Skip to main content
Glama

borer is a reverse-engineering engine built for AI agents. It gives an agent what a human reverse engineer brings to a binary: it finds the code that matters, reads it as C, follows data through it and writes down what it learned. It is one Rust binary: an MCP server when run with no arguments, a command-line tool with them. There is no GUI, and no Ghidra, IDA or Binary Ninja underneath.

WARNING

borer is an early-stage project. Expect bugs and rough edges, and expect tool names, output and resource URIs to change between releases. SeeLimits, and please report anything that looks wrong.

Why borer exists

Most software that matters ships as binaries nobody can read: malware, closed firmware, game clients, drivers, the third-party libraries inside every product. Reading them takes reverse engineers, and there are far too few of them for the volume of code that needs reading. A malware analyst triages a handful of samples a day while millions arrive. A vulnerability researcher audits one component while the attack surface around it keeps growing.

Agents can read code all day without tiring. What they lack is a tool made for them. The existing disassemblers were built for a person at a screen: interactive GUIs, state hidden in a project database, output sized for eyes rather than a context window, and answers an agent has no way to check.

borer is that tool, designed from the start for a reader that is a program:

  • Answers an agent can trust. Every block of decompiled C is run in an emulator from seeded states and compared with the machine code it came from, and the output says how much was checked. Instructions it cannot model stay as /* asm: ... */ instead of a guess. An agent that knows which lines are proven can build on them.

  • Built for a context window. Every list is filtered and paged on the server and says # showing N of M. A repeated request with since=<tag> returns only what changed. The same question gives the same bytes every time.

  • Fast enough to read everything. A whole binary loads and decompiles in seconds, so an agent can sweep every function instead of guessing where to look.

  • Safe on hostile input. No clock, no random seed, bounds-checked reads, capped scans and fuel-limited walks: a malformed or malicious file gets an error, never a crash. The binary is never modified, and annotations are dry-run by default.

  • Its own engine. The analysis, lifters, emulator, structurer and decompiler are written from scratch in Rust for this purpose, so every layer can be shaped around what an agent needs. Only instruction decoding and file parsing come from standard crates.

Related MCP server: kuna_mcp

What it is for

  • Malware analysis. Triage a sample in one call (what it is, how it is packed or protected, where to start), then unpack it, decode its strings, pull out its indicators, and write a YARA rule that finds its family again.

  • Vulnerability research. Follow attacker-controlled data from an input to where it is used with taint analysis, find the checks between them, solve for inputs that reach a path, and diff a patched binary against the old one to see what was fixed.

  • Auditing what you ship. Read the closed-source libraries, drivers and firmware inside a product the same way you would read your own code.

  • Understanding software. Recover class layouts, protocols and message formats, and read a running process's objects by their recovered layout.

Formats: PE, ELF, Mach-O, raw code and memory dumps. Architectures: x86, x86-64 and arm64 for disassembly, decompilation and emulation. 32-bit ARM (A32 and Thumb-2) for disassembly and decompilation.

Where it is going

The aim is an agent that takes a binary and returns what a skilled reverse engineer would: what it does, what is dangerous in it, and the evidence for each claim.

borer is built to push every measure as far as it will go: faster analysis, less memory, more of the binary understood, more of the output proven, and decompiled code closer to the source. When it reaches a limit, the next step is to move that limit. Each step below moves borer toward that aim:

  1. Decompiled C indistinguishable from source. Natural loops and conditions instead of gotos, recovered types and structures, and text that compiles back to the same machine code, with the emulator check kept on every line.

  2. Whole-program reasoning. Data flow, taint and value ranges across every function and every call, so an agent asks "can this input reach that copy unchecked?" and gets an answer with the path that proves it.

  3. Findings. Built-in detectors for memory-safety bugs, unsafe API use, hard-coded secrets and known malware behaviors, each one reported with its path and a proof or a reproducing input.

  4. Scale. Fleets of agents on huge codebases and sample feeds: shared analysis caches, incremental re-analysis when a binary changes, and results that diff cleanly between versions.

  5. Every platform. Wider architecture coverage (32-bit ARM emulation, MIPS, RISC-V), managed code (.NET, Java) and firmware images.

  6. Runtime alongside static. Debugging, tracing and live memory on every operating system, so a static claim can be confirmed against the running program.

Install

One command downloads the latest release for your machine, checks it against the release's SHA256SUMS, and registers borer with every MCP client it finds.

macOS and Linux:

curl -fsSL https://borer.lol/install | sh

Windows (PowerShell):

irm https://borer.lol/install.ps1 | iex

setup finds Claude Code, Claude Desktop, Cursor, Windsurf, Devin Desktop, VS Code, VS Code Insiders, Gemini CLI, Antigravity, Codex CLI, Zed, OpenCode, pi, Copilot CLI, Grok Build, Cline, Roo Code, Kilo Code, Continue, Amp, Qwen Code, Kiro, Factory Droid, Kimi Code, Junie, Augment, Warp and LM Studio. It backs up each file it edits to <file>.bak, replaces an entry whose program no longer exists (--replace replaces any other), and ends by naming the clients to restart, since none reads its configuration again while it runs. Quit Claude Desktop from the tray, turn borer on in Cursor under Settings > MCP, and run /reload in pi. For Codex it also sets tool_timeout_sec = 600, and for pi "timeout": 600, since the first analysis of a large binary can take longer than their default minute. pi also gets "exposure": "direct", so borer's tools are offered like built-in ones rather than only to codemode.

As a Claude Code plugin, which fetches the binary of the plugin's version when a session starts and replaces it when the plugin updates:

/plugin marketplace add imjustprism/borer
/plugin install borer@borer

Or by hand: download an archive from the latest release (Windows x64, Linux x64, macOS), move borer where it will stay (setup registers the path it runs from), then:

./borer setup           # show what would change
./borer setup --apply   # register borer with every client found

From source, with the toolchain that rust-toolchain.toml pins:

git clone https://github.com/imjustprism/borer
cd borer
cargo build --release
target/release/borer setup --apply

To register it by hand, use an absolute path. Claude Desktop, Cursor, Windsurf, Gemini CLI, Antigravity, Qwen Code, Kimi Code, Junie, Augment, Warp, LM Studio and Factory Droid read mcpServers. Continue reads it too, from a file of its own (~/.continue/mcpServers/borer.json), and Amp reads it under amp.mcpServers:

{ "mcpServers": { "borer": { "command": "/path/to/borer", "args": [] } } }

VS Code (mcp.json in the user folder) reads servers:

{ "servers": { "borer": { "type": "stdio", "command": "/path/to/borer", "args": [] } } }

Zed (settings.json) reads context_servers:

{ "context_servers": { "borer": { "command": "/path/to/borer", "args": [] } } }

OpenCode (~/.config/opencode/opencode.json) and Kilo Code (~/.config/kilo/kilo.json) read mcp, with the command as an array:

{ "mcp": { "borer": { "type": "local", "command": ["/path/to/borer"], "enabled": true } } }

pi (~/.pi/agent/mcp.json, or pi mcp add borer -- /path/to/borer) reads mcpServers:

{ "mcpServers": { "borer": { "command": "/path/to/borer", "args": [], "timeout": 600, "exposure": "direct" } } }

Copilot CLI (~/.copilot/mcp-config.json) wants a local server and its tools named:

{ "mcpServers": { "borer": { "type": "local", "command": "/path/to/borer", "args": [], "tools": ["*"] } } }

Cline (~/.cline/data/settings/cline_mcp_settings.json), Roo Code and Kiro read mcpServers with a timeout (in seconds, or milliseconds for Kiro), which setup raises for a first analysis.

