Skip to main content
Glama

GhidraLens

AI 클라이언트 안에서 렌더링되는 Ghidra. 심볼을 클릭해 이름을 바꾸고, 호출을 클릭해 따라가세요.

MCP Apps Ghidra 11.3+ Local models MIT

디컴파일러 뷰

지금까지의 모든 Ghidra MCP 서버는 텍스트만 반환합니다. 모델은 읽을 수 있지만, 사용자는 탐색할 수 없습니다. GhidraLens는 동일한 분석을 대화형 뷰로 반환합니다 — MCP Apps (io.modelcontextprotocol/ui) 기반, 서버가 실제 HTML을 대화에 실어 보낼 수 있게 해주는 확장 기능입니다.

사용자와 모델은 동일한 라이브 프로그램을 보고 있습니다. 변수를 클릭해 이름을 바꾸면 모델의 다음 디컴파일에 새 이름이 반영됩니다.

실제 스크린샷입니다: where.exe를 Ghidra로 디컴파일한 것으로, 모든 식별자가 출처 주소를 담고 있습니다.


제공 기능

뷰

기능

디컴파일러

Ghidra의 C 출력을 라이브 토큰 스트림으로 제공 — 모든 식별자가 주소와 종류를 담고 있습니다. 지역 변수를 클릭해 이름을 바꾸고, 호출을 클릭해 따라가세요. 호출자, 피호출자, 변수가 사이드바에 표시됩니다.

함수 브라우저

바이너리의 모든 함수를 주소, 이름, 크기 또는 호출자 수로 필터링하고 정렬할 수 있습니다. 행을 클릭하면 디컴파일합니다.

호출 그래프

왼쪽에 호출자, 오른쪽에 피호출자, 가운데에 요청한 함수가 표시됩니다. 노드를 클릭하면 다시 중앙에 배치됩니다.

함수 브라우저

함수 브라우저

호출 그래프

호출 그래프

총 10개의 도구가 있습니다. 세 개는 뷰를 열고, 나머지는 조회 및 쓰기 작업입니다. 그중 두 개는 모델이 볼 수 없습니다 — 뷰에서의 클릭이 실행할 수 있도록만 존재합니다.

Related MCP server: GhidraMCP

구성 방식

  MCP client  ──stdio──▶  server/  ──HTTP──▶  bridge/  ──JPype──▶  Ghidra (JVM)
  (Claude,                 TypeScript         PyGhidra            program stays
   Cursor, …)              MCP server         session             resident
       ▲
       │  ui:// HTML in a sandboxed iframe
       └──  ui/  three self-contained views

브리지는 의도적으로 별도의 장기 실행 프로세스입니다. Ghidra의 자동 분석이 가장 비용이 큰 단계이며, 한 번만 수행됩니다. 64KB Windows 시스템 유틸리티(198개 함수) 기준 측정값:

최초 열기 (분석 포함)

25 s

동일 바이너리 다시 열기

0.3 s

2KB 함수 하나 디컴파일

0.4 s

87노드 호출 그래프

< 0.1 s

MCP 서버나 클라이언트를 재시작해도 분석된 프로그램은 그대로 유지됩니다.

설정

사전 요구 사항: Ghidra 11.3+, JDK 21+, Python 3.9–3.13 (3.14 제외 — JPype에 아직 휠이 없습니다), Node 20+. bridge/setup.py.md를 참조하세요 — Python 쪽이 까다로우며 해당 파일에 잘못될 수 있는 모든 경우가 정리되어 있습니다. JAVA_HOME이 설정되지 않은 경우 GhidraLens가 JDK를 자동으로 찾아줍니다. 이는 흔한 "Java는 설치했지만 셸을 재시작하지 않은" 상황을 해결합니다.

git clone https://github.com/hellosverre/ghidralens
cd ghidralens
npm install
npm run build

