ghidralens
GhidraLens
Ghidra を AI クライアント内に表示。シンボルをクリックすると名前を変更でき、コールをクリックすると追跡できます。

これまでの Ghidra MCP サーバーはどれもテキストを返すだけでした。モデルは読めますが、ユーザーは操作できません。GhidraLens は同じ解析結果を インタラクティブビュー として返します。これは MCP Apps(io.modelcontextprotocol/ui)上に構築されています。この拡張機能により、サーバーは実際の HTML を会話に組み込めるようになります。
あなたとモデルは同じライブプログラムを見ています。変数をクリックして名前を変更すると、モデルが次にデコンパイルするときには新しい名前が反映されます。
これは実際のスクリーンショットです。where.exe を Ghidra でデコンパイルしたもので、すべての識別子に由来元のアドレスが付与されています。
できること
ビュー | 説明 |
デコンパイラ | Ghidra の C 出力をライブなトークンストリームとして表示。すべての識別子にアドレスと種類が付与されます。ローカル変数をクリックすると名前を変更でき、コールをクリックすると追跡できます。サイドバーには呼び出し元、呼び出し先、変数が表示されます。 |
関数ブラウザ | バイナリ内のすべての関数を、アドレス・名前・サイズ・呼び出し元数でフィルタリング/ソートできます。行をクリックするとデコンパイルします。 |
コールグラフ | 呼び出し元を左、呼び出し先を右、指定した関数を中央に表示。ノードをクリックすると中央に再配置します。 |
関数ブラウザ

コールグラフ

ツールは全部で10個。3つはビューを開き、残りは検索と書き込みです。その中にはモデルが決して見ることのない2つがあり、ビュー内のクリックが発火させるためだけに存在します。
Related MCP server: GhidraMCP
連携の仕組み
MCP client ──stdio──▶ server/ ──HTTP──▶ bridge/ ──JPype──▶ Ghidra (JVM)
(Claude, TypeScript PyGhidra program stays
Cursor, …) MCP server session resident
▲
│ ui:// HTML in a sandboxed iframe
└── ui/ three self-contained viewsブリッジは意図的に独立した常駐プロセスにしています。Ghidra の自動解析はコストの高い処理ですが、これは 一度だけ 実行されます。64 KB の Windows システムユーティリティ(198関数)で測定した結果は次のとおりです。
初回オープン(解析込み) | 25 秒 |
同じバイナリを再度開く | 0.3 秒 |
2 KB の関数を1つデコンパイル | 0.4 秒 |
87ノードのコールグラフ | < 0.1 秒 |
MCP サーバーやクライアントを再起動しても、解析済みのプログラムはそのまま残ります。
セットアップ
前提条件: Ghidra 11.3+、JDK 21+、Python 3.9–3.13(3.14 は不可 — JPype にまだ wheel がないため)、Node 20+。bridge/setup.py.md を参照してください。Python 側は要求が厳しく、そのファイルに失敗するすべてのパターンが記載されています。JAVA_HOME が未設定の場合、GhidraLens が JDK を見つけてくれます。これにより「Java はインストール済みだがシェルを再起動していない」というよくあるケースにも対応できます。
git clone https://github.com/hellosverre/ghidralens
cd ghidralens
npm install
npm run build次に、確認したいバイナリに対してブリッジを起動します:
python bridge/serve.py --binary /path/to/target.exeトークンが出力されます。そのトークンとビルド済みサーバーへのパスを MCP クライアントの設定に記入します:
{
"mcpServers": {
"ghidralens": {
"command": "node",
"args": ["/absolute/path/to/ghidralens/server/dist/index.js"],
"env": {
"GHIDRALENS_BRIDGE_URL": "http://127.0.0.1:8799",
"GHIDRALENS_TOKEN": "paste-the-printed-token-here"
}
}
}
}あとはクライアントに次のように依頼するだけです: 「ライセンス検証を処理する関数をデコンパイルして」。
ツール
ツール | 表示先 | レンダリング |
| モデル | — |
| モデル | — |
| モデル + ビュー | デコンパイラ |
| モデル + ビュー | 関数ブラウザ |
| モデル + ビュー | コールグラフ |
| モデル | — |
| モデル + ビュー | — |
| モデル + ビュー | — |
| ビューのみ | — |
| モデル | — |
add_comment は意図的にモデルから隠されています。可視性は、MCP Apps が「エージェントが実行してよい操作」と「クリックが実行してよい操作」を分離する仕組みです。書き込みツールをモデルの一覧から外すことで、一覧を短く保ち、モデルが自発的に名前を変更するのを防ぎます。
名前の変更とコメントは、save_program で Ghidra プロジェクトに書き込まれるまでメモリ上に保持されます。書き込んだ後は、他の編集と同様に Ghidra GUI に表示されます。
Ghidra なしでビューを開発する
npm run dev:ui
# open http://localhost:5173/dev/harness.htmlui/dev/harness.ts は 本物の MCP Apps ホスト です。iframe 内のビューに対して SDK の AppBridge を実行するため、ui/initialize ハンドシェイク、開始時の ui/notifications/tool-result、クリックによって発火するすべての tools/call は、実際の postMessage JSON-RPC を経由します。右側にはメッセージトレースとホストテーマの切り替えがあります。ビューは両方のテーマで正しく表示される必要があるためです。
ツールバーで切り替えられる2つのデータソース:
fixtures — Ghidra 不要、インストールも不要
live bridge — 実行中のブリッジにプロキシするため、実際に解析されたプログラムに対して開発できます
何かを信用する前に、live で確認してください。fixtures はきれいですが、実際の出力はローカル変数56個を伴う400行の関数と87ノードのコールグラフで、実際にレイアウトが崩れるのはこのようなケースです。
ローカルモデルで実行する
リバースエンジニアリングは、まさにホスト型モデルに送信したくない種類の作業です。そのため、agent/ollama-agent.mjs は GhidraLens を Ollama の背後に置く小さな MCP ホストです。API キーは不要で、データがマシンの外に出ることもありません。
OLLAMA_MODEL=qwen3:14b node agent/ollama-agent.mjs "what does this binary do?"_meta.ui.visibility を尊重するため、アプリ専用ツールはモデルから見えないままになります。これはグラフィカルクライアントが強制するのと同じ分離です。~9B モデルでも find_strings と list_functions を使って方向を掴むには十分です。14B モデルなら、デコンパイルされた C を読む能力が著しく向上します。
テスト
スイート | Ghidra の要否 | 対象 |
| 不要 | MCP サーフェス: ツール、 |
| 不要 | ブリッジの認証、CSRF 拒否、ルーティング、入力検証 |
| 必要 | すべての Ghidra 呼び出し: 解析、キャッシュ、デコンパイラトークン、インポート、名前変更、書き込み |
| 必要(ブリッジ実行中) | チェーン全体と、すべてのペイロードがビューの参照先の形状に一致すること |
最初の2つは CI で実行できるものです。test_session.py は bridge/session.py に手を加えた後に重要となるテストです。Ghidra API 呼び出しが正しいことを証明できる唯一のテストであり、書かれた当日に実際のバグを3件検出しました。
セキュリティ
ブリッジは 127.0.0.1 にのみバインドし、X-GhidraLens-Token に実行ごとのトークンを要求し、Origin または Referer ヘッダーを含むリクエストをすべて拒否します。そのため、ブラウザで開いているページがデコンパイラに到達することはできません。マルチユーザーモデルはなく、外部公開を想定していません。--host はループバック以外を拒否します。
バイナリの解析はそれを実行するわけではありませんが、Ghidra はマルウェアをためらいなく開きます。他のリバースエンジニアリング作業と同じ隔離策を使用してください。
ライセンス
MIT。
Available Tools
10 toolsadd_commentAdd commentA
Attach a plate comment at an address. Persists into the Ghidra project, so notes made here show up in the Ghidra GUI.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| address | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is not read-only, and the description adds meaningful context by stating the comment persists into the Ghidra project and appears in the GUI. This goes beyond the annotation signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no filler. The core action is front-loaded, and the second sentence adds relevant persistence behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but the description omits important invocation details like address format and whether an existing comment is replaced or supplemented. It covers persistence well enough but is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only generically references 'an address.' It does not explain the expected format of address (e.g., hex, symbol) or the semantics of text, leaving the agent without guidance on how to fill the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Attach a plate comment at an address.' This clearly identifies the operation and distinguishes it from sibling tools like decompile or rename_symbol.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. The sentence about persistence provides motivation but not selection criteria or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