Codex CLI (~/.codex/config.toml) and Grok Build (~/.grok/config.toml, which takes the same table without the timeouts):

[mcp_servers.borer]
command = "/path/to/borer"
args = []
startup_timeout_sec = 30
tool_timeout_sec = 600

To uninstall, borer setup --apply --remove takes borer out of every client (borer setup --remove shows what it would change). Then delete the binary and its cache (%LOCALAPPDATA%\borer, or ~/.cache/borer). The installers do all three:

curl -fsSL https://borer.lol/install | sh -s -- --uninstall
& ([scriptblock]::Create((irm https://borer.lol/install.ps1))) -Uninstall

Use it from an agent

A typical session:

  1. load_binary

  2. borer://triage (what the file is, how it is protected, where to start)

  3. find_function_by_string, strings or symbols

  4. function_summary, then decompile

  5. xrefs, cfg or callgraph to go wider

Any address argument takes 0x hex, decimal, or a name.

Area

Tools

Load

load_binary, binary_info, fetch_pdb, reload

Find

functions, function, symbols, strings, search, find_function_by_string, find_crypto_constants, entropy

Read code

function_summary, function_strings, decompile, decompile_batch, disassemble, disassemble_function, cfg, callgraph, reaches, xrefs, class_layout

Read data

read, hexdump

Annotate

set_name, set_comment, set_type, types, annotations, save_project, load_project

Live process (Windows only)

live_attach, live_detach, live_modules, live_read, live_object, live_instances, live_watch

Anything else

query, script

Deeper analyses are borer:// resources: taint, struct layout, emulation, input solving, unpacking, flattening, VM dispatch, devirtualization, binary diff, stack strings, decoded and encoded strings, IOCs, byte signatures and YARA rules. borer://help lists all of them. A client without resource support passes the same URI to query.

Use it from the command line

borer triage    sample.exe
borer functions sample.exe
borer decompile sample.exe <address|name>
borer xrefs     sample.exe <address|name>
borer verify    sample.exe    # lifter vs emulator, fails on any disagreement
borer help                    # every command

Useful flags: --pack <file> loads target knowledge, --no-pdb skips the companion PDB, and --arch x86|x64|arm64 (with --base, --entry and --regions) maps raw code or a dump.

More

  • Live processes (Windows only): live_attach opens a running process read-only (PROCESS_VM_READ) and maps the loaded binary onto it. The live tools then read objects by their recovered class layout and watch fields change. Some anti-cheat software flags any foreign handle, read-only or not.

  • Packs: target knowledge (one engine's class names, message ports) lives in local .borer files, never in engine code. None ship with borer. borer sigmake builds a signature pack from static libraries you already have (COFF .lib, ELF .a, Rust .rlib).

  • Other tools: borer sig writes the shortest byte signature that finds a function again (moving bytes wildcarded), borer yara a YARA rule from functions' signatures and strings, and borer names <bin> ida|ghidra|binja|x64dbg borer's names and comments as a script or database those tools apply. borer info gives the MD5, SHA-256, imphash and TLSH, and what any data appended past the last section is. borer addr converts between virtual address, relative address and file offset.

  • Scripting: sandboxed Rhai scripts (no files, no network, an operation budget) through the script tool or borer script.

  • Sizes: every answer is capped at 72,000 bytes, cut at a line with a note on how to page the rest (BORER_BUDGET sets the cap in bytes, 0 lifts it). A file is read into memory whole, so one past 1 GiB is refused with a message (BORER_MAX_FILE, in bytes or with K, M or G, and 0 lifts it). A client that sends a progress token gets a progress notification every few seconds while a first analysis runs.

Network access

borer sends nothing about what you analyze, and has no telemetry or crash reporting. Three things reach the network:

  • The update check. A command line run at a terminal checks once a day whether a newer release is out: a request to https://github.com/imjustprism/borer/releases/latest with the user agent borer/<version>, so GitHub sees your IP address, the version and the time. It never runs for the MCP server, under CI, or with stderr redirected, and BORER_NO_UPDATE_CHECK=1 turns it off.

  • fetch_pdb, only when asked and dry-run by default, sends the PDB's name, GUID and age to the symbol server (Microsoft's unless configured). borer doctor checks that server is reachable unless run as borer doctor offline.

  • borer update and the installers download the release from GitHub.

Limits

  • No instruction sets beyond x86, x86-64, arm64 and 32-bit ARM.

  • 32-bit ARM code is not emulated, so the emulator-backed analyses refuse it.

  • On arm64, taint, layout, solve, unpack and devirt refuse to run.

  • Shapes the structurer cannot prove stay as labels and gotos. SIMD code prints as intrinsics (paddd, __add_4s), not as C.

  • No debugger: no breakpoints and no writes. Live access is Windows only.

  • .NET IL and Swift are not decompiled (.NET metadata is read).

  • DWARF supplies names and types, not line tables.

  • Embedded containers are listed (borer://children), not extracted.

  • Library signatures ship for three runtimes only (LLVM compiler-rt, the Microsoft C++ standard library, the Rust standard library). Any other library needs a pack built with borer sigmake.

Workspace

Crate

Role

borer-engine

The analysis core: loading, lifting, emulation, decompilation. Pure and synchronous: no I/O, no async.

borer

The MCP server and CLI, thin adapters over the engine.

borer-live

Read-only access to a running process.

borer-fixtures

Programs the tests decompile and check against their source.

Contributing

python scripts/gate.py runs what CI runs: fmt, clippy with -D warnings, tests, rustdoc, cargo deny, typos, ruff and a smoke test of the real server. The rules for people and coding agents alike are in borer.rules. Commit titles look like type: summary.

By opening a pull request you agree that your contribution is licensed under the project's license and that the maintainer may relicense it, including under commercial terms. The details are in CONTRIBUTING.md.