그런 다음 살펴보려는 바이너리에서 브리지를 시작합니다:

python bridge/serve.py --binary /path/to/target.exe

토큰을 출력합니다. 해당 토큰과 빌드된 서버의 경로를 MCP 클라이언트 설정에 입력하세요:

{
  "mcpServers": {
    "ghidralens": {
      "command": "node",
      "args": ["/absolute/path/to/ghidralens/server/dist/index.js"],
      "env": {
        "GHIDRALENS_BRIDGE_URL": "http://127.0.0.1:8799",
        "GHIDRALENS_TOKEN": "paste-the-printed-token-here"
      }
    }
  }
}

그런 다음 클라이언트에 요청하세요: "라이선스 검증을 처리하는 함수를 디컴파일해 줘".

도구

도구

표시 대상

렌더링

open_binary

모델

—

program_info

모델

—

decompile

모델 + 뷰

디컴파일러

list_functions

모델 + 뷰

함수 브라우저

call_graph

모델 + 뷰

호출 그래프

find_strings

모델

—

xrefs_to

모델 + 뷰

—

rename_symbol

모델 + 뷰

—

add_comment

뷰 전용

—

save_program

모델

—

add_comment는 의도적으로 모델에게 숨겨져 있습니다. 표시 여부는 MCP Apps가 "에이전트가 할 수 있는 일"과 "클릭이 할 수 있는 일"을 구분하는 방식입니다. 쓰기 도구를 모델의 목록에서 제외하면 목록이 짧게 유지되고 모델이 임의로 이름을 바꾸는 것을 방지할 수 있습니다.

이름 변경과 주석은 save_program이 Ghidra 프로젝트에 기록할 때까지 메모리에 유지됩니다 — 이후에는 다른 편집과 마찬가지로 Ghidra GUI에 표시됩니다.

Ghidra 없이 뷰 개발하기

npm run dev:ui
# open http://localhost:5173/dev/harness.html

ui/dev/harness.ts는 실제 MCP Apps 호스트입니다 — SDK의 AppBridge를 iframe 안의 뷰에 대해 실행하므로 ui/initialize 핸드셰이크, 시작 시의 ui/notifications/tool-result, 그리고 클릭이 발생시키는 모든 tools/call이 실제 postMessage JSON-RPC를 통해 전달됩니다. 오른쪽에 메시지 추적이 있고 호스트 테마 전환 기능도 있습니다. 뷰가 두 테마 모두에서 올바르게 보여야 하기 때문입니다.

툴바에서 전환할 수 있는 두 가지 데이터 소스:

  • fixtures — Ghidra 불필요, 설치할 것 없음

  • live bridge — 실행 중인 브리지에 프록시하므로 실제 분석된 프로그램을 대상으로 개발할 수 있습니다.

무엇이든 신뢰하기 전에 live를 사용하세요. Fixtures는 깔끔합니다. 실제 출력은 지역 변수 56개를 가진 400줄짜리 함수와 87노드 호출 그래프이며, 레이아웃이 실제로 깨지는 지점이 바로 여기입니다.

로컬 모델에서 실행하기

리버스 엔지니어링은 사람들이 호스팅 모델에 보내고 싶지 않아 하는 작업이므로, agent/ollama-agent.mjs는 GhidraLens를 Ollama 뒤에 배치하는 소규모 MCP 호스트입니다. API 키가 필요 없고, 어떤 것도 머신 밖으로 나가지 않습니다.

OLLAMA_MODEL=qwen3:14b node agent/ollama-agent.mjs "what does this binary do?"

_meta.ui.visibility를 존중하므로 앱 전용 도구는 모델에게 숨겨진 상태로 유지됩니다 — 그래픽 클라이언트가 강제하는 것과 동일한 분리입니다. ~9B 모델은 find_strings와 list_functions로 방향을 잡기에 충분하고, 14B 모델은 디컴파일된 C를 읽는 데 눈에 띄게 더 뛰어납니다.

