with no annotations and no output schema, the description is far too thin. It omits the mutation/save lifecycle, batch-vs-single items semantics, and any notion of what the tool returns or how errors surface.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: the nested `addr` and `asm` fields are documented, and the Chinese instance_id description explains its routing purpose and points at instance_list. However, the top-level `items` wrapper (array-or-object union) is undocumented, and the description adds no formatting or semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource ('Patch assembly instructions') and mentions the address-based target. But it does not distinguish itself from closely related siblings such as `patch`, `put_int`, or `define_code`, which an agent must choose between.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives like `patch`, `define_code`, or `put_int`, nor any stated prerequisites. The one routing hint (call instance_list first) lives only in the instance_id schema field, not the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
put_intC
Write integer values to memory addresses
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Integer write requests (ty, addr, value). value is a string; supports 0x.. and negatives | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden for a mutation tool. It says 'write' but never covers reversibility, permission/routing requirements, batch semantics, or failure behavior, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is efficient, though arguably under-specified for a write tool rather than overly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, a one-line description is thin. It omits batch behavior, error/partial-write semantics, and any safety context an agent would need to invoke it confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so `items`, `ty`, `addr`, `value`, and `instance_id` are already well documented in the schema. The description adds no extra meaning beyond that baseline, so a 3 is warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Write') and resource ('integer values to memory addresses'), which is clear enough to act on. However it doesn't distinguish itself from neighbors like `patch` or note that it is the write counterpart to sibling `get_int`, and it omits that it accepts a batch of writes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus alternatives such as `patch`, `set_type`, or `get_int`. Nothing states prerequisites, ordering, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_structC
Read struct fields from memory at address; auto-detect type when possible.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It discloses only the auto-detect-type behavior and says nothing about read-only safety, permission/instance requirements, failure modes when the address or type cannot be resolved, or what is returned, leaving significant behavioral gaps for a memory-reading tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the action and the auto-detect caveat come first. It is appropriately sized, though extremely terse given how much is left unspecified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should carry more, but it omits the polymorphic nature of 'queries' (array vs single object), the batch semantics, and the return shape. For a tool taking a free-form address and an optional struct type across multiple instances, this is under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
At 50% schema coverage, the description must compensate, and it largely does not. It gestures at the 'addr' and optional 'struct' parameters but adds nothing beyond the schema's own field notes, and it never mentions the required 'instance_id' routing parameter whose usage guidance lives only in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Read struct fields from memory at address') and adds the auto-detection behavior. It is clear what the tool does, though it does not explicitly distinguish itself from nearby siblings like type_inspect or get_global_value, which also surface typed memory contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no when-not-to-use, and no named alternative. The description does not tell the agent when reading a struct this way beats calling get_bytes, type_inspect, or search_structs, so selection relies entirely on the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
refresh_cacheA
请求指定 IDA 实例立即刷新其本地 SQLite 静态缓存 (xxx.idb.mcp.sqlite)。实际刷新仍然需要 IDA 进入 idle 状态才会执行,此工具仅唤醒插件端守护线程并立即返回。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full load and does so well: it discloses that the call is fire-and-forget (wakes the plugin daemon thread and returns immediately) and that the actual refresh is deferred until IDA reaches idle state. Auth/permission needs and failure modes are not covered, keeping it below 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the action and back-loaded with the important async caveat. No filler, though it could be slightly tighter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, no-output-schema tool the description is nearly sufficient: it covers what happens, when the effect actually lands, and that the call returns immediately. It lacks only edge-case behavior (e.g. what happens if the instance never goes idle).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents instance_id thoroughly, including the pointer to instance_list. The description adds nothing about the parameter, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('request the specified IDA instance to refresh its local SQLite static cache') and even names the concrete artifact (xxx.idb.mcp.sqlite). Clear enough to distinguish from instance_list/cache_status, though it never explicitly names the sibling it is not.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage via the async caveat (refresh only happens once IDA is idle), but gives no explicit when-to-use vs when-not, and does not mention cache_status as the sibling for inspecting the cache. Guidance is inferable but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
renameC
批量重命名: 函数、全局变量、局部变量、栈变量。支持 dry_run 等选项。
| Name | Required | Description | Default |
|---|---|---|---|