License

borer is free software under the GNU Affero General Public License v3.0 (AGPL-3.0-only). Use it for anything, change it and share it. If you distribute borer or a modified version, or run one as a network service, you must publish its complete source under the same license. Versions 0.1.0 and 0.1.1 were released under MIT. A commercial license, for uses the AGPL does not fit, is available: open an issue or reach out on GitHub.

Third-party notices (pefile ordinal tables, the TLSH reference implementation, the library signature sets and the SDK type data, with their provenance) are in NOTICE. Each release archive also carries THIRD-PARTY-LICENSES, the licenses of every crate and runtime the binary links.

Ghidra is a project of the NSA. IDA and Hex-Rays are trademarks of Hex-Rays SA, Binary Ninja is a trademark of Vector 35, and Claude is a trademark of Anthropic. Other names are their owners' trademarks. borer is not affiliated with or endorsed by any of them.

Available Tools

34 tools
annotationsA
Read-only

List the names, findings and open questions (comments opening with ?) added this session, paged. Use it to resume work; not for binary symbols (use symbols) or user types (use types).

NameRequiredDescriptionDefault
limitNoMax rows (default 200, max 1000).
filterNoCase-insensitive substring of a row (address, kind or text).
offsetNoRows to skip first (paging).
count_onlyNoHeader only (default false).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish that this is a read-only, closed-world operation, and the description does not contradict that. The description adds useful behavioral context beyond annotations: results are session-scoped ('added this session'), paged, and focused on comments opening with '?'. It does not describe ordering or default paging behavior, but the core behavior is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The two-sentence description is front-loaded with the core purpose and immediately follows with usage guidance and exclusions. Every clause carries useful information without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only listing tool with fully documented parameters, the description covers purpose, session scope, paging, and alternatives adequately. It could be slightly richer about return contents or ordering, but no critical information is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are already documented in the schema. The description mentions paging but adds no syntax or default details beyond what the schema provides, making baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (List) and concrete resources (names, findings, and open-question comments added this session), plus paging behavior. It also distinguishes the tool from sibling tools `symbols` and `types`, so an agent can identify it without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states the intended use case ('Use it to resume work') and names the alternatives for out-of-scope cases ('not for binary symbols (use symbols) or user types (use types)'). This is clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

binary_infoA
Read-only

Summarize the loaded program: format, arch, entry, sections with entropy, imports, exports. load_binary already returns it; for protection and where to start, query borer://triage. Fails if nothing is loaded.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the description's added value is the precondition/error behavior ("Fails if nothing is loaded") — a concrete failure mode the agent must sequence around. It adds real context beyond the annotations, though it says nothing about output size or cost of the entropy computation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the return contents are front-loaded, followed by workflow guidance and the failure condition. Every clause carries information; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters, no output schema, and annotations already covering the safety profile, the description's enumeration of returned fields plus the load precondition and the triage hand-off make the tool callable without further inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so there is nothing to disambiguate and the baseline of 4 applies. The description correctly implies no input is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("Summarize") and resource ("the loaded program") and enumerates exactly what is returned: format, arch, entry, sections with entropy, imports, exports. An agent can distinguish this from siblings like entropy, symbols, or strings without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent elsewhere for adjacent needs ("for protection and where to start, query borer://triage") and names the prerequisite producer (load_binary). The "load_binary already returns it" clause is slightly ambiguous about whether this tool is redundant after a load, which keeps it from a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

callgraphA
Read-only

Draw a function's call graph as mermaid: callees, or callers with callers=true; imports are leaves and a %% line counts nodes cut by max_nodes. Not for one path (use reaches) or a caller list (use xrefs).

NameRequiredDescriptionDefault
addressYesRoot function entry address.
callersNoWhat reaches it instead of what it calls.
max_nodesNoMaximum graph nodes (default 30, max 100).

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds genuinely new behavioral detail: mermaid output, imports appear as leaf nodes, and a %% comment line reports nodes dropped by max_nodes — telling the agent how truncation is surfaced rather than silent. It stops short of describing overall response shape or pagination, keeping it at 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence plus one exclusion clause; the primary behavior and output format are front-loaded and every clause carries information (direction, leaf handling, truncation marker, alternatives).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description takes on the burden of describing the return value and does so (mermaid text, imports as leaves, %% truncation line). Combined with annotations covering read-only status, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description still adds value by explaining the semantic consequence of callers=true (inverted traversal) and, importantly, that exceeding max_nodes produces a %% line counting the cut nodes rather than an error. That truncation contract is not in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb (draw), resource (a function's call graph), and output format (mermaid), plus the direction switch via callers=true. It explicitly names the sibling tools it is not (reaches, xrefs), so an agent can distinguish it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit exclusions with alternatives: 'Not for one path (use reaches) or a caller list (use xrefs).' This is the when-not/use-instead guidance pattern, requiring no inference from the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cfgA
Read-only

Draw a function's control-flow graph as mermaid: blocks and successor edges, 300 blocks a page, a %% line when cut. Not for reading logic (use decompile) or a block table (use function).

NameRequiredDescriptionDefault
offsetNoBlocks to skip, 300 a page.
addressYesFunction entry or any address inside it.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds meaningful output behavior beyond annotations: mermaid text with blocks and successor edges, pagination at 300 blocks per page, and a '%% line when cut' truncation marker. It does not describe every edge case, but it substantially enriches the behavioral picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly packed sentences with zero waste. The core action and output format are front-loaded, followed by pagination/truncation details and then explicit tool alternatives. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only CFG visualization tool, the description covers purpose, output format, pagination behavior, truncation signaling, and when to use alternatives. Although there is no output schema, the mermaid return format is described sufficiently for correct invocation. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented: 'offset' is blocks to skip at 300 per page, and 'address' is a function entry or any address inside it. The description repeats the '300 blocks a page' pagination but adds no new parameter semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Draw a function's control-flow graph as mermaid'. It also explicitly distinguishes itself from two sibling tools by naming what it is not for and pointing to 'decompile' and 'function'. An agent can identify the right tool without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit exclusions and alternatives: 'Not for reading logic (use decompile) or a block table (use function).' This directly says when to use this tool versus others, leaving little inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

class_layoutA
Idempotent

Infer a C++ class's fields, methods and vftable from how its methods use the object: offset, width, reads, writes. Use it on an unknown class; for a known layout use set_type. apply=Name saves it as a struct (dry run until dry_run=false).

