Skip to main content
Glama

GhidraLens

Ghidra, renderizado dentro de tu cliente de IA. Haz clic en un símbolo para renombrarlo. Haz clic en una llamada para seguirla.

MCP Apps Ghidra 11.3+ Modelos locales MIT

La vista del descompilador

Todos los servidores MCP de Ghidra hasta ahora devuelven texto. El modelo puede leerlo; tú no puedes navegarlo. GhidraLens devuelve el mismo análisis como una vista interactiva — construida sobre MCP Apps (io.modelcontextprotocol/ui), la extensión que permite a un servidor enviar HTML real a la conversación.

Tú y el modelo estáis mirando el mismo programa en vivo. Renombra una variable haciendo clic en ella y la siguiente descompilación del modelo verá el nuevo nombre.

Esa es una captura de pantalla real: where.exe, descompilado por Ghidra, con cada identificador llevando la dirección de la que procede.


Qué obtienes

Vista

Qué hace

Descompilador

La salida en C de Ghidra como un flujo de tokens en vivo — cada identificador lleva su dirección y su tipo. Haz clic en una variable local para renombrarla, haz clic en una llamada para seguirla. Funciones llamantes, funciones llamadas y variables en una barra lateral.

Explorador de funciones

Cada función del binario, filtrable y ordenable por dirección, nombre, tamaño o número de llamantes. Haz clic en una fila para descompilarla.

Grafo de llamadas

Llamantes a la izquierda, llamados a la derecha, la función que preguntaste en el medio. Haz clic en cualquier nodo para recentrarlo.

Explorador de funciones

El explorador de funciones

Grafo de llamadas

El grafo de llamadas

Diez herramientas en total. Tres abren vistas; el resto son consultas y escrituras, incluidas dos que el modelo nunca ve — existen solo para que un clic en una vista pueda activarlas.

Related MCP server: GhidraMCP

Cómo encaja todo

  MCP client  ──stdio──▶  server/  ──HTTP──▶  bridge/  ──JPype──▶  Ghidra (JVM)
  (Claude,                 TypeScript         PyGhidra            program stays
   Cursor, …)              MCP server         session             resident
       ▲
       │  ui:// HTML in a sandboxed iframe
       └──  ui/  three self-contained views

El bridge es un proceso separado y de larga duración a propósito. El autoanálisis de Ghidra es el paso costoso, y ocurre una sola vez. Medido en una utilidad de sistema de Windows de 64 KB (198 funciones):

Primera apertura, con análisis

25 s

Reabrir el mismo binario

0.3 s

Descompilar una función de 2 KB

0.4 s

Grafo de llamadas de 87 nodos

< 0.1 s

Reinicia el servidor MCP o el cliente y el programa analizado sigue ahí.

Configuración

Requisitos: Ghidra 11.3+, un JDK 21+, Python 3.9–3.13 (no 3.14 — JPype aún no tiene wheel para ella), Node 20+. Consulta bridge/setup.py.md — la parte de Python es quisquillosa y ese archivo cubre todas las formas en que falla. GhidraLens encuentra un JDK por ti si JAVA_HOME no está definido, lo que cubre el caso típico de «Java instalado, shell sin reiniciar».

git clone https://github.com/hellosverre/ghidralens
cd ghidralens
npm install
npm run build

Luego, inicia el bridge sobre el binario que quieras examinar:

python bridge/serve.py --binary /path/to/target.exe

Imprime un token. Pon eso, junto con la ruta al servidor compilado, en la configuración de tu cliente MCP:

{
  "mcpServers": {
    "ghidralens": {
      "command": "node",
      "args": ["/absolute/path/to/ghidralens/server/dist/index.js"],
      "env": {
        "GHIDRALENS_BRIDGE_URL": "http://127.0.0.1:8799",
        "GHIDRALENS_TOKEN": "paste-the-printed-token-here"
      }
    }
  }
}

Luego pregúntale a tu cliente: «descompila la función que gestiona la validación de licencia».

Herramientas

Herramienta

Visible para

Renderiza

open_binary

modelo

—

program_info

modelo

—

decompile

modelo + vista

Descompilador

list_functions

modelo + vista

Explorador de funciones

call_graph

modelo + vista

Grafo de llamadas

find_strings

modelo

—

xrefs_to

modelo + vista

—

rename_symbol

modelo + vista

—

add_comment

solo vista

—

save_program

modelo

—

add_comment está oculta del modelo deliberadamente. La visibilidad es cómo MCP Apps separa «el agente puede hacer esto» de «un clic puede hacer esto»; mantener las herramientas de escritura fuera de la lista del modelo la mantiene corta e impide que el modelo renombre cosas por iniciativa propia.