| batch | Yes | 批量重命名: 函数、全局变量、局部变量、栈变量。batch 可为空{}。格式: {func:[{addr,name}], data:[{old,new}], ...} | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses that renames are batchable and that dry_run/options exist, but says nothing about whether renames persist to the database, permission/auth needs, conflict or partial-failure behavior, or what a rename of an already-named entity does. For a mutation tool this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the scope of the operation plus a note on available options. No filler, though the '等选项' phrasing is slightly vague and the brevity edges toward under-specification rather than true concision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The nested schema is fully annotated and there is no output schema to explain, so parameter-level completeness is adequate. However, for an un-annotated mutation tool the description omits behavioral context (persistence, auth, failure semantics) that an agent would need to use it safely, leaving a real gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents batch sub-keys (func/data/local/stack), dry_run, stop_on_error and allow_overwrite. The description adds little beyond restating the rename categories, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (batch rename) plus the resources it operates on (functions, global/local/stack variables), matching the schema categories. Clear enough for an agent to know this is the symbol-renaming tool, though it does not explicitly distinguish itself from adjacent symbol tools like define_func or set_type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to use this versus alternatives, no prerequisites, and no exclusion conditions. The only usage hint is the existence of a 'dry_run' option, which is offered rather than explained as a recommended first step.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_structsC
Search local structs/unions by name pattern.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | Yes | Case-insensitive search. Use * or ? for glob (e.g. FILE*, *_t). Else substring. | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a read-only lookup but says nothing about result limits, whether matches include members or just names, or how results are ordered/returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though very terse given the amount of behavioral information it omits.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter search tool with no annotations and no output schema, the description is adequate on scope but silent on return shape and how matches are presented. Minimum viable, not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the filter glob/substring semantics and the instance_id routing note are fully documented in the schema. The description adds nothing beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Search), resource (structs/unions), and scope qualifier (local, by name pattern), which distinguishes it from read_struct, type_query, and entity_query. It does not explicitly name a sibling alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no conditions that select this tool over read_struct/type_query/find, and no prerequisites beyond what the schema already states. 'local' hints at scope but does not route the agent among alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_textB
Search the rendered listing using IDA's native text search (fast C++ scan).
Discovers candidate EAs with ida_search.find_text(), then renders each hit
once via ida_lines.generate_disassembly() to extract matching lines and
classify them as disasm or comment. Returns one hit per EA.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max hits per page (default: 30, max: 500) | |
| regex | No | Treat pattern as a regex (uses IDA's SEARCH_REGEX) | |
| start | No | Cursor: address to resume from (hex or symbol). Empty = first segment. | |
| include | No | 'disasm' | 'comments' | 'all' (default: all) | all |
| pattern | Yes | Text to search for in the rendered listing (literal substring by default) | |
| code_only | No | Restrict search to executable segments (default: true) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| case_sensitive | No | Case-sensitive match (default: false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations and no output schema, so the description carries the full burden. It discloses the pipeline and that hits are classified as disasm/comment, but says nothing about result ordering, permissions, performance/rate characteristics, or what the cursor-based pagination returns. For a paged search tool with zero structured coverage, this is a notable gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight paragraphs with no filler; the core behavior is front-loaded. The internal API names are slightly implementation-flavored but justify the 'native C++ scan' claim, so they still earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, paged search tool with no output schema and no annotations, the description covers the return shape only in outline (one hit per EA, classified). It omits pagination/ordering expectations and the routing requirement of instance_id, leaving a few gaps an agent must fill from the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter including limit, regex, start, include, and code_only is already documented in the schema. The description adds no syntax or format detail beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
It states a precise verb+resource ('search the rendered listing') and even names the mechanism (ida_search.find_text over generate_disassembly output). It clearly differentiates from raw-byte search by specifying 'rendered listing', though it stops short of naming the closest siblings (find, find_regex, find_bytes) directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'rendered listing' implies this is for disassembly-text/comments rather than raw bytes, which hints at when it beats find_bytes. But there is no explicit when-to-use or when-not-to-use versus find, find_regex, or entity_query, leaving the routing decision mostly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
select_instanceA
Switch to a different IDA Pro instance. All subsequent tool calls will be routed to the selected instance. Use list_instances to see available instances.