테스트

스위트

Ghidra 필요

범위

node server/smoke.mjs

아니요

MCP 표면: 도구, ui:// 리소스, 도구 표시 여부, 브리지 없는 경우의 정상 실패

python bridge/test_serve.py

아니요

브리지 인증, CSRF 거부, 라우팅, 입력 검증

python bridge/test_session.py

예

모든 Ghidra 호출: 분석, 캐싱, 디컴파일러 토큰, 임포트, 이름 변경, 쓰기

node server/live.mjs

예 (브리지 실행 중)

전체 체인, 그리고 모든 페이로드가 뷰가 인덱싱하는 형태와 일치하는지 확인

처음 두 개는 CI에서 실행할 수 있는 것들입니다. test_session.py는 bridge/session.py를 수정한 후 가장 중요한 테스트입니다 — Ghidra API 호출이 올바른지 증명하는 유일한 테스트이며, 작성된 날 실제 버그 3개를 잡아냈습니다.

보안

브리지는 127.0.0.1에만 바인딩하고, X-GhidraLens-Token에 실행별 토큰을 요구하며, Origin 또는 Referer 헤더가 있는 모든 요청을 거부합니다 — 따라서 브라우저에 열린 페이지는 디컴파일러에 접근할 수 없습니다. 멀티유저 모델이 없으며 외부에 노출되도록 설계되지 않았습니다. --host는 루프백 외의 모든 것을 거부합니다.

바이너리를 분석하는 것은 실행을 의미하지 않지만, Ghidra는 맬웨어도 기꺼이 열어줍니다. 다른 RE 작업과 동일한 격리 조치를 사용하세요.

라이선스

MIT.

Available Tools

10 tools
add_commentAdd commentA

Attach a plate comment at an address. Persists into the Ghidra project, so notes made here show up in the Ghidra GUI.

NameRequiredDescriptionDefault
textYes
addressYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is not read-only, and the description adds meaningful context by stating the comment persists into the Ghidra project and appears in the GUI. This goes beyond the annotation signal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no filler. The core action is front-loaded, and the second sentence adds relevant persistence behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, but the description omits important invocation details like address format and whether an existing comment is replaced or supplemented. It covers persistence well enough but is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description only generically references 'an address.' It does not explain the expected format of address (e.g., hex, symbol) or the semantics of text, leaving the agent without guidance on how to fill the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Attach a plate comment at an address.' This clearly identifies the operation and distinguishes it from sibling tools like decompile or rename_symbol.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives. The sentence about persistence provides motivation but not selection criteria or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

call_graphCall graphA
Read-only

Draw the callers and callees around one function as a navigable graph. Depth is capped at 3 because call graphs fan out exponentially.

NameRequiredDescriptionDefault
nameNo
depthNo
addressNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description complements this by disclosing the depth cap of 3 and the reason behind it (exponential fan-out). It also describes the output modality as a navigable graph, adding useful behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The main action is front-loaded, and the depth-cap rationale is a useful, concise addition that earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, no required parameters, and zero parameter descriptions, the description leaves important gaps: what 'name' vs 'address' mean, whether either is sufficient, and what the navigable graph output actually contains. For a tool with this much structural ambiguity, the description is not complete enough for an agent to invoke it reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the parameters, but it does not. 'name' and 'address' are both undocumented and their relationship is unclear, and 'depth' is only implicitly referenced by the cap statement, not explained as a user-controllable parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Draw') and clearly identifies the resource: callers and callees around one function. It also distinguishes this tool by emphasizing the navigable graph output, which separates it from list-oriented siblings like xrefs_to or list_functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context for use is implied: call_graph is for exploring the caller/callee relationships of a single function as a graph. However, it never explicitly states when to prefer this over xrefs_to or other sibling tools, nor does it mention any exclusions or alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decompileDecompile functionA
Read-only

Decompile one function to C and show it in an interactive view. Identify the function by address (hex) or by name.