Los cambios de nombre y los comentarios permanecen en memoria hasta que save_program los escribe en el proyecto de Ghidra — tras lo cual aparecen en la GUI de Ghidra como cualquier otra edición.

Desarrollar las vistas sin Ghidra

npm run dev:ui
# open http://localhost:5173/dev/harness.html

ui/dev/harness.ts es un host real de MCP Apps — ejecuta el AppBridge del SDK contra la vista en un iframe, de modo que el handshake ui/initialize, el ui/notifications/tool-result inicial y cada tools/call que dispara un clic viajan todos por JSON-RPC real sobre postMessage. Hay un trazado de mensajes en el lado derecho y un interruptor de tema del host, porque las vistas deben verse bien en ambos.

Dos fuentes de datos, conmutables en la barra de herramientas:

  • fixtures — no se necesita Ghidra, nada que instalar

  • live bridge — hace de proxy a un bridge en ejecución, para que desarrolles contra un programa real analizado

Usa live antes de confiar en nada. Los fixtures son ordenados; la salida real es una función de 400 líneas con 56 variables locales y un grafo de llamadas de 87 nodos, y es ahí donde el diseño realmente se rompe.

Ejecutarlo en un modelo local

La ingeniería inversa es exactamente el trabajo que la gente prefiere no enviar a un modelo alojado, así que agent/ollama-agent.mjs es un pequeño host MCP que pone GhidraLens detrás de Ollama. Sin clave de API, nada sale de la máquina.

OLLAMA_MODEL=qwen3:14b node agent/ollama-agent.mjs "what does this binary do?"

Respeta _meta.ui.visibility, de modo que las herramientas solo para la aplicación permanecen ocultas para el modelo — la misma separación que impone un cliente gráfico. Un modelo ~9B es suficiente para orientarse con find_strings y list_functions; uno de 14B es notablemente mejor leyendo C descompilado.

Pruebas

Suite

Necesita Ghidra

Cubre

node server/smoke.mjs

no

Superficie MCP: herramientas, recursos ui://, visibilidad de herramientas, fallo controlado sin bridge

python bridge/test_serve.py

no

Autenticación del bridge, rechazo de CSRF, enrutamiento, validación de entrada

python bridge/test_session.py

sí

Cada llamada a Ghidra: análisis, caché, tokens del descompilador, importaciones, renombrados, escrituras

node server/live.mjs

sí (bridge en ejecución)

Toda la cadena, y que cada payload coincide con la forma que las vistas indexan

Los dos primeros son los que CI puede ejecutar. test_session.py es el que importa después de modificar bridge/session.py — es lo único que demuestra que las llamadas a la API de Ghidra son correctas, y detectó tres errores reales el día en que se escribió.

Seguridad

El bridge se vincula solo a 127.0.0.1, requiere un token por ejecución en X-GhidraLens-Token, y rechaza cualquier solicitud que lleve una cabecera Origin o Referer — así, una página abierta en tu navegador no puede alcanzar tu descompilador. No tiene modelo multiusuario y no está pensado para exponerse; --host rechaza cualquier cosa que no sea loopback.

Analizar un binario no lo ejecuta, pero Ghidra abrirá malware de buena gana. Usa el mismo aislamiento que usarías para cualquier otro trabajo de RE.

Licencia

MIT.

Available Tools

10 tools
add_commentAdd commentA

Attach a plate comment at an address. Persists into the Ghidra project, so notes made here show up in the Ghidra GUI.

NameRequiredDescriptionDefault
textYes
addressYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is not read-only, and the description adds meaningful context by stating the comment persists into the Ghidra project and appears in the GUI. This goes beyond the annotation signal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no filler. The core action is front-loaded, and the second sentence adds relevant persistence behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, but the description omits important invocation details like address format and whether an existing comment is replaced or supplemented. It covers persistence well enough but is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description only generically references 'an address.' It does not explain the expected format of address (e.g., hex, symbol) or the semantics of text, leaving the agent without guidance on how to fill the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Attach a plate comment at an address.' This clearly identifies the operation and distinguishes it from sibling tools like decompile or rename_symbol.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives. The sentence about persistence provides motivation but not selection criteria or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

call_graphCall graphA
Read-only

Draw the callers and callees around one function as a navigable graph. Depth is capped at 3 because call graphs fan out exponentially.