To switch back to this instance, call select_instance with this instance's port, or call select_instance with port=0 to reset.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | Host address of the IDA instance | 127.0.0.1 |
| port | Yes | Port number of the IDA instance to connect to | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses the key stateful behavior (subsequent calls are routed/re-routed to the selected instance) and the reset escape hatch (port=0), which are non-obvious and valuable. It stops short of describing failure modes or whether the current selection persists across sessions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and effect in the first sentence, with reset instructions in a short second paragraph. Slightly repetitive with "call select_instance" recited twice, but there is little waste overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter, annotation-free, output-schema-free routing tool, the description supplies the routing effect, discovery pointer, and reset behavior an agent needs. It omits error handling and does not address the host parameter, but it is adequate to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds meaning beyond the schema: the reset semantics of port=0 and the instruction to derive the port from the current instance. The host parameter is left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Switch to a different IDA Pro instance") and immediately clarifies the effect (all subsequent calls routed to the selected instance). It distinguishes itself from the sibling list_instances, which only enumerates instances, so an agent can tell the two apart without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent to list_instances to discover available instances and gives the switch-back/reset conditions (pass this instance's port, or port=0). It covers the main when-to-use flows but does not state error conditions or what happens when the target is unavailable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_healthA
Health/ready probe for MCP server and current IDB state.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It implies a read-only, non-destructive probe of server and IDB state, which is useful, but it omits the return shape (what constitutes 'healthy'/ready), any cost or latency characteristics, and whether it touches the IDB at all. Adequate but thin for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no filler. It is appropriately sized, though so terse that a few more words on the probe's output or scope would have earned their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, annotation-free probe with no output schema, the description covers what is being checked and implies what is returned. Given how simple the tool is, this is close to sufficient, though it could say more about the result of the probe.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is a single required parameter, so the baseline is 3. The description adds no meaning beyond the schema — it does not explain the instance_id argument's routing role, which the schema already spells out.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: a health/ready probe covering both the MCP server and the current IDB state. That is clearly distinguishable from siblings like server_warmup, idb_save, or instance_info. It stops short of explicitly differentiating itself from the closest sibling, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied — a 'health/ready probe' suggests you call it to check liveness before issuing heavier operations, but no when-to-use condition, prerequisites, or alternative (e.g., server_warmup vs. this) is named. The schema's instance_id note points to instance_list, which helps route the call but is not usage guidance for the tool itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_warmupA
Warm up IDA subsystems to reduce first-call latency and transient failures.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| build_caches | No | Build core caches (currently strings) | |
| init_hexrays | No | Initialize Hex-Rays decompiler plugin | |
| wait_auto_analysis | No | Wait for auto analysis queue |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses intent (pre-warming subsystems to avoid transient failures), which implies a non-destructive setup operation. It does not state cost, likely duration, idempotency, or whether it blocks, so transparency is only partial for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that states the action and its benefit with zero wasted words. Perfectly sized for the tool's scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter, no-annotation, no-output-schema tool, the description is minimal. It conveys purpose adequately but omits operational context such as whether the call blocks, how long it may take, and how it relates to refresh_cache/cache_status, leaving the agent with gaps for a setup operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (instance_id, build_caches, init_hexrays, wait_auto_analysis) are documented in the schema itself. The description adds no parameter meaning, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (warm up) and resource (IDA subsystems) plus the benefit (reduce first-call latency and transient failures). It clearly distinguishes itself from siblings like refresh_cache, cache_status, and server_health by describing pre-initialization. However, it does not name or route against any specific alternative sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The stated benefit ('reduce first-call latency') implies usage before a first real operation, but there is no explicit when-to-use, when-not-to-use, or comparison to sibling tools like refresh_cache or server_health. Usage is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_commentsC
Set comments at addresses (both disassembly and decompiler views)
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not disclose whether setting a comment overwrites an existing one, whether an idb_save is required for persistence, or any side-effect semantics. The one trait it adds, applicability to both views, is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. Nothing is wasted and the essential purpose is stated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is too sparse. It omits overwrite/reversibility behavior, persistence expectations, and any error or routing context that an agent would need before writing data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: addr and comment are documented in the schema, and the instance_id field carries a detailed routing description. The description merely restates 'addresses' and 'comments' without adding syntax or format meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Set comments at addresses' and clarifies scope ('both disassembly and decompiler views'). Distinguishes it from the sibling append_comments only implicitly through 'set' vs 'append', so it falls short of the explicit sibling differentiation that would earn a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of the alternative (append_comments) and no exclusions or prerequisites. An agent must infer that 'set' means overwrite while 'append' means add, and must independently discover the instance routing requirement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_typeC