NameRequiredDescriptionDefault
applyNoStruct name to define the layout as.
classYesClass name or a method address.
dry_runNoPreview only; false applies.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations establish it is a non-read-only, non-destructive, idempotent operation; the description adds the key behavioral detail that apply=Name materializes a struct and that it is only a dry run until dry_run=false, which is not derivable from annotations. It stops short of covering what happens if the struct name already exists or what the inference output looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences, front-loaded with the core inference capability, then the sibling exclusion, then the write gating. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, but the description enumerates what is inferred (offset, width, reads, writes) so the agent knows what comes back. Missing only edge-case behavior for re-applying over an existing struct definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description still adds value by tying apply and dry_run together into a single save-vs-preview rule, clarifying behavior the schema's terse 'false applies' phrasing leaves ambiguous. The 'class' parameter accepting a method address is covered by the schema, not the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (infer) and precise resource (a C++ class's fields, methods, vftable) plus the evidence basis (offset, width, reads, writes). It also names the sibling it is not (set_type) so the agent can distinguish it without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly scopes use to unknown classes and routes the known-layout case to set_type. The alternative and the selecting condition are both stated outright.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decompileA
Read-only

Decompile one function to pseudo-C. Locals are local_N/arg_N (N hex bytes below the entry sp: higher N, lower address); /* asm */ marks unmodeled code. Line 2 says what was checked, // warn: what is wrong. Not for a first look (use function_summary).

NameRequiredDescriptionDefault
limitNoReturn at most this many lines (default 300; more than the text has for all).
detailNo`skeleton` for flow and calls only; `full` or absent for all of it.
filterNoKeep only lines containing this text, case-insensitively.
offsetNoSkip this many lines of the answer.
addressYesFunction entry or any address inside it.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint and openWorldHint already covering the safety profile, the description instead spends its words on non-obvious output semantics: local_N/arg_N naming with hex byte offsets, /* asm */ for unmodeled code, line 2 as a check summary, and // warn: for problems. It does not mention failure modes (e.g., functions that cannot be decompiled) or output size expectations, which keeps it just short of the top score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, front-loaded with what the tool does, then the decoding conventions an agent needs to read the output. Nothing is redundant with the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the burden of explaining the returned text, and it largely does via the naming scheme and marker conventions. What's missing is only edge-case behavior, such as what a failed or partial decompilation looks like, which is a minor gap for a read-only single-function tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all five parameters (address, limit, detail, filter, offset) are already documented in the schema, so the baseline of 3 applies. The description adds no parameter-level guidance such as when to prefer skeleton over full or how filter interacts with limit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Decompile one function to pseudo-C") with an explicit unit-of-work (one function). The closing clause distinguishing it from function_summary lets an agent separate it from the summary sibling without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit exclusion and a named alternative: "Not for a first look (use function_summary)." The positive trigger is only implied by "one function," and alternatives like disassemble_function or decompile_batch for multiple functions are not mentioned, so routing is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decompile_batchA
Destructive

Decompile many functions matching a name filter, in parallel, 6000 chars each and 40000 in all; out=<file.c> writes all uncapped to a file under the output root, kept unless overwrite=true. For one use decompile.

NameRequiredDescriptionDefault
outNoA `.c` file under the output root to write every function to; not with `filter` or `max_functions`.
filterNoCase-insensitive filter on function name or entry hex.
libraryNoWith out: also write library functions (default false).
overwriteNoWith out: replace an existing file (default false).
max_functionsNoMaximum functions to decompile (default 10, max 50).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructive=true, readOnly=false, idempotent=false, and closed-world behavior, so the bar for extra disclosure is lower. The description still adds useful operational context: parallel execution, per-function and total character caps, and file persistence semantics ('kept unless overwrite=true'). It does not add auth or rate-limit details, but those are less central here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the verb and resource, and every clause carries operational detail. The semicolon-heavy first sentence is dense but not wasteful, and the single-function alternative is placed clearly at the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter tool with full schema coverage and annotations, the description covers the important behavioral complexities: parallel batch decompilation, character caps, file output, overwrite semantics, and the single-function alternative. Remaining details such as exact return formatting are minor and partly handled by the schema and annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all five parameters. The description adds meaning beyond the schema by clarifying output capping and that out writes uncapped results to a file; this is useful for understanding the out/filter/max_functions interaction even if it does not restate every parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Decompile many functions') and explicitly names the single-function sibling ('For one use decompile'), making the distinction from decompile clear. It also adds the name-filter matching condition, so the tool's purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives the key alternative for a single function and explains the out=<file.c> mode for uncapped bulk output versus the capped default behavior. It stops short of stating explicit exclusions such as out not combining with filter or max_functions, leaving those constraints to the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

disassembleA
Read-only

Disassemble count instructions from any address as va text rows. Use it for a few instructions or code outside functions; for a whole function use disassemble_function. Fails if unmapped.

NameRequiredDescriptionDefault
bytesNoAdd the raw-bytes column (default false).
countNoMax instructions (default 32, max 256).
addressYesAddress or a function/symbol name.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered; the description adds a meaningful failure mode ('fails if unmapped') and the result format, which go beyond the annotations. It stops short of stating pagination/truncation behavior beyond what the schema's count max implies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, zero waste, with purpose and output format front-loaded before the usage routing and failure note.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only 3-parameter tool with no output schema, the description covers what it returns (VA/text rows), when to use it, and the unmapped-address failure. Only minor gaps like output volume/limits remain, and those are partly handled by the schema's max.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented in the schema. The description only implies that count controls instruction count and that address accepts VA or symbol; it adds little syntax beyond the structured fields, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (disassemble) with a scoped resource (count instructions from any address) and names the output shape (`va text` rows). It explicitly contrasts with the sibling disassemble_function, so an agent can pick between them without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-to-use (a few instructions, or code outside functions) and an explicit alternative for the other case (whole function → disassemble_function). No inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

disassemble_functionA
Read-only

Disassemble a whole function by blocks, with L_<addr>: labels and named call targets. Use it when exact instructions matter; for C use decompile, for a few instructions disassemble.

NameRequiredDescriptionDefault
bytesNoAdd the raw-bytes column (default false).
addressYesEntry, any address inside it, or a name.
max_instrsNoMaximum instructions to return (default 400, max 2000).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds genuinely useful behavior beyond that: output is organized into blocks with address labels and resolved call target names, which is the key expectation for callers. It omits truncation behavior, though the max_instrs cap is documented in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the verb and output shape, then the routing rule. Nothing redundant and nothing padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only three-parameter tool with full schema coverage and no output schema, the description covers what the tool does, how output is shaped, and when to prefer siblings. It could note the instruction cap consequence (truncated results for large functions), but that is already in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and all three parameters (bytes, address, max_instrs) carry their own defaults and limits in the schema. The description adds no parameter-level meaning beyond noting whole-function scope, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (disassemble) plus resource and scope (a whole function by blocks) and even characterizes the output format via `L_<addr>:` labels and named call targets. That distinguishes it from the sibling `disassemble` (few instructions) and `decompile` (C output).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names both alternatives and the conditions that select them: exact instructions → this tool, C code → decompile, a few instructions → disassemble. The agent has no inference left to make about tool choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

entropyA
Read-only

Find packed, compressed or encrypted data: chunks at or above threshold bits/byte, as off va len entropy rows, at most 200, paged. To name the packer query borer://protection instead.