NameRequiredDescriptionDefault
nameNo
depthNo
addressNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description complements this by disclosing the depth cap of 3 and the reason behind it (exponential fan-out). It also describes the output modality as a navigable graph, adding useful behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The main action is front-loaded, and the depth-cap rationale is a useful, concise addition that earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, no required parameters, and zero parameter descriptions, the description leaves important gaps: what 'name' vs 'address' mean, whether either is sufficient, and what the navigable graph output actually contains. For a tool with this much structural ambiguity, the description is not complete enough for an agent to invoke it reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the parameters, but it does not. 'name' and 'address' are both undocumented and their relationship is unclear, and 'depth' is only implicitly referenced by the cap statement, not explained as a user-controllable parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Draw') and clearly identifies the resource: callers and callees around one function. It also distinguishes this tool by emphasizing the navigable graph output, which separates it from list-oriented siblings like xrefs_to or list_functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context for use is implied: call_graph is for exploring the caller/callee relationships of a single function as a graph. However, it never explicitly states when to prefer this over xrefs_to or other sibling tools, nor does it mention any exclusions or alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decompileDecompile functionA
Read-only

Decompile one function to C and show it in an interactive view. Identify the function by address (hex) or by name.

NameRequiredDescriptionDefault
nameNoFunction name, e.g. main
addressNoEntry point, e.g. 0x140001000

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the tool is known to be a safe read operation. The description adds that the result appears in an interactive C view and that the function can be identified by address or name, which is useful but does not address edge behavior such as missing symbols or invalid addresses. Given the read-only annotation, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The core action and output are front-loaded in the first sentence, and the identification criteria complete the second sentence efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only decompile tool with two self-describing optional parameters, the description covers the main usage: decompile one function, see C in an interactive view, and identify the function by name or address. It does not describe failure behavior or state that at least one identifier is required, but that gap is minor given the clarity of the rest of the definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter described and exemplified in the input schema. The description adds the relationship that identification can be done 'by address (hex) or by name,' but it does not clarify whether exactly one must always be provided or what happens if both are supplied. Overall, the description adds only marginal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Decompile one function to C and show it in an interactive view.' This clearly conveys what the tool does and is easy to distinguish from siblings such as list_functions or call_graph, which target listing or relationships rather than C pseudocode for a single function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when a single function needs to be decompiled) and says how to identify the function 'by address (hex) or by name,' but it does not explicitly state when not to use it or name an alternative. The context is clear enough to infer basic usage, but there is no direct routing guidance versus sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_stringsFind stringsA
Read-only

Search defined string data. Usually the fastest way into an unknown binary - find the message, then look at what references it.

NameRequiredDescriptionDefault
limitNo
queryNo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, covering the safety profile, and the description aligns with that by describing a search operation. The description adds a speed/strategy heuristic beyond the annotations, but it does not disclose behavioral details such as case sensitivity, substring vs. exact matching, or how the limit parameter affects results. This is acceptable given the read-only annotation but not richly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences deliver a precise definition and a useful workflow heuristic. Every word earns its place, and the core action is front-loaded. No redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only search tool, the description provides enough to understand purpose and workflow. However, since there is no output schema and parameter descriptions are absent, an agent must infer query matching behavior, result shape, and the practical meaning of the limit parameter. Slightly more detail would make it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden of explaining parameters. It does not compensate: there is no mention of what query means (substring, regex, case sensitivity) or how limit behaves beyond the schema's min/max. The parameter names are somewhat self-explanatory, but the description adds no semantic value for them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action and resource: 'Search defined string data.' It also distinguishes itself from function-oriented siblings like decompile, list_functions, and call_graph by emphasizing string discovery. The added heuristic about finding a message and looking at references makes the purpose concrete and memorable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit context: it is 'usually the fastest way into an unknown binary' and suggests a follow-up step ('find the message, then look at what references it'). It does not explicitly name the sibling tool xrefs_to or state when not to use it, but the intended workflow is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_functionsList functionsA
Read-only

Browse the program's functions in a sortable table. Filter by substring; sort by address, name, size or caller count.