Apply types (function/global/local/stack)
| Name | Required | Description | Default |
|---|---|---|---|
| edits | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full behavioral burden, and it does not state that this mutates the IDB, whether the change is reversible, or that edits are applied to a specific routed instance. 'Apply' weakly implies a write, but nothing about persistence, safety, or side effects is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short, front-loaded sentence with no filler, so nothing is wasted. However, for a tool with a complex nested edits payload, this brevity reflects under-specification rather than disciplined conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and only 50% schema coverage, a one-line description leaves major gaps: the effect on the database, the routing requirement to a specific IDA instance, and the semantics of the edits payload are all unaddressed. The schema's instance_id note is the only substantive usage hint in the whole definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50% and the description adds no parameter meaning beyond the parenthetical entity list, which mostly overlaps the schema's own addr description. The anyOf shape of edits, the roles of ty/kind/name/variable/signature, and the difference between array and single-object input are not clarified by the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a verb (Apply) and a resource (types) plus a scoping list (function/global/local/stack), but it is terse and does not distinguish this tool from close siblings like type_apply_batch, declare_type, or make_signature. An agent cannot tell from the text alone which of the type-related tools is the right one here.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use, when-not-to-use, or alternative-tool guidance at all. The parenthetical entity list hints at scope but never says under what circumstances an agent should call set_type versus declare_type or type_apply_batch.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stack_frameC
Return stack variables for function address(es).
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Address(es) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It says nothing about whether the returned variables include their types/values, whether it requires the function to be analyzed/decompiled first, or how it behaves on unknown addresses. The only routing context (instance_id) comes from the schema, not the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is arguably too terse rather than too long, but structurally it is clean and readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description should explain what a 'stack variable' result contains and any prerequisites. As written, an agent cannot predict the return shape or required analysis state from the definition alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, including the detailed instance routing note. The description's phrase 'function address(es)' adds a small hint that addrs are function entry points rather than arbitrary addresses, but otherwise the schema does the work; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (return stack variables) and scopes it to function addresses, so the agent knows what comes back. It does not, however, distinguish itself from nearby siblings like declare_stack or delete_stack, which share the stack/function domain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisite beyond what the schema already states, and no named alternative. The agent must infer that this is a read-only inspection tool from the verb alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
survey_binaryA
Get a compact overview of the binary in one call. Returns file metadata, segment layout, entry points, statistics, top 15 strings and functions ranked by xref count (functions include classification: thunk/wrapper/leaf/dispatcher/ complex), imports by category, and call graph summary. Use this as your FIRST tool call when starting analysis. Do not call list_funcs, imports, or find_regex separately for triage — this returns all of that. Use detail_level='minimal' for binaries with >10k functions.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 | |
| detail_level | No | Detail level: 'standard' or 'minimal' | standard |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations the description carries the full burden, and it discloses the complete return profile: metadata, segment layout, entry points, statistics, ranked strings/functions with classification labels, imports by category, and call graph summary. It also flags a performance-driven mode for >10k-function binaries. It stops short of stating read-only safety or any cost/limit, but the disclosure is well above average for an unannotated read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then usage, then a parameter tip, in three tight sentences. The return-content enumeration is long but each listed artifact is decision-relevant, so it earns its space; slightly dense but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must describe returns, and it does so thoroughly (including classification categories). No annotations means the safety profile is only implied by 'Get', but for a triage/survey tool an agent has essentially everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds meaningful guidance beyond the schema: it ties detail_level='minimal' to the concrete threshold of >10k functions. instance_id is left to the schema, which documents it adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get a compact overview of the binary in one call') and enumerates exactly what the overview contains. It explicitly separates itself from siblings list_funcs, imports, and find_regex, so an agent can place it instantly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('Use this as your FIRST tool call when starting analysis') and when-not-to-use alternatives ('Do not call list_funcs, imports, or find_regex separately for triage'), plus a size-based condition for detail_level. This is a textbook routing statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trace_data_flowA
Follow cross-references from or to an address, automatically traversing multiple hops. Use 'forward' to see where data flows TO (xrefs-from), or 'backward' to see where data flows FROM (xrefs-to). At each node in the traversal, returns the function name, instruction, and whether it's code or data. Use this when you find an interesting string, constant, or global and want to understand every code path that touches it without manually chaining xrefs_to calls. Do not use for call graph traversal — use callgraph for that. max_depth controls how many hops to follow (default 5, max 20).