NameRequiredDescriptionDefault
nameNoFunction name, e.g. main
addressNoEntry point, e.g. 0x140001000

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the tool is known to be a safe read operation. The description adds that the result appears in an interactive C view and that the function can be identified by address or name, which is useful but does not address edge behavior such as missing symbols or invalid addresses. Given the read-only annotation, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The core action and output are front-loaded in the first sentence, and the identification criteria complete the second sentence efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only decompile tool with two self-describing optional parameters, the description covers the main usage: decompile one function, see C in an interactive view, and identify the function by name or address. It does not describe failure behavior or state that at least one identifier is required, but that gap is minor given the clarity of the rest of the definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter described and exemplified in the input schema. The description adds the relationship that identification can be done 'by address (hex) or by name,' but it does not clarify whether exactly one must always be provided or what happens if both are supplied. Overall, the description adds only marginal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Decompile one function to C and show it in an interactive view.' This clearly conveys what the tool does and is easy to distinguish from siblings such as list_functions or call_graph, which target listing or relationships rather than C pseudocode for a single function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when a single function needs to be decompiled) and says how to identify the function 'by address (hex) or by name,' but it does not explicitly state when not to use it or name an alternative. The context is clear enough to infer basic usage, but there is no direct routing guidance versus sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_stringsFind stringsA
Read-only

Search defined string data. Usually the fastest way into an unknown binary - find the message, then look at what references it.

NameRequiredDescriptionDefault
limitNo
queryNo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, covering the safety profile, and the description aligns with that by describing a search operation. The description adds a speed/strategy heuristic beyond the annotations, but it does not disclose behavioral details such as case sensitivity, substring vs. exact matching, or how the limit parameter affects results. This is acceptable given the read-only annotation but not richly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences deliver a precise definition and a useful workflow heuristic. Every word earns its place, and the core action is front-loaded. No redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only search tool, the description provides enough to understand purpose and workflow. However, since there is no output schema and parameter descriptions are absent, an agent must infer query matching behavior, result shape, and the practical meaning of the limit parameter. Slightly more detail would make it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden of explaining parameters. It does not compensate: there is no mention of what query means (substring, regex, case sensitivity) or how limit behaves beyond the schema's min/max. The parameter names are somewhat self-explanatory, but the description adds no semantic value for them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action and resource: 'Search defined string data.' It also distinguishes itself from function-oriented siblings like decompile, list_functions, and call_graph by emphasizing string discovery. The added heuristic about finding a message and looking at references makes the purpose concrete and memorable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit context: it is 'usually the fastest way into an unknown binary' and suggests a follow-up step ('find the message, then look at what references it'). It does not explicitly name the sibling tool xrefs_to or state when not to use it, but the intended workflow is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_functionsList functionsA
Read-only

Browse the program's functions in a sortable table. Filter by substring; sort by address, name, size or caller count.

NameRequiredDescriptionDefault
sortNo
limitNo
queryNoCase-insensitive name filter
offsetNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful details about filter and sort behavior, but it does not disclose output shape, pagination semantics, or any limits beyond the schema. This is acceptable but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences pack in the resource, action, filtering capability, and sortable columns. There is no filler, and the most useful information is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with no required parameters, the description covers the core purpose and key behaviors well. The main gaps are lack of explicit return shape and default/pagination behavior, but the sortable-table framing plus the schema's limit/offset fields make this largely sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is low at 25%, so the description must compensate. It adds meaning for the query parameter ('substring') and repeats sort fields, matching the sort enum. However, limit and offset are not explained in the description, leaving pagination semantics to be inferred from their names and schema constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly names the resource ('the program's functions') and the action ('browse'), with concrete capabilities like substring filtering and sorting. It does not explicitly distinguish itself from siblings such as call_graph or program_info, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you need a sortable, filterable table of functions. However, it gives no explicit guidance about when to prefer list_functions over sibling tools, nor any exclusions or when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

open_binaryOpen binaryA

Load an executable into the Ghidra session and run auto-analysis. Slow the first time for a given file (seconds to minutes); cached in the Ghidra project afterwards. Must be called before anything else.

