ghidralens
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GHIDRALENS_TOKEN | No | Shared secret printed by the PyGhidra bridge. Not needed to start the server or list its tools. | |
| GHIDRALENS_BRIDGE_URL | No | Where the PyGhidra bridge is listening. | http://127.0.0.1:8799 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| open_binaryA | Load an executable into the Ghidra session and run auto-analysis. Slow the first time for a given file (seconds to minutes); cached in the Ghidra project afterwards. Must be called before anything else. |
| program_infoA | What is currently open: format, architecture, function count. |
| decompileA | Decompile one function to C and show it in an interactive view. Identify the function by address (hex) or by name. |
| list_functionsA | Browse the program's functions in a sortable table. Filter by substring; sort by address, name, size or caller count. |
| call_graphA | Draw the callers and callees around one function as a navigable graph. Depth is capped at 3 because call graphs fan out exponentially. |
| find_stringsA | Search defined string data. Usually the fastest way into an unknown binary - find the message, then look at what references it. |
| xrefs_toB | Everything that references an address. |
| rename_symbolA | Rename a function, or a local variable inside one. Pass old_name to rename a local; omit it to rename the function itself. This is what a click on an identifier in the decompiler view fires. |
| add_commentA | Attach a plate comment at an address. Persists into the Ghidra project, so notes made here show up in the Ghidra GUI. |
| save_programA | Write renames and comments back to the Ghidra project on disk. Nothing is lost without this, but nothing is durable with it either. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Decompiler | Ghidra's C output with every identifier clickable - rename symbols, follow calls, read cross-references without leaving the conversation. |
| Function Browser | Sortable, filterable table of every function in the program. |
| Call Graph | Callers and callees around one function, laid out as a navigable graph. |
TDQS
Scored across 10 tools
Each tool maps to a clearly distinct operation: loading, querying metadata, searching strings, decompiling, listing functions, graphing calls, finding xrefs, renaming, commenting, and saving. The few related tools like call_graph and xrefs_to are cleanly separated by their descriptions and intended use cases.
Most tools follow a readable verb_noun pattern such as open_binary, find_strings, list_functions, rename_symbol, add_comment, and save_program. A few commands deviate—program_info, call_graph, and xrefs_to are noun-style and decompile is a bare verb—but the names are still concise, snake_case, and reasonably predictable.
Ten tools is well-scoped for a Ghidra reverse-engineering server. Each tool covers a distinct step in the analyze-annotate-persist workflow, and none feel redundant or padded.
The surface covers the full core workflow: open, inspect, find strings, decompile, explore call graphs/xrefs, rename, comment, and save. Minor gaps remain—there is no raw disassembly view or broader symbol/import browser—but an agent can work around them using the provided tools.