NameRequiredDescriptionDefault
sortNo
limitNo
queryNoCase-insensitive name filter
offsetNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful details about filter and sort behavior, but it does not disclose output shape, pagination semantics, or any limits beyond the schema. This is acceptable but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences pack in the resource, action, filtering capability, and sortable columns. There is no filler, and the most useful information is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with no required parameters, the description covers the core purpose and key behaviors well. The main gaps are lack of explicit return shape and default/pagination behavior, but the sortable-table framing plus the schema's limit/offset fields make this largely sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is low at 25%, so the description must compensate. It adds meaning for the query parameter ('substring') and repeats sort fields, matching the sort enum. However, limit and offset are not explained in the description, leaving pagination semantics to be inferred from their names and schema constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly names the resource ('the program's functions') and the action ('browse'), with concrete capabilities like substring filtering and sorting. It does not explicitly distinguish itself from siblings such as call_graph or program_info, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you need a sortable, filterable table of functions. However, it gives no explicit guidance about when to prefer list_functions over sibling tools, nor any exclusions or when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

open_binaryOpen binaryA

Load an executable into the Ghidra session and run auto-analysis. Slow the first time for a given file (seconds to minutes); cached in the Ghidra project afterwards. Must be called before anything else.

NameRequiredDescriptionDefault
pathYesAbsolute path to the executable
analyzeNoRun auto-analysis. Only set false if already analysed.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description meaningfully adds context beyond the annotations: it warns about slow first-time execution, notes caching behavior in the Ghidra project, and declares a prerequisite relationship with all other tools. It does not contradict the readOnlyHint=false / openWorldHint=false annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with no filler. The core behavior is front-loaded, followed by performance expectations and the essential ordering rule.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only two parameters and no output schema, the description covers the necessary operational context: what it does, how long it might take, that results are cached, and that it must run first. A small gap is that it does not explicitly mention error conditions or what happens if the path is invalid, but this is not essential for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description does not need to compensate. The description reinforces that auto-analysis happens, which aligns with the 'analyze' parameter, but it does not add new parameter-level meaning beyond what the schema already explains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific action: load an executable into the Ghidra session and run auto-analysis. This clearly differentiates it from sibling analytical tools like decompile, list_functions, or call_graph, which operate on an already-loaded program.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Must be called before anything else,' giving the agent a clear ordering constraint. It also provides practical timing guidance (slow first load, cached afterwards) that helps the agent decide when this tool is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

program_infoProgram infoA
Read-only

What is currently open: format, architecture, function count.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already communicates that this is a safe read operation, so the description does not need to restate that. It adds some value by enumerating exactly what information is available, but it does not describe the return shape or behavior when no program is currently open.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with no filler. It front-loads the scope ('currently open') and then lists the exact informational payload, so every word contributes to the agent's understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only informational tool, the description provides the essential facts needed to decide whether to call it. It is slightly thin on expected return formatting or behavior when no program is open, but those are minor given the simplicity and the safety annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, so the empty input schema fully covers the parameter surface. The description's mention of the 'currently open' program provides the only relevant context needed, which is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as the currently open program and lists the specific details returned: format, architecture, and function count. However, it lacks an explicit verb and does not directly distinguish itself from the sibling tools beyond the implied 'currently open' scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'currently open' gives useful context that this tool applies after a binary is loaded, and the sibling list includes open_binary as a likely alternative. Still, there is no explicit statement of when to use this tool versus others, leaving the routing mostly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rename_symbolRename symbolA

Rename a function, or a local variable inside one. Pass old_name to rename a local; omit it to rename the function itself. This is what a click on an identifier in the decompiler view fires.

NameRequiredDescriptionDefault
addressYesAddress of the function that owns the symbol
new_nameYes
old_nameNoCurrent local-variable name. Omit to rename the function.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal a mutating operation (readOnlyHint=false) that is not classified as destructive. The description adds the function-vs-local mode distinction, but that is also captured in the schema's old_name description. It does not disclose persistence, reference updates, return behavior, or error cases, so it adds only modest transparency beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: the first defines the operation, the second gives the conditional parameter behavior, and the third provides practical context. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward 3-parameter rename, the description plus schema is enough to select the correct parameters. However, there is no output schema and no mention of return values, side effects, name validity, or whether renaming updates references elsewhere. This leaves some invocation uncertainty for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description restates the old_name behavior already present in the schema ('Current local-variable name. Omit to rename the function.'). It does not add meaningful semantics for new_name beyond its schema minLength, nor does it explain naming constraints or the address parameter beyond what the schema states. With 67% schema coverage, the description is adequate but not compensatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Rename a function, or a local variable inside one.' It clearly differentiates from sibling tools by stating exactly what operation is performed, and the added UI-context sentence reinforces the tool's purpose without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit procedural guidance: pass old_name to rename a local variable, omit it to rename the function itself. It also notes that this is what a click on an identifier fires, giving a concrete real-world trigger. It does not explicitly name alternatives or exclusions, but the operation is distinct enough among siblings that this is a minor gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_programSave programA

