ghidra-fleet
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GHIDRA_FLEET_LOG | No | Log level | INFO |
| GHIDRA_FLEET_XMX | No | JVM heap limit; set to an empty string to use Ghidra's default | 4G |
| GHIDRA_INSTALL_DIR | Yes | Ghidra installation directory (required) | |
| GHIDRA_FLEET_MAX_OPEN | No | Number of programs kept open simultaneously (LRU eviction) | 6 |
| GHIDRA_FLEET_MAX_WORKERS | No | Number of parallel analysis threads; set to 1 if you encounter analyzer concurrency issues | min(4, CPU) |
| GHIDRA_FLEET_PROJECT_DIR | No | Ghidra project directory | ~/.ghidra_fleet/projects |
| GHIDRA_FLEET_PROJECT_NAME | No | Project name | fleet |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": true
} |
| resources | {
"subscribe": false,
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| analyze_binariesA | 批量导入并分析二进制文件（后台并行执行，立即返回 job_id）。 paths: 单个路径或路径列表；目录会展开为其中的文件（recursive=true 时递归展开）。 已分析过（相同 sha256）的文件会自动跳过并标记 cached。 返回后用 analysis_status(job_id) 轮询进度；已完成的二进制可以立刻查询。 |
| analysis_statusA | 查询分析作业进度。不传 job_id 时返回最近的所有作业。 |
| list_binariesA | 列出项目中所有已分析的二进制及其元数据（program_name、架构、大小、sha256、状态）。 |
| find_in_all_binariesB | 跨所有已分析的二进制搜索（旧的单文件 MCP 做不到的核心能力）。 kind: "string" 或 "function"。query 为子串（不区分大小写）。 典型用途：在一批样本中找共同的函数名/字符串特征。最多扫描最近分析的 200 个二进制。 |
| list_functionsB | 列出二进制中的所有函数（分页）。filter 为函数名子串过滤（不区分大小写）。 |
| list_methodsD | list_functions 的别名（兼容旧工具名习惯）。 |
| search_functions_by_nameC | 按名称子串搜索函数（不区分大小写）。 |
| function_infoB | 查看函数详情：签名、入口地址、参数、返回类型、大小、调用约定。function 接受函数名或入口地址。 |
| decompile_functionB | 反编译函数为 C 伪代码。function 接受函数名（支持唯一子串）或入口地址。 |
| disassemble_functionC | 反汇编函数（汇编指令列表）。function 接受函数名或入口地址。 |
| get_xrefs_toC | 查看引用到指定地址的所有交叉引用（谁引用了它）。 |
| get_xrefs_fromC | 查看指定地址向外的所有引用（它引用了谁）。 |
| get_function_xrefsC | 查看函数的调用者（谁调用了这个函数）。 |
| list_importsC | 列出导入符号（库!名称）。 |
| list_exportsC | 列出导出符号。 |
| list_segmentsB | 列出内存段（名称、范围、读写执行权限、大小）。 |
| list_stringsC | 列出程序中的字符串（分页，filter 子串过滤）。 |
| rename_functionB | 重命名函数（立即保存到项目，GUI 打开同一项目可见）。 |
| rename_dataC | 在指定地址设置/重命名数据标签。 |
| rename_variableC | 重命名函数内的局部变量/参数。 |
| set_function_prototypeC | 设置函数原型/签名，例如 'int func(char *buf, int len)'。 |
| set_local_variable_typeC | 设置函数局部变量/参数的类型，例如 'char *'、'unsigned int'、'struct MY_STRUCT *'。 |
| set_commentC | 在指定地址设置注释。kind: plate/pre/eol/post/repeatable（默认 eol）。 |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 23 tools
Several tools overlap: list_methods is an explicit alias of list_functions, search_functions_by_name overlaps with filtered list_functions, and get_function_xrefs overlaps with get_xrefs_to on function entries. find_in_all_binaries is also adjacent to single-binary search tools. Descriptions help clarify intent, but an agent may still hesitate between similar query paths.
Most names follow a consistent snake_case verb_noun style such as analyze_binaries, list_functions, decompile_function, and rename_variable. Minor deviations like analysis_status and function_info are noun-first, and list_methods introduces an alternate noun for the same concept, but the overall convention is predictable.
At 23 tools, the surface is at the heavy end for a single MCP server, though the Ghidra reverse-engineering domain is broad. The explicit list_methods alias adds redundancy, and some list/search/xref tools could potentially be consolidated. It is usable but borderline heavy.
The surface covers batch analysis, status polling, binary listing, cross-binary search, function listing/search, decompilation, disassembly, xrefs, imports/exports, segments, strings, and several mutation operations. Minor gaps remain around deletion/project lifecycle and listing variables or data beyond rename operations, but core workflows are well covered.