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Starting address | |
| direction | No | 'forward' (xrefs from) or 'backward' (xrefs to) | forward |
| max_depth | No | Maximum traversal depth | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does substantial work: it discloses automatic multi-hop traversal, the direction semantics, and the per-node return payload (function name, instruction, code-vs-data). It doesn't cover performance/limits on large traversals, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then direction semantics, then the triggering use case, then the exclusion, then the parameter note. Every sentence adds distinct information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description describes what each traversal node returns (function name, instruction, code/data), which is exactly what an agent needs to decide whether to call it. For a 4-parameter read tool with no annotations, it is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3; the description adds intuitive meaning to 'direction' (forward = data flows TO, backward = flows FROM) beyond the terse schema phrasing, and supplies the max_depth cap (max 20) that the schema omits. Marginal but real added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (follow/traverse) plus resource (cross-references from/to an address across multiple hops). It explicitly distinguishes itself from the sibling 'callgraph' and implicitly from chained 'xrefs_to' calls, so an agent can place it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete triggering scenario ('when you find an interesting string, constant, or global') and an explicit exclusion with the escape hatch ('Do not use for call graph traversal — use callgraph for that'). Both when-to-use and when-not-to-use are covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_apply_batchC
Apply multiple type edits and return aggregate status.
| Name | Required | Description | Default |
|---|---|---|---|
| batch | Yes | Batch type edits with optional stop_on_error behavior | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It hints at 'aggregate status', but for a mutating batch operation it says nothing about partial-failure semantics beyond the schema's stop_on_error field, whether edits are reversible, or any permission/routing requirements beyond what instance_id's schema text already states.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero padding. It is efficient, though for a tool with a deeply nested batch schema it is arguably under-specified rather than richly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a batch mutation with nested objects, no annotations, no output schema, and instance routing requirements, one sentence is not enough. Nothing explains failure handling across the batch, edit ordering, or what 'aggregate status' actually reports.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with every nested edit field (ty, addr, kind, name, variable, signature) and stop_on_error documented in the schema itself. The description adds nothing beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('apply type edits') with the batch scope made explicit by 'multiple' and 'aggregate status', which distinguishes it from single-edit siblings like set_type and declare_type. It does not name a sibling directly, but the batching purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to prefer this over set_type/declare_type/infer_types, no prerequisites stated, and no note on when a single-edit call would be better. The agent must infer usage purely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_inspectB
Inspect named types (size/kind/declaration/members).
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Inspect named types and optionally include member layout | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. While 'Inspect' implies a read-only operation, the description does not explicitly state side effects, permissions, instance routing behavior, or any operational limits. The listed aspects add some value but do not compensate for the missing behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with zero waste, front-loading the verb and resource before the parenthetical detail. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has moderate complexity, no output schema, and complete schema descriptions. The description communicates what is inspected but omits any usage context or return-value framing. It is minimally viable but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents the two parameters and their nested fields. The description adds only a high-level summary of inspectable aspects, not parameter syntax or format details. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb 'Inspect' and resource 'named types', and enumerates the inspection aspects '(size/kind/declaration/members)'. It does not differentiate from sibling tools like type_query or read_struct, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no when-to-use guidance, no alternatives, and no exclusions. It only states what the tool does, leaving the agent to infer appropriate context from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_queryC
Query local types with structured filters/projection-friendly output.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Type catalog query with filtering, pagination, and optional relationships | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, but it only offers the phrase 'projection-friendly output'. It does not state that this is a read-only operation, describe the output shape, or mention any constraints, so an agent gets little beyond the surface claim.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single compact sentence with no wasted words. It is front-loaded with the core verb+resource, though the trailing qualifier is somewhat obscure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should carry more, especially about return values. It gestures at output via 'projection-friendly output' but leaves the actual response shape and read-only nature unexplained, so it is only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every field (kind, filter, count, offset, sort_by, includes). The description adds nothing beyond this, so the baseline 3 for fully-covered schemas applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource ('Query local types'), which clearly identifies the operation. However, it offers no differentiation from closely related siblings like search_structs, type_inspect, or read_struct, and 'projection-friendly output' is vague jargon rather than a concrete scope statement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as type_inspect, search_structs, or read_struct. The description only states what the tool does, not the conditions that select it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