NameRequiredDescriptionDefault
limitNoMost regions listed (default 200, max 200).
offsetNoRegions to skip first (paging).
windowNoWindow size in bytes (default 1024, minimum 64).
thresholdNoMinimum bits per byte to report (default 7.2, max 8.0).

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is known; the description adds genuinely new behavior: results are capped at 200 rows and paged, and each row has a fixed column layout. It stops short of explaining how the window setting affects detection sensitivity or what an empty result implies, which is a minor gap against an otherwise solid disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences: the detection criterion and result format come first, the disambiguation and cap follow. There is no filler, and the output row layout is conveyed compactly rather than as prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of describing return values, and it does so at least partially via the `off va len entropy` row format plus the 200-row paging note. What's missing is guidance on tuning window versus threshold, which matters for a heuristic scanner whose results depend heavily on those two defaults.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so limit, offset, window, and threshold are all documented in the schema, which sets the baseline at 3. The description reinforces the threshold concept ('at or above threshold bits/byte') and the 200 cap but adds no syntax or tradeoff guidance beyond that, so it does not earn above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Find') and a precise object ('packed, compressed or encrypted data'), then defines the detection criterion (chunks at or above threshold bits/byte) and the output shape (`off va len entropy` rows). It also distinguishes itself from the naming step by pointing at borer://protection, so an agent can tell exactly what this tool answers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the triggering condition (looking for packed/compressed/encrypted regions) and redirects the packer-identification sub-task to borer://protection. It does not, however, contrast with adjacent detection tools such as find_crypto_constants or strings, so routing among the analysis siblings is only partly resolved.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_pdbA
Idempotent

Download the loaded PE's missing PDB over https into the cache, kept only if its GUID and age match. Use it when load_binary reports no PDB; dry run until dry_run=false, then load_binary again.

NameRequiredDescriptionDefault
dry_runNoPreview only (default true); false fetches from `BORER_SYMBOL_SERVER` or Microsoft's.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare openWorldHint=true, idempotent=true, destructive=false, so the network-write profile is partly covered. The description adds real value on top: the source servers (BORER_SYMBOL_SERVER or Microsoft's), the https transport, the GUID/age validation gate, and the dry-run default. It does not cover failure modes (GUID mismatch, download errors) or cache location, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. The core action and cache rule come first, the when-to-use and workflow follow, and the dry-run constraint is placed where an agent needs it before invoking.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, no-output-schema tool with helpful annotations, this covers what it does, when to call it, and what to do afterward. Minor gaps remain around what happens on GUID mismatch or download failure, but nothing essential to a correct call is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage on the single parameter, the schema already explains dry_run's default and effect. The description only reinforces the default with 'dry run until dry_run=false', which is procedural rather than new semantic detail, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: downloads the missing PDB for the loaded PE, over https, into the cache. It also states the retention rule (kept only if GUID and age match), which separates it clearly from siblings like load_binary and symbols.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit trigger: 'Use it when load_binary reports no PDB'. Explicit sequence: dry run first, set dry_run=false, then re-run load_binary. Both the when and the surrounding workflow are named with a sibling tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_crypto_constantsA
Read-only

Find crypto constants and tables (AES, SHA, MD5, CRC-32, ChaCha, Blowfish, FNV, Base64) and hashed API names as va section algorithm rows, paged. Use it to locate crypto code, then xrefs a hit; not for strings (use strings).

NameRequiredDescriptionDefault
limitNoMax rows (default 200, max 500).
offsetNoRows to skip (paging).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this as a read-only, closed-world search. The description adds useful behavioral context beyond the annotations: it describes the output row shape (`va section algorithm`) and that results are paged. It does not cover rate limits or empty-result behavior, but for a read-only search tool this is largely sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two dense, front-loaded sentences with no filler. The core purpose and output format come first, and the usage workflow and alternative follow immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read-only search tool with no output schema, the description supplies the missing output shape (`va section algorithm`), paging behavior, and a follow-up workflow (xrefs a hit). An agent has enough information to select and call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so `limit` and `offset` are already fully documented in the schema. The description adds only that results are 'paged', which is marginal additional meaning beyond the schema's own parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: find crypto constants and tables. It lists concrete algorithm examples and describes the row format (`va section algorithm`), making the tool's scope and output shape clear. It also distinguishes itself from `strings` by explicitly excluding string searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use it to locate crypto code and then xrefs a hit, and warns not to use it for strings (use `strings` instead). This gives clear when-to-use guidance and names an alternative tool for a likely confusion case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_function_by_stringA
Read-only

Find the functions whose strings contain a text, case-insensitively: a numbered string legend, then entry name: 1 2 rows, paged. Not for one function's strings (use function_strings).

NameRequiredDescriptionDefault
limitNoMax rows and legend strings (default 50, max 300).
filterYesCase-insensitive substring of the referenced string.
offsetNoFunction rows to skip first (paging).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare `readOnlyHint: true` and `openWorldHint: false`, so the safety profile is covered. The description adds useful behavioral context: case-insensitive matching, paged output, and the shape of the returned string legend and function rows.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence plus one routing sentence, with the core action front-loaded. Every clause contributes either purpose, output shape, or disambiguation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description explains the return format and paging behavior. Combined with full parameter schema coverage and annotations covering read-only status, this is sufficient for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented in the schema. The description's mentions of case-insensitivity and paging are mildly reinforcing but largely redundant with the schema's own parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: find functions whose strings contain a text, case-insensitively. It also distinguishes the tool from sibling `function_strings` and gives a compact indication of its output shape.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says what the tool is not for — one function's strings — and names the correct alternative, `function_strings`. This directly resolves the most likely sibling ambiguity an agent would face.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

functionA
Read-only

Show one function's raw facts: range, counts, callers, callees and block table (start size term successors), 300 blocks a page. Not for a readable triage (use function_summary).

NameRequiredDescriptionDefault
offsetNoBlocks to skip first (300 a page).
addressYesEntry, any address inside it, or a name.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=false), and the description adds the block-table column format (`start size term successors`) and the 300-blocks-per-page pagination behavior, which are genuine behavioral details not in the annotations. It stops short of saying what happens at the end of a function with more than one page or how the paging interacts with callers/callees.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both earning their place: the first defines content and pagination, the second routes to the alternative. Front-loaded with the resource and the notable format detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must carry the return shape — it does so by enumerating the fact categories and the block-table columns, plus pagination. Minor gaps remain (total block count, behavior when a name resolves to multiple functions), but nothing essential to a correct call is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented — including the flexible "entry, any address inside it, or a name" semantics for address and the skip-count for offset. The description only restates the 300-per-page figure already present in the offset description, adding no new param-level meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ("Show") plus resource ("one function") and an explicit inventory of the returned facts — range, counts, callers, callees, block table. It also names the sibling it is not, so an agent can distinguish it from function_summary without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the negative condition ("Not for a readable triage") and names the alternative tool that should be used instead (function_summary). The positive case is implied by "raw facts", and the routing rule is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

functionsA
Read-only

List discovered functions as entry size blocks instrs callers callees src name rows, paged; filter on name or entry hex, sort=size for the largest. Not for imports (use symbols).