call_graphCall graphARead-only
Draw the callers and callees around one function as a navigable graph. Depth is capped at 3 because call graphs fan out exponentially.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| depth | No | ||
| address | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description complements this by disclosing the depth cap of 3 and the reason behind it (exponential fan-out). It also describes the output modality as a navigable graph, adding useful behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The main action is front-loaded, and the depth-cap rationale is a useful, concise addition that earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no required parameters, and zero parameter descriptions, the description leaves important gaps: what 'name' vs 'address' mean, whether either is sufficient, and what the navigable graph output actually contains. For a tool with this much structural ambiguity, the description is not complete enough for an agent to invoke it reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the parameters, but it does not. 'name' and 'address' are both undocumented and their relationship is unclear, and 'depth' is only implicitly referenced by the cap statement, not explained as a user-controllable parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Draw') and clearly identifies the resource: callers and callees around one function. It also distinguishes this tool by emphasizing the navigable graph output, which separates it from list-oriented siblings like xrefs_to or list_functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context for use is implied: call_graph is for exploring the caller/callee relationships of a single function as a graph. However, it never explicitly states when to prefer this over xrefs_to or other sibling tools, nor does it mention any exclusions or alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decompileDecompile functionARead-only
Decompile one function to C and show it in an interactive view. Identify the function by address (hex) or by name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Function name, e.g. main | |
| address | No | Entry point, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the tool is known to be a safe read operation. The description adds that the result appears in an interactive C view and that the function can be identified by address or name, which is useful but does not address edge behavior such as missing symbols or invalid addresses. Given the read-only annotation, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The core action and output are front-loaded in the first sentence, and the identification criteria complete the second sentence efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only decompile tool with two self-describing optional parameters, the description covers the main usage: decompile one function, see C in an interactive view, and identify the function by name or address. It does not describe failure behavior or state that at least one identifier is required, but that gap is minor given the clarity of the rest of the definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter described and exemplified in the input schema. The description adds the relationship that identification can be done 'by address (hex) or by name,' but it does not clarify whether exactly one must always be provided or what happens if both are supplied. Overall, the description adds only marginal value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Decompile one function to C and show it in an interactive view.' This clearly conveys what the tool does and is easy to distinguish from siblings such as list_functions or call_graph, which target listing or relationships rather than C pseudocode for a single function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when a single function needs to be decompiled) and says how to identify the function 'by address (hex) or by name,' but it does not explicitly state when not to use it or name an alternative. The context is clear enough to infer basic usage, but there is no direct routing guidance versus sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_stringsFind stringsARead-only
Search defined string data. Usually the fastest way into an unknown binary - find the message, then look at what references it.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, covering the safety profile, and the description aligns with that by describing a search operation. The description adds a speed/strategy heuristic beyond the annotations, but it does not disclose behavioral details such as case sensitivity, substring vs. exact matching, or how the limit parameter affects results. This is acceptable given the read-only annotation but not richly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences deliver a precise definition and a useful workflow heuristic. Every word earns its place, and the core action is front-loaded. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only search tool, the description provides enough to understand purpose and workflow. However, since there is no output schema and parameter descriptions are absent, an agent must infer query matching behavior, result shape, and the practical meaning of the limit parameter. Slightly more detail would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden of explaining parameters. It does not compensate: there is no mention of what query means (substring, regex, case sensitivity) or how limit behaves beyond the schema's min/max. The parameter names are somewhat self-explanatory, but the description adds no semantic value for them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action and resource: 'Search defined string data.' It also distinguishes itself from function-oriented siblings like decompile, list_functions, and call_graph by emphasizing string discovery. The added heuristic about finding a message and looking at references makes the purpose concrete and memorable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit context: it is 'usually the fastest way into an unknown binary' and suggests a follow-up step ('find the message, then look at what references it'). It does not explicitly name the sibling tool xrefs_to or state when not to use it, but the intended workflow is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_functionsList functionsARead-only
Browse the program's functions in a sortable table. Filter by substring; sort by address, name, size or caller count.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | ||
| limit | No | ||
| query | No | Case-insensitive name filter | |
| offset | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful details about filter and sort behavior, but it does not disclose output shape, pagination semantics, or any limits beyond the schema. This is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences pack in the resource, action, filtering capability, and sortable columns. There is no filler, and the most useful information is front-loaded in the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with no required parameters, the description covers the core purpose and key behaviors well. The main gaps are lack of explicit return shape and default/pagination behavior, but the sortable-table framing plus the schema's limit/offset fields make this largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low at 25%, so the description must compensate. It adds meaning for the query parameter ('substring') and repeats sort fields, matching the sort enum. However, limit and offset are not explained in the description, leaving pagination semantics to be inferred from their names and schema constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly names the resource ('the program's functions') and the action ('browse'), with concrete capabilities like substring filtering and sorting. It does not explicitly distinguish itself from siblings such as call_graph or program_info, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when you need a sortable, filterable table of functions. However, it gives no explicit guidance about when to prefer list_functions over sibling tools, nor any exclusions or when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_binaryOpen binaryA
Load an executable into the Ghidra session and run auto-analysis. Slow the first time for a given file (seconds to minutes); cached in the Ghidra project afterwards. Must be called before anything else.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the executable | |
| analyze | No | Run auto-analysis. Only set false if already analysed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description meaningfully adds context beyond the annotations: it warns about slow first-time execution, notes caching behavior in the Ghidra project, and declares a prerequisite relationship with all other tools. It does not contradict the readOnlyHint=false / openWorldHint=false annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with no filler. The core behavior is front-loaded, followed by performance expectations and the essential ordering rule.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only two parameters and no output schema, the description covers the necessary operational context: what it does, how long it might take, that results are cached, and that it must run first. A small gap is that it does not explicitly mention error conditions or what happens if the path is invalid, but this is not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to compensate. The description reinforces that auto-analysis happens, which aligns with the 'analyze' parameter, but it does not add new parameter-level meaning beyond what the schema already explains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific action: load an executable into the Ghidra session and run auto-analysis. This clearly differentiates it from sibling analytical tools like decompile, list_functions, or call_graph, which operate on an already-loaded program.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'Must be called before anything else,' giving the agent a clear ordering constraint. It also provides practical timing guidance (slow first load, cached afterwards) that helps the agent decide when this tool is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
program_infoProgram infoARead-only