NameRequiredDescriptionDefault
pathYesAbsolute path to the executable
analyzeNoRun auto-analysis. Only set false if already analysed.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description meaningfully adds context beyond the annotations: it warns about slow first-time execution, notes caching behavior in the Ghidra project, and declares a prerequisite relationship with all other tools. It does not contradict the readOnlyHint=false / openWorldHint=false annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with no filler. The core behavior is front-loaded, followed by performance expectations and the essential ordering rule.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only two parameters and no output schema, the description covers the necessary operational context: what it does, how long it might take, that results are cached, and that it must run first. A small gap is that it does not explicitly mention error conditions or what happens if the path is invalid, but this is not essential for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description does not need to compensate. The description reinforces that auto-analysis happens, which aligns with the 'analyze' parameter, but it does not add new parameter-level meaning beyond what the schema already explains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific action: load an executable into the Ghidra session and run auto-analysis. This clearly differentiates it from sibling analytical tools like decompile, list_functions, or call_graph, which operate on an already-loaded program.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Must be called before anything else,' giving the agent a clear ordering constraint. It also provides practical timing guidance (slow first load, cached afterwards) that helps the agent decide when this tool is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

program_infoProgram infoA
Read-only

What is currently open: format, architecture, function count.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already communicates that this is a safe read operation, so the description does not need to restate that. It adds some value by enumerating exactly what information is available, but it does not describe the return shape or behavior when no program is currently open.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with no filler. It front-loads the scope ('currently open') and then lists the exact informational payload, so every word contributes to the agent's understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only informational tool, the description provides the essential facts needed to decide whether to call it. It is slightly thin on expected return formatting or behavior when no program is open, but those are minor given the simplicity and the safety annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, so the empty input schema fully covers the parameter surface. The description's mention of the 'currently open' program provides the only relevant context needed, which is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as the currently open program and lists the specific details returned: format, architecture, and function count. However, it lacks an explicit verb and does not directly distinguish itself from the sibling tools beyond the implied 'currently open' scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'currently open' gives useful context that this tool applies after a binary is loaded, and the sibling list includes open_binary as a likely alternative. Still, there is no explicit statement of when to use this tool versus others, leaving the routing mostly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rename_symbolRename symbolA

Rename a function, or a local variable inside one. Pass old_name to rename a local; omit it to rename the function itself. This is what a click on an identifier in the decompiler view fires.

NameRequiredDescriptionDefault
addressYesAddress of the function that owns the symbol
new_nameYes
old_nameNoCurrent local-variable name. Omit to rename the function.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal a mutating operation (readOnlyHint=false) that is not classified as destructive. The description adds the function-vs-local mode distinction, but that is also captured in the schema's old_name description. It does not disclose persistence, reference updates, return behavior, or error cases, so it adds only modest transparency beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: the first defines the operation, the second gives the conditional parameter behavior, and the third provides practical context. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward 3-parameter rename, the description plus schema is enough to select the correct parameters. However, there is no output schema and no mention of return values, side effects, name validity, or whether renaming updates references elsewhere. This leaves some invocation uncertainty for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description restates the old_name behavior already present in the schema ('Current local-variable name. Omit to rename the function.'). It does not add meaningful semantics for new_name beyond its schema minLength, nor does it explain naming constraints or the address parameter beyond what the schema states. With 67% schema coverage, the description is adequate but not compensatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Rename a function, or a local variable inside one.' It clearly differentiates from sibling tools by stating exactly what operation is performed, and the added UI-context sentence reinforces the tool's purpose without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit procedural guidance: pass old_name to rename a local variable, omit it to rename the function itself. It also notes that this is what a click on an identifier fires, giving a concrete real-world trigger. It does not explicitly name alternatives or exclusions, but the operation is distinct enough among siblings that this is a minor gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_programSave programA