NameRequiredDescriptionDefault
sortNo`address` (default) or `size` for the largest first.
limitNoMax rows (default 50, max 300).
filterNoCase-insensitive filter on name or entry hex; `thunk` or `funclet` lists what is otherwise left out.
offsetNoMatches to skip (paging).
count_onlyNoHeader only (default false).

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish that this is a read-only, closed-world operation. The description adds useful behavior beyond that by stating the tool is paged and by documenting the exact returned row columns, which helps the agent understand the response shape without an output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the most important information: what is listed, the row shape, paging, filtering, sorting, and the sibling exclusion. Every clause carries useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though there is no output schema, the description defines the returned row columns, which is critical. Combined with the read-only annotation and the fully described schema, an agent has enough information to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all five parameters are already documented in the schema. The description restates some of that information (filtering by name or entry hex, sorting by size for largest) but does not add significant semantics beyond the structured parameter definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('List discovered functions') and even specifies the exact row shape returned (`entry size blocks instrs callers callees src name`). It also scopes the tool against a sibling by saying it is not for imports and should use `symbols` for those.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly indicates when not to use the tool ('Not for imports') and names the alternative (`symbols`). It also explains the main usage patterns (filtering by name or entry hex, sorting by size for largest), though it does not compare against other function-related siblings like `function` or `function_summary`.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

function_stringsA
Read-only

List the string literals one function references as site string_va text rows, at most 100. Not for finding a text's functions (use find_function_by_string).

NameRequiredDescriptionDefault
addressYesEntry, any address inside it, or a name.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered; the description adds genuinely new behavior by disclosing the return shape ('site string_va text' rows) and a hard result cap of 100. It does not say how the cap is enforced (truncation vs. error) or what ordering applies, which keeps it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the positive capability and output shape front-loaded and the exclusion second. Every clause carries information an agent needs to select and call it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read tool with no output schema, the description supplies the output format and the result bound, which is the main missing structured information. The only gap is unspecified ordering/truncation behavior at the 100-row boundary, which is minor for this tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter with 100% schema description coverage, so the schema already explains 'Entry, any address inside it, or a name'; the description adds no syntax or format detail beyond that. Baseline 3 is correct where the schema does all the parameter work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List the string literals one function references'), gives the exact row shape 'site string_va text', and caps the result at 100. It also explicitly names the sibling it is not, so the agent can distinguish it from find_function_by_string without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second sentence gives an explicit negative case ('Not for finding a text's functions') paired with the exact alternative to use ('use find_function_by_string'). That is a clean when-not plus redirect, leaving nothing for the agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

function_summaryA
Read-only

Triage one function in one call: shape, loops, jump tables, callers, callees, strings and data, then # next: lines. Use it before decompile; for the raw block table use function.

NameRequiredDescriptionDefault
addressYesEntry, any address inside it, or a name.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnlyHint=true, openWorldHint=false), and the description adds genuine context beyond them: this is a single consolidated call covering many facets, and the response embeds '`# next:` lines' suggesting follow-ups. It stops short of describing failure behavior for a bad address or the format/size of the returned triage output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, front-loaded with the action and payload, followed by the routing rules. No filler, and the alternative is placed after the primary claim where it is most useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must convey what comes back and does so by naming each returned facet plus the embedded '`# next:`' guidance. Purpose, routing, and payload are all covered for a single required-parameter read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the one parameter is documented as 'Entry, any address inside it, or a name.' The description adds nothing about the address argument beyond 'one function', so the schema carries the semantics alone — the baseline 3 case.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and scope ('Triage one function in one call') and enumerates the returned facets: shape, loops, jump tables, callers, callees, strings, data. It also distinguishes itself from the sibling `function` ('for the raw block table use function'), so an agent can pick between them without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use it before decompile' gives explicit workflow placement, and 'for the raw block table use function' names the alternative and the condition that selects it. It does not address overlap with other siblings that also surface callers, callees, or strings (xrefs, callgraph, function_strings), leaving some selection ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hexdumpA
Read-only

Hexdump raw bytes at an address as address hex |ascii| rows; a range past mapped bytes shows what is there. Not for typed values (use read), text (use strings) or a live process (live_read).

NameRequiredDescriptionDefault
lengthNoNumber of bytes (default 64, max 4096).
addressYesAddress (0x-hex or decimal), a name, or `off:<n>` for a file offset.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds genuine context beyond that: the row layout of the output and the fact that ranges extending past mapped bytes still return something rather than failing. The wording of that out-of-range behavior ('shows what is there') is slightly vague about whether it pads, errors, or truncates, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the core behavior and output format, followed by routing exclusions. Nothing redundant with schema or annotations is repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read-only tool with full schema coverage and no output schema, the description covers purpose, output shape, and alternatives adequately. The only soft spot is the imprecise description of what happens when the range exceeds mapped memory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so address forms (0x-hex, decimal, name, `off:<n>`) and the length default/max of 4096 are already fully documented. The description only restates the address framing and adds no syntax or constraint detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (hexdump) and resource (raw bytes at an address) plus the exact output shape (`address hex |ascii|` rows). It also rules out three sibling tools by name, so an agent can distinguish it from read, strings, and live_read without inspecting schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit negative routing: not for typed values (use read), not for text (use strings), not for a live process (live_read). Each exclusion names the correct alternative, giving a clear decision rule for when to pick this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

load_binaryA
DestructiveIdempotent

Load a PE, ELF or Mach-O file (or raw bytes with arch) as the program all tools read, returning its summary. Clears the session's names: save_project first. A refused load changes nothing.