undefineC
Undefine item(s) at address(es), converting back to raw bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the end effect ('converting back to raw bytes'), which is useful, but says nothing about permissions, reversibility, side effects on references/function definitions, or whether the operation can be undone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-formed sentence with the verb and effect front-loaded and zero padding. Appropriately sized for the operation, though it could have afforded one more sentence of behavioral context given the total absence of annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating operation with no annotations, no output schema, and only 50% parameter coverage, the description is too thin. It omits the consequences of undefining, prerequisite instance routing (only covered in the Chinese schema text), and any conflict/error behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%; the 'items' parameter is well documented in the schema (addr/end/size) and the instance_id has a detailed description. The description adds only 'at address(es)', which marginally maps to the items parameter but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (undefine), the resource (item(s) at address(es)), and the resulting effect (converting back to raw bytes). This is clear and roughly distinguishes it from the sibling define_code as its inverse, though 'item(s)' remains somewhat vague about what kinds of entities are affected.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus define_code, no prerequisites, no conditions. The inverse relationship to define_code is only implicit and left for the agent to infer from the sibling name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xref_queryC
Query xrefs with direction/type filters and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Generic xref query with direction/type filters and pagination | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read (query), but omits that the 'queries' param accepts a batch of addresses, that instance_id must resolve to a live IDA instance, or any hint about result shape/defaults beyond 'pagination'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no filler. It is arguably too terse rather than verbose, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool accepts a nested batch of query objects with nine sub-fields each and requires an instance_id that must be routed to a specific IDA instance. The description mentions none of this — no batch semantics, no instance routing, no return behavior. Given the complexity and absence of annotations, it is under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters (addr, count, direction, xref_type, offset, sort_by, dedup, descending, include_fn, instance_id) are already documented in the schema. The description adds nothing beyond the schema, which is the expected baseline at this coverage level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Query') and resource ('xrefs') plus the filter dimensions and pagination support. However, it does nothing to distinguish itself from siblings like xrefs_to, xrefs_to_field, or find_xref_signatures, which is the main thing an agent needs to disambiguate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance at all. Given at least three closely related xref tools in the sibling list, the description should say when this multi-query/batch variant is preferred over xrefs_to. Nothing indicates context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xrefs_toC
获取交叉引用(引用的目标地址)。
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | 目标地址。支持 hex、符号名、逗号分隔。例: '0x401000'、'main, 0x402000' | |
| limit | No | Max xrefs per address (default: 100, max: 1000) | |
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It only restates the basic operation and says nothing about read-only safety, required permissions, pagination/limit behavior, error conditions, or what the operation returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no wasted words, so it is concise. However, for an xref tool with no annotations and no output schema, it is under-specified rather than optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no annotations and no output schema, so the description should compensate by explaining direction of the xref lookup, return shape, and any behavioral constraints. It does not do so, leaving significant gaps for an agent to infer from the schema and sibling names alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well documented in the schema, including the required instance_id routing prerequisite and the limit default/max. The description adds no parameter meaning beyond the schema, which matches the baseline 3 for high-coverage schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a verb and resource ("获取交叉引用" / get cross-references), but the parenthetical "引用的目标地址" is ambiguous about direction: it does not clearly state whether the input addresses are the referencing sources or the referenced targets. It also does not distinguish this tool from close siblings like xref_query or xrefs_to_field.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no when-to-use guidance, no exclusions, and no alternatives. It does not mention that this should be preferred over or used instead of xref_query, xrefs_to_field, or other xref-related siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xrefs_to_fieldC
Get cross-references to structure fields
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | ||