Write renames and comments back to the Ghidra project on disk. Nothing is lost without this, but nothing is durable with it either.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag non-read-only, non-destructive, closed-world behavior, and the description adds a persistence trait: changes are only durable after calling it. It also implies that the tool has no effect without pending renames or comments, which is useful context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences that front-load the action and then add a memorable durability caveat. There is no filler or duplication of schema data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless save operation with no output schema, the description fully covers what the tool does and when its effect matters. No additional return-value or parameter details are needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and schema coverage is 100%, so there is nothing for the description to clarify. Baseline 4 applies for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the action (write back) and resource (renames/comments to the Ghidra project on disk), so an agent understands the tool's job. It doesn't explicitly name sibling tools like rename_symbol or add_comment, but the 'on disk' qualifier draws a practical distinction from in-memory edits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The durability remark ('Nothing is lost without this, but nothing is durable with it either') signals that this is a save/persist step to run after editing operations, not a standalone tool. It does not name exclusions or alternatives, but the sequencing is reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

xrefs_toCross-referencesB
Read-only

Everything that references an address.

NameRequiredDescriptionDefault
limitNo
addressYesTarget address, e.g. 0x140001000

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the read-only, closed-world character, and the description's 'Everything' is consistent with openWorldHint=false, suggesting an exhaustive in-program search. It adds little beyond the annotations, so it neither harms nor meaningfully enriches the behavioral picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The one-sentence description is short, with no filler. It is arguably too terse to carry much context, but for the core purpose it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read-only lookup, the basics are present: target address and optional limit appear in the schema. But there is no output schema and no mention of what the returned references look like or how the limit applies, so an agent must infer behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only the address parameter is documented in the schema; limit has no description, and the tool description adds no parameter-level meaning. At 50% coverage the description needed to compensate for the undocumented limit but did not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase 'Everything that references an address' clearly names the returned resource (cross-references to a target address) and implies a lookup action. It is not a tautology, but it lacks an explicit verb and does not contrast itself with siblings like call_graph, which also deals with reference relationships.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to prefer this tool over call_graph or other listing tools. The description merely states the function, so an agent gets no exclusions or selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.1.1
    • First observedadd_comment
    • First observedcall_graph
    • First observeddecompile
    • First observedfind_strings
    • First observedlist_functions
    • First observedopen_binary
    • First observedprogram_info
    • First observedrename_symbol
    • First observedsave_program
    • First observedxrefs_to

TDQS

A3.8/5.0

Scored across 10 tools

Disambiguation5/5

Each tool maps to a clearly distinct operation: loading, querying metadata, searching strings, decompiling, listing functions, graphing calls, finding xrefs, renaming, commenting, and saving. The few related tools like call_graph and xrefs_to are cleanly separated by their descriptions and intended use cases.

Naming Consistency4/5

Most tools follow a readable verb_noun pattern such as open_binary, find_strings, list_functions, rename_symbol, add_comment, and save_program. A few commands deviate—program_info, call_graph, and xrefs_to are noun-style and decompile is a bare verb—but the names are still concise, snake_case, and reasonably predictable.

Tool Count5/5

Ten tools is well-scoped for a Ghidra reverse-engineering server. Each tool covers a distinct step in the analyze-annotate-persist workflow, and none feel redundant or padded.

Completeness4/5

The surface covers the full core workflow: open, inspect, find strings, decompile, explore call graphs/xrefs, rename, comment, and save. Minor gaps remain—there is no raw disassembly view or broader symbol/import browser—but an agent can work around them using the provided tools.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables LLMs to autonomously reverse engineer binaries using Ghidra's capabilities including decompilation, function analysis, automatic renaming, and BSim integration for function similarity matching.
    1
    AGPL 3.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Bridges Ghidra's reverse engineering capabilities with AI tools through 179 specialized tools for automated binary analysis and documentation. It supports full read/write access for function decompilation, renaming, and cross-binary documentation transfer in both GUI and headless modes.
    Apache 2.0