NameRequiredDescriptionDefault
pdbNoApply the companion PDB the debug record names (default true).
archNoRaw code or a dump: map its bytes as this arch.
baseNoWith arch: the file's address (default 0).
pathYesAbsolute path to the file.
entryNoWith arch: entry address (default first executable byte).
regionsNoWith arch, not base: VA@OFF:LEN[:rwx],... (max 256).
entry_file_offsetNoFile offset to use as the entry instead of the header's.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: annotations only say destructive/not-readOnly/idempotent, while the description states exactly what is lost (session names) and what happens on failure ('a refused load changes nothing'). That failure-atomicity detail is precisely the kind of behavior an agent cannot infer from hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, zero filler. The destructive side effect and the save_project prerequisite are front-loaded right after the identification clause, ordering the risk before the agent commits.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter destructive load with no output schema, the description covers identification, downstream effect ('the program all tools read'), return shape ('returning its summary'), data loss, and failure semantics. An agent has everything needed to invoke it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so every parameter including pdb, base, entry, regions, and entry_file_offset is already documented inline. The description only echoes the arch usage, adding no format or default details beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (load) and resource (PE/ELF/Mach-O file or raw bytes with arch), plus the crucial scope fact that it becomes 'the program all tools read'. This distinguishes it from load_project, reload, and fetch_pdb without needing their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to call save_project first because session names are cleared, and signals the arch path for raw bytes. It doesn't cover when to prefer load_project or reload, so it stops short of full alternative routing, but the prerequisite guidance is concrete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

load_projectA
DestructiveIdempotent

Replace the session's names, comments and types with a saved .json project. Another binary's project (by SHA-256) is refused unless force=true; for a rebuild use borer://carry.

NameRequiredDescriptionDefault
pathYesProject JSON path.
forceNoLoad a project saved for another binary anyway (default false).

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructive and idempotent annotations, the description adds important context: it replaces session names, comments and types, refuses projects matching another binary by SHA-256, and allows bypass only with force=true. That is substantive behavioral disclosure rather than repetition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tightly written sentences with no wasted text. The main destructive action is front-loaded, followed by the refusal rule and the rebuild alternative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, idempotent project-loading tool with no output schema and fully documented parameters, the description covers the key effects, refusal behavior, force override, and rebuild alternative. An agent has enough context to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the baseline is 3. The description still adds meaning by explaining that force is specifically for loading a project saved for another binary, including the SHA-256 refusal condition, which goes beyond the schema's shorter wording.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it replaces the session's names, comments and types with a saved .json project. This clearly distinguishes it from save_project and gives an agent enough to know exactly what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly describes the refusal condition for projects from another binary and the force=true override, and it names an alternative route for rebuilds via borer://carry. This gives clear when/when-not guidance and an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

queryA
Read-only

Read a borer:// resource (triage, taint, emulate, solve, grep...) for hosts without MCP resources; same answer as resources/read. Use it for analyses no tool has; borer://help lists them, !offset=N!limit=N pages.

NameRequiredDescriptionDefault
uriYesA borer:// resource URI.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the bar is lower. The description adds useful behavioral detail beyond that: it returns the same result as resources/read (idempotent read), enumerates discoverable resource categories, and explains '!offset=N!limit=N' pagination, which is non-obvious and not in the schema. It does not cover error behavior for invalid URIs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences, front-loaded with verb and resource, and the pagination syntax is appended rather than buried. Slight cost: the 'for hosts without MCP resources' clause is jargon-heavy and could be clearer.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description defers return-shape knowledge to 'same answer as resources/read' — a reference an agent may not be able to resolve, rather than a description of what a triage/taint/grep response looks like. URI discovery and paging are covered, so it is adequate but leaves the agent guessing about response structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With one parameter at 100% schema coverage, the baseline is 3; the description earns an extra point by explaining that the URI names a borer:// resource, that borer://help enumerates valid ones, and that offset/limit paging is embedded in the URI string — information the schema's one-line 'A borer:// resource URI.' does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (Read) and resource class (borer:// resource) with concrete examples (triage, taint, emulate, solve, grep), and distinguishes itself from sibling analyses tools by saying it is for 'analyses no tool has'. It also names an equivalence ('same answer as resources/read'), though the odd 'for hosts without MCP resources' phrasing is cryptic without outside context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to reach for it: cases 'no tool has' plus the discovery path 'borer://help lists them', and gives the paging syntax. It stops short of naming a specific sibling to avoid, but the 'no tool has' condition effectively carves out its niche against decompile/disassemble/search.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reachesA
Read-only

Find the shortest call chain from one function to another or to an import, or say none exists within depth. Not for the whole neighbourhood (use callgraph) or direct callers (use xrefs).

NameRequiredDescriptionDefault
toYesTarget function, or an import by name or slot.
fromYesFunction the call chain starts at.
depthNoLongest chain to follow (default 24, max 64).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds genuine behavioral context beyond that: it returns the shortest path, and it explicitly reports when no path exists within the depth limit — a notable outcome an agent must handle. It does not describe the return shape, but without an output schema that is a modest gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the core action and immediately followed by the disambiguation clause. Every clause carries information; nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter read-only graph query with full schema coverage and no output schema, the description covers purpose, scope, failure signaling, and alternatives. The only shortfall is the absence of any hint about the result's shape (e.g., the chain as an ordered list of symbols), which an agent might want when interpreting output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and all three parameters are documented in-schema, including depth default 24 and max 64. The description's phrase 'within depth' reinforces the depth parameter's role as a search bound, but adds no syntax or format detail beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (find shortest call chain) with the exact resource endpoints (function to function or import) and its depth bound. It also names the two sibling tools it is not, so an agent can distinguish it from callgraph and xrefs purely from the text.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit exclusions with the alternatives named: 'Not for the whole neighbourhood (use callgraph) or direct callers (use xrefs)'. That is a textbook when-not plus alternative mapping, leaving no ambiguity about tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

readA
Read-only

Read typed values (kind) as va value rows, or a user type (type) one row per field, pointers named; stops at the first unmapped byte. Not for raw bytes (use hexdump) or a live process (live_read).

NameRequiredDescriptionDefault
kindNoWhat to decode the bytes as (default u64).
typeNoA user type instead of kind: `Rec`, `Rec[4]`, `char[16]`.
countNoValues to read (default 1, max 256).
addressYesAddress (0x-hex or decimal), a name, or `off:<n>` for a file offset.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnlyHint=true, openWorldHint=false), but the description adds real behavioral detail the annotations cannot: the row-oriented return format, pointer naming, and the important truncation trait 'stops at the first unmapped byte,' which tells the agent reads can be partial. It stops short of describing error behavior for a fully unmapped address, so not a full 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly packed sentences with no filler. The primary behavior and output format are front-loaded, and the exclusions are compressed into a single trailing clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with full schema coverage, annotations, and no output schema, the description supplies exactly what structured data cannot: the return shape and the truncation-at-unmapped-byte behavior. Address syntax and count limits are adequately handled by the schema, so nothing an agent needs is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns above that by making the mutual-exclusivity of `kind` and `type` explicit ('or a user type (type)') and by tying each parameter to its mode. It does not elaborate on address forms or the 256-value cap, which remain schema-only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (read) plus two explicit decoding modes (kind-based typed values vs. user type) and the output shape (`va value` rows, one row per field, pointers named). It also names what the tool is not (hexdump for raw bytes, live_read for a live process), which lets an agent separate it from siblings without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-not guidance with named alternatives: 'Not for raw bytes (use hexdump) or a live process (live_read).' The two positive modes described in the first sentence imply the when-to-use case, so an agent has both the selection rule and the routing rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reloadA