Write renames and comments back to the Ghidra project on disk. Nothing is lost without this, but nothing is durable with it either.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag non-read-only, non-destructive, closed-world behavior, and the description adds a persistence trait: changes are only durable after calling it. It also implies that the tool has no effect without pending renames or comments, which is useful context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences that front-load the action and then add a memorable durability caveat. There is no filler or duplication of schema data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless save operation with no output schema, the description fully covers what the tool does and when its effect matters. No additional return-value or parameter details are needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and schema coverage is 100%, so there is nothing for the description to clarify. Baseline 4 applies for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the action (write back) and resource (renames/comments to the Ghidra project on disk), so an agent understands the tool's job. It doesn't explicitly name sibling tools like rename_symbol or add_comment, but the 'on disk' qualifier draws a practical distinction from in-memory edits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The durability remark ('Nothing is lost without this, but nothing is durable with it either') signals that this is a save/persist step to run after editing operations, not a standalone tool. It does not name exclusions or alternatives, but the sequencing is reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

xrefs_toCross-referencesB
Read-only

Everything that references an address.

NameRequiredDescriptionDefault
limitNo
addressYesTarget address, e.g. 0x140001000

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the read-only, closed-world character, and the description's 'Everything' is consistent with openWorldHint=false, suggesting an exhaustive in-program search. It adds little beyond the annotations, so it neither harms nor meaningfully enriches the behavioral picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The one-sentence description is short, with no filler. It is arguably too terse to carry much context, but for the core purpose it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read-only lookup, the basics are present: target address and optional limit appear in the schema. But there is no output schema and no mention of what the returned references look like or how the limit applies, so an agent must infer behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only the address parameter is documented in the schema; limit has no description, and the tool description adds no parameter-level meaning. At 50% coverage the description needed to compensate for the undocumented limit but did not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase 'Everything that references an address' clearly names the returned resource (cross-references to a target address) and implies a lookup action. It is not a tautology, but it lacks an explicit verb and does not contrast itself with siblings like call_graph, which also deals with reference relationships.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to prefer this tool over call_graph or other listing tools. The description merely states the function, so an agent gets no exclusions or selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.1.1
    • First observedadd_comment
    • First observedcall_graph
    • First observeddecompile
    • First observedfind_strings
    • First observedlist_functions
    • First observedopen_binary
    • First observedprogram_info
    • First observedrename_symbol
    • First observedsave_program
    • First observedxrefs_to

TDQS

A3.8/5.0

Scored across 10 tools

Disambiguation5/5

Each tool maps to a clearly distinct operation: loading, querying metadata, searching strings, decompiling, listing functions, graphing calls, finding xrefs, renaming, commenting, and saving. The few related tools like call_graph and xrefs_to are cleanly separated by their descriptions and intended use cases.

Naming Consistency4/5

Most tools follow a readable verb_noun pattern such as open_binary, find_strings, list_functions, rename_symbol, add_comment, and save_program. A few commands deviate—program_info, call_graph, and xrefs_to are noun-style and decompile is a bare verb—but the names are still concise, snake_case, and reasonably predictable.

Tool Count5/5

Ten tools is well-scoped for a Ghidra reverse-engineering server. Each tool covers a distinct step in the analyze-annotate-persist workflow, and none feel redundant or padded.

Completeness4/5

The surface covers the full core workflow: open, inspect, find strings, decompile, explore call graphs/xrefs, rename, comment, and save. Minor gaps remain—there is no raw disassembly view or broader symbol/import browser—but an agent can work around them using the provided tools.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables LLMs to autonomously reverse engineer binaries using Ghidra's capabilities including decompilation, function analysis, automatic renaming, and BSim integration for function similarity matching.
    1
    AGPL 3.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Bridges Ghidra's reverse engineering capabilities with AI tools through 179 specialized tools for automated binary analysis and documentation. It supports full read/write access for function decompilation, renaming, and cross-binary documentation transfer in both GUI and headless modes.
    Apache 2.0