ih8sn1ff
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GHIDRA_INSTALL_DIR | No | Path to the extracted Ghidra 12.x release directory. Optional; enables Ghidra headless import/decompilation tools and is auto-detected when omitted. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| bin_infoC | PE/ELF metadata: arch, image base, entry RVA, sections, entropy, packer hints. |
| strings_scanC | Extract printable strings with file offsets. encoding: ascii, utf16, both. |
| entropy_mapC | Windowed Shannon entropy: packed/encrypted vs plaintext regions. |
| find_blobsC | Carve embedded archives or PEs by signature (kind: zip, pe, gzip). |
| run_and_dumpC | Launch a target (optionally elevated), wait, dump all module images, terminate it. |
| dump_processC | Dump every module image of a running process; writes dump_meta.json. |
| rebuild_peB | Rebuild a file-aligned PE from a runtime memory image (Scylla-style unmap). |
| trim_peC | Shrink an unpacked PE for analysis: huge protector arenas keep only a prefix. |
| rebuild_importsC | Rebuild a dump's IAT/import directory from dump_meta.json module metadata. |
| delphi_methodsC | Map Delphi published-method names to code RVAs. |
| delphi_unitsC | Frequency-ranked Delphi unit (a.b.c) and TClass inventory. |
| disasmC | Capstone x86/x64 listing at addr (hex string). base: file or rva. |
| xrefsC | Find absolute-immediate references to a value or string. |
| xrefs_ripC | Find RIP-relative memory refs and direct branches (RVA space; layout auto/dump/file). |
| callgraphB | Breadth-first direct-call graph from an RVA/VA (indirect calls unresolved). |
| emulateC | Bounded Unicorn emulation in RVA space with an execution trace. |
| debug_launchC | Launch a Windows target (x64 or WOW64 x86) under the debugger; specs 'module:0xRVA' or '0xVA'. |
| debug_continueB | Resume a debug session and wait for the next stop or timeout. |
| debug_stateB | Return the debug session summary without touching the target. |
| debug_registersC | Read x64 general-purpose registers of the last stopped thread. |
| debug_read_memoryC | Read target memory (hex) at an absolute address. |
| debug_write_memoryC | Write bytes (hex string) into target memory. |
| debug_breakpoint_addC | Add a software breakpoint by absolute VA or module + RVA. |
| debug_breakpoint_removeC | Remove a breakpoint and restore the original byte. |
| debug_dumpC | Dump module images of the stopped process (dump offset == RVA). |
| debug_closeB | Terminate the target (if alive) and release the debug session. |
| ghidra_importC | Headless Ghidra import into a project (analysis: full or none). |
| ghidra_decompileC | Decompile functions by RVA list and/or by string keywords. |
| ghidra_funcsC | List analyzed functions (address + name) from a Ghidra project. |
| dotnet_typesC | List types in a managed assembly via ilspycmd, optionally filtered. |
| dotnet_typeB | Decompile one managed type to C# via ilspycmd. |
| yara_scanB | Run YARA rules; without rules_file the bundled packer/anti-debug pack is used. |
| yara_packC | Alias for yara_scan with the bundled packer profiles. |
| evidence_listB | List journaled tool calls (newest first) with ids and digests. |
| evidence_readC | Read one full evidence record by id. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 35 tools
Each tool targets a distinct analysis action or resource, from static metadata (bin_info) to dynamic debugging (debug_*), decompilation (ghidra_*), and evidence journaling (evidence_*). Overlaps like yara_scan vs yara_pack are explicitly aliases, and the dump variants are scoped by context (run_and_dump, dump_process, debug_dump).
All names use snake_case, but the patterns vary: verb_noun (rebuild_pe), noun_noun (strings_scan), single words (disasm), and prefixed groups (debug_*, ghidra_*, dotnet_*). The grouping is consistent within subsystems, making the set readable despite not following one uniform convention.
With 35 tools, the set far exceeds the typical 3–15 range and crosses into heavy territory. While many tools have distinct purposes, several could be consolidated (e.g., debug operations into an action parameter, Ghidra operations into fewer endpoints), making the surface overwhelming.
The server covers a broad reverse-engineering lifecycle: static analysis, PE manipulation, dynamic debugging, decompilation, .NET, YARA, and evidence tracking. Minor gaps exist, such as no debug_attach for existing processes or a dedicated import table viewer, but agents can work around them with available tools.