| instance_id | Yes | 必须提供的 instance_id(或 client_id),用于将请求精确路由到特定的 IDA 实例。请先调用 instance_list 查看并选择合适的客户端 ID。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. The word 'Get' suggests a read-only operation, but nothing is said about return format, whether code and data references are separated, permissions, or side effects. For an unannotated tool, this is only minimal behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. However, it is under-specified for a tool with a nontrivial anyOf query parameter and instance routing, so its brevity comes at the cost of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no annotations, no output schema, and only partial input schema descriptions. The description adds almost no procedural or behavioral context, leaving the agent without enough information about usage, return values, or the required instance_id workflow beyond what the schema's Chinese parameter text provides.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not explain the parameters at all. The schema's instance_id description covers routing and instance_list, and nested struct/field descriptions exist, but the top-level queries parameter—which accepts either a single object or an array—is undocumented in both the description and schema. With only 50% schema description coverage, the description fails to compensate for the remaining ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Get) and resource (cross-references to structure fields), which is clearer than a generic xref query. However, it does not explicitly distinguish itself from siblings like xrefs_to or xref_query, so an agent must infer the difference from the resource phrase alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no conditions for choosing this tool over xrefs_to, xref_query, or other xref-related siblings, and no prerequisites. The purpose sentence implies usage but provides no explicit selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
66 tool updates
v2.1.0- First observed
analyze_batch - First observed
analyze_component - First observed
analyze_function - First observed
append_comments - First observed
basic_blocks - First observed
cache_status - First observed
callees - First observed
callgraph - First observed
declare_stack - First observed
declare_type - First observed
decompile - First observed
define_code - First observed
define_func - First observed
delete_stack - First observed
disasm - First observed
entity_query - First observed
enum_upsert - First observed
export_funcs - First observed
find - First observed
find_bytes - First observed
find_regex - First observed
find_xref_signatures - First observed
func_profile - First observed
func_query - First observed
get_bytes - First observed
get_global_value - First observed
get_int - First observed
get_string - First observed
idb_save - First observed
imports - First observed
imports_query - First observed
infer_types - First observed
insn_query - First observed
instance_info - First observed
instance_list - First observed
int_convert - First observed
list_funcs - First observed
list_globals - First observed
list_instances - First observed
lookup_funcs - First observed
make_signature - First observed
make_signature_for_function - First observed
make_signature_for_range - First observed
patch - First observed
patch_asm - First observed
put_int - First observed
read_struct - First observed
refresh_cache - First observed
rename - First observed
search_structs - First observed
search_text - First observed
select_instance - First observed
server_health - First observed
server_warmup - First observed
set_comments - First observed
set_type - First observed
stack_frame - First observed
survey_binary - First observed
trace_data_flow - First observed
type_apply_batch - First observed
type_inspect - First observed
type_query - First observed
undefine - First observed
xref_query - First observed
xrefs_to - First observed
xrefs_to_field
TDQS
Scored across 66 tools
Several tools appear to duplicate each other: instance_list vs list_instances both list IDA instances, imports vs imports_query, list_funcs vs func_query, and xrefs_to vs xref_query cover overlapping ground. Analysis tools (analyze_function, analyze_component, analyze_batch, func_profile, survey_binary) also overlap heavily, making selection between them uncertain.
The conventions are mixed: some tools are verb_noun (list_funcs, get_bytes, find_regex), others noun_verb (xrefs_to), others bare nouns (decompile, disasm, patch, rename, callees). The most glaring flaw is instance_list vs list_instances, the same concept with inverted word order.
At 66 tools this is far above a comfortable surface, and a meaningful subset are redundant query variants (imports_query, func_query, xref_query, entity_query) or near-duplicate instance/signature helpers. The domain is broad but the count is inflated by overlapping tools rather than distinct capabilities.
The surface is remarkably thorough for binary reverse engineering: decompilation, disassembly, xrefs, callgraphs, read/write/patch of memory and code, stack frames, type declaration, signatures, comments, renaming, and cache management are all present. Only minor lifecycle gaps (e.g. segment-level operations, richer diffing) seem missing.
Maintenance
Related MCP Connectors
AI Reasoning Cache & Consensus Layer with 11 MCP tools via Streamable HTTP.
- HutchDBOAuthcom.hutchdb
Store, query, and update structured data from any AI agent
Codebase intelligence for agents: 152 structured artifacts across 21 programs, one call.
Related MCP Servers
- AlicenseBqualityFmaintenanceA Model Context Protocol server for IDA interaction and automation. This server provides tools to read IDA database via Large Language Models.19547MIT
- AlicenseCqualityDmaintenanceEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.562MIT
- AlicenseNot gradedqualityCmaintenanceEnables LLM clients like Claude to interact with IDA Pro for binary analysis, decompilation, cross-references, patching, and more via 41 MCP tools, 8 resources, and 7 guided prompts.52MIT
- FlicenseNot gradedqualityCmaintenanceEnables LLMs to perform binary analysis and reverse engineering via IDA Pro's headless idalib, providing 66 MCP tools like decompile, disasm, and xrefs without requiring the IDA GUI.2-