What is currently open: format, architecture, function count.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already communicates that this is a safe read operation, so the description does not need to restate that. It adds some value by enumerating exactly what information is available, but it does not describe the return shape or behavior when no program is currently open.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler. It front-loads the scope ('currently open') and then lists the exact informational payload, so every word contributes to the agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only informational tool, the description provides the essential facts needed to decide whether to call it. It is slightly thin on expected return formatting or behavior when no program is open, but those are minor given the simplicity and the safety annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This tool has zero parameters, so the empty input schema fully covers the parameter surface. The description's mention of the 'currently open' program provides the only relevant context needed, which is appropriate here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource as the currently open program and lists the specific details returned: format, architecture, and function count. However, it lacks an explicit verb and does not directly distinguish itself from the sibling tools beyond the implied 'currently open' scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'currently open' gives useful context that this tool applies after a binary is loaded, and the sibling list includes open_binary as a likely alternative. Still, there is no explicit statement of when to use this tool versus others, leaving the routing mostly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rename_symbolRename symbolA
Rename a function, or a local variable inside one. Pass old_name to rename a local; omit it to rename the function itself. This is what a click on an identifier in the decompiler view fires.
| Name | Required | Description | Default |
|---|---|---|---|
| address | Yes | Address of the function that owns the symbol | |
| new_name | Yes | ||
| old_name | No | Current local-variable name. Omit to rename the function. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal a mutating operation (readOnlyHint=false) that is not classified as destructive. The description adds the function-vs-local mode distinction, but that is also captured in the schema's old_name description. It does not disclose persistence, reference updates, return behavior, or error cases, so it adds only modest transparency beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: the first defines the operation, the second gives the conditional parameter behavior, and the third provides practical context. There is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward 3-parameter rename, the description plus schema is enough to select the correct parameters. However, there is no output schema and no mention of return values, side effects, name validity, or whether renaming updates references elsewhere. This leaves some invocation uncertainty for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description restates the old_name behavior already present in the schema ('Current local-variable name. Omit to rename the function.'). It does not add meaningful semantics for new_name beyond its schema minLength, nor does it explain naming constraints or the address parameter beyond what the schema states. With 67% schema coverage, the description is adequate but not compensatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Rename a function, or a local variable inside one.' It clearly differentiates from sibling tools by stating exactly what operation is performed, and the added UI-context sentence reinforces the tool's purpose without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit procedural guidance: pass old_name to rename a local variable, omit it to rename the function itself. It also notes that this is what a click on an identifier fires, giving a concrete real-world trigger. It does not explicitly name alternatives or exclusions, but the operation is distinct enough among siblings that this is a minor gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_programSave programA
Write renames and comments back to the Ghidra project on disk. Nothing is lost without this, but nothing is durable with it either.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag non-read-only, non-destructive, closed-world behavior, and the description adds a persistence trait: changes are only durable after calling it. It also implies that the tool has no effect without pending renames or comments, which is useful context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences that front-load the action and then add a memorable durability caveat. There is no filler or duplication of schema data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless save operation with no output schema, the description fully covers what the tool does and when its effect matters. No additional return-value or parameter details are needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and schema coverage is 100%, so there is nothing for the description to clarify. Baseline 4 applies for a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the action (write back) and resource (renames/comments to the Ghidra project on disk), so an agent understands the tool's job. It doesn't explicitly name sibling tools like rename_symbol or add_comment, but the 'on disk' qualifier draws a practical distinction from in-memory edits.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The durability remark ('Nothing is lost without this, but nothing is durable with it either') signals that this is a save/persist step to run after editing operations, not a standalone tool. It does not name exclusions or alternatives, but the sequencing is reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xrefs_toCross-referencesBRead-only
Everything that references an address.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| address | Yes | Target address, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the read-only, closed-world character, and the description's 'Everything' is consistent with openWorldHint=false, suggesting an exhaustive in-program search. It adds little beyond the annotations, so it neither harms nor meaningfully enriches the behavioral picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The one-sentence description is short, with no filler. It is arguably too terse to carry much context, but for the core purpose it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read-only lookup, the basics are present: target address and optional limit appear in the schema. But there is no output schema and no mention of what the returned references look like or how the limit applies, so an agent must infer behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only the address parameter is documented in the schema; limit has no description, and the tool description adds no parameter-level meaning. At 50% coverage the description needed to compensate for the undocumented limit but did not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The phrase 'Everything that references an address' clearly names the returned resource (cross-references to a target address) and implies a lookup action. It is not a tautology, but it lacks an explicit verb and does not contrast itself with siblings like call_graph, which also deals with reference relationships.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given for when to prefer this tool over call_graph or other listing tools. The description merely states the function, so an agent gets no exclusions or selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.1- First observed
add_comment - First observed
call_graph - First observed
decompile - First observed
find_strings - First observed
list_functions - First observed
open_binary - First observed
program_info - First observed
rename_symbol - First observed
save_program - First observed
xrefs_to
TDQS
Scored across 10 tools
Each tool maps to a clearly distinct operation: loading, querying metadata, searching strings, decompiling, listing functions, graphing calls, finding xrefs, renaming, commenting, and saving. The few related tools like call_graph and xrefs_to are cleanly separated by their descriptions and intended use cases.
Most tools follow a readable verb_noun pattern such as open_binary, find_strings, list_functions, rename_symbol, add_comment, and save_program. A few commands deviate—program_info, call_graph, and xrefs_to are noun-style and decompile is a bare verb—but the names are still concise, snake_case, and reasonably predictable.
Ten tools is well-scoped for a Ghidra reverse-engineering server. Each tool covers a distinct step in the analyze-annotate-persist workflow, and none feel redundant or padded.
The surface covers the full core workflow: open, inspect, find strings, decompile, explore call graphs/xrefs, rename, comment, and save. Minor gaps remain—there is no raw disassembly view or broader symbol/import browser—but an agent can work around them using the provided tools.
Maintenance
Related MCP Connectors
Renders interactive Chart.js charts and dashboards inline in AI conversations.
Interactive data visualization and executive PDF dashboards for ChatGPT, Claude, and Cursor.
Turn calls and notes into process flow diagrams in Claude, ChatGPT, VS Code, Cursor, and Teams.
AI Agent with Architectural Memory. Impact analysis (free), tests and code from the graph (pro).
Related MCP Servers
- FlicenseAqualityDmaintenanceEnables LLMs to perform binary analysis using Ghidra in headless mode, extracting functions, pseudocode, structs, and enums from binaries for interactive reverse-engineering.94-
- AlicenseNot gradedqualityDmaintenanceEnables LLMs to autonomously reverse engineer binaries using Ghidra's capabilities including decompilation, function analysis, automatic renaming, and BSim integration for function similarity matching.1AGPL 3.0
- AlicenseNot gradedqualityCmaintenanceBridges Ghidra's reverse engineering capabilities with AI tools through 179 specialized tools for automated binary analysis and documentation. It supports full read/write access for function decompilation, renaming, and cross-binary documentation transfer in both GUI and headless modes.Apache 2.0
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to analyze binaries, debug processes, and inspect kernel state using Ghidra, x64dbg, WinDbg, and ILSpyCmd.10Apache 2.0