Restart the borer server on its rebuilt binary, keeping the session, the loaded file and its annotations. Use it after rebuilding borer instead of restarting the client; live attaches end.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-read-only, non-idempotent, non-destructive semantics. The description adds important context beyond that: the session, loaded file, and annotations survive, while live attaches terminate. It does not cover authentication or failure modes, but the core behavioral effect is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence with the primary action front-loaded, followed by preserved-state details and the attach consequence. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-argument restart tool with annotations covering safety flags and no output schema, the description supplies all necessary operational context: what is preserved, what ends, and when to prefer this over a client restart.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters means the schema imposes no parameter burden, and no parameter-specific description is needed. The description does not need to explain inputs, and the empty schema is fully sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Restart the borer server on its rebuilt binary') and immediately clarifies scope by naming preserved state: session, loaded file, annotations. It is distinguishable from client restart and from load_binary/load_project siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it ('after rebuilding borer') and names the alternative ('instead of restarting the client'). The note 'live attaches end' adds an operational consequence, but there is no explicit when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_projectA
DestructiveIdempotent

Save the session's names, comments and types to a .json project under the output root, keyed by SHA-256. Restore with load_project; an existing file is kept unless overwrite=true.

NameRequiredDescriptionDefault
pathYesOutput `.json` path, relative to the output root or absolute under it.
overwriteNoReplace an existing file (default false).

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already declaring destructiveHint=true and idempotentHint=true, the description adds useful behavior: the file is keyed by SHA-256, lives under the output root, and existing files are preserved unless overwrite=true. It could have been more explicit about what overwrite=true replaces, but the safety-relevant behavior is mostly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two compact sentences with no wasted text. The primary save behavior is front-loaded, followed immediately by restore and overwrite semantics.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter mutation tool with full schema coverage and annotations, the description covers contents saved, path scope, keying, restore alternative, and overwrite behavior. It does not describe the return value or confirmation behavior, which is a minor remaining gap without an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented in the input schema. The description adds context around output-root placement and overwrite behavior, but it does not significantly deepen parameter semantics beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: saving the session's names, comments, and types into a .json project file. It also distinguishes the opposite operation by naming load_project for restore.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly points to load_project as the restore alternative and explains the overwrite condition for existing files. It does not explicitly cover when not to use the tool, but the operational context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scriptA

Run a sandboxed Rhai script on a snapshot of the program: query(uri) and rows(uri) read any resource. Use it when no single tool answers. Proposed names apply only with dry_run=false; a failed script applies nothing.

NameRequiredDescriptionDefault
codeYesRhai source.
dry_runNoPreview only (default true); false applies.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false and destructiveHint=false but say nothing about atomicity; the description adds the important guarantee 'a failed script applies nothing' and that name changes require dry_run=false (default true). It still doesn't say whether query/rows can mutate, or what the script returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action and the API surface, then the selection rule, then the safety semantics. No filler; every clause carries information the agent needs before writing a script.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, potentially mutating escape hatch with no output schema, the description covers purpose, selection, and mutation semantics. It leaves a gap around what the script returns and what URI forms are valid, which matters for a tool whose whole job is arbitrary composition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds meaning the schema cannot: it tells the agent what to actually write inside 'code' (query(uri) and rows(uri)) and reiterates the dry_run gating in context. The dry_run explanation partly duplicates the schema text, keeping it from a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run a sandboxed Rhai script on a snapshot of the program') and goes further by naming the in-script API surface (query(uri), rows(uri)). This is clearly distinguishable from every sibling, which are all fixed-purpose analysis tools, not a general scripting escape hatch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use it when no single tool answers' sets an explicit selection condition that implicitly excludes cases where a dedicated sibling (query, read, xrefs, etc.) already covers the need. It's a strong fallback rule, though it stops short of naming which siblings to prefer for which tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_commentA
Idempotent

Comment an address in the session overlay, never the binary; a comment opening with ? is an open question. To name it use set_name. Dry run until dry_run=false; save_project keeps it.

NameRequiredDescriptionDefault
addressYesAddress the comment attaches to.
commentYesComment text.
dry_runNoPreview only (default true); false applies.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool non-read-only, idempotent and non-destructive, so the description focuses on what annotations can't convey: writes land in the session overlay rather than the binary, and persistence requires save_project. The '? = open question' convention is a genuinely useful behavioral detail. It stops short of explaining overwrite behavior or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight clauses, front-loading the resource and the non-persistence constraint before routing and workflow details. The telegraphic phrasing ('save_project keeps it') is efficient but slightly clipped, which nudges it below a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter mutation tool with full schema coverage and no output schema, the essentials are covered: target, non-persistence, alternative tool, dry-run ritual, and persistence step. Only edge cases (overwriting an existing comment, address validity) are unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns more by adding the '?' prefix convention that governs how the comment string is interpreted, and by restating the dry-run toggle as a workflow invariant. That is meaning beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource (comment an address) and adds crucial scope: it writes to the session overlay, never the binary. It also explicitly distinguishes itself from the sibling set_name for the naming case, so an agent needn't read two schemas to choose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives the explicit alternative for the adjacent task ('To name it use set_name') and states the dry-run workflow condition ('Dry run until dry_run=false'). It does not spell out when not to use it (e.g., commenting data vs code, or duplicate comment overwrites), but the routing guidance is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_nameA
Idempotent

Name a function or data global in the session overlay, never the binary; names=[addr=name,...] renames many, checked first. A taken name needs force=true. Dry run until dry_run=false.

NameRequiredDescriptionDefault
nameNoNew name, an identifier (C++ `::<>~`, `@$?.` kept).
forceNoTake a name another address holds (default false).
namesNoMany at once instead: `address=name` each (max 500).
addressNoFunction entry, any address inside it, or a data address.
dry_runNoPreview only (default true); false applies.

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag it as a non-readonly, non-destructive, idempotent mutation, and the description adds genuinely useful context on top: the change lands in the session overlay and never touches the binary, the bulk path is evaluated first, and a conflicting name is rejected unless force is set. The dry_run default restates the schema, but the overlay/conflict semantics are real added value. No output behavior is described.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, no filler, with the scope constraint front-loaded. The phrase "checked first" is slightly cryptic about what it is checked against, a minor clarity cost in an otherwise tight definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter mutation with full schema coverage and no output schema, the description covers the important behavioral envelope: overlay-only effect, conflict handling, and preview-by-default. The one meaningful gap is that it says nothing about what a call returns or how failures report, which matters slightly more given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter is already documented, and the baseline of 3 applies. The description does add a precedence hint ("names=... checked first") that the schema does not express, but it adds little else about individual parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ("Name a function or data global") and immediately bounds the scope with "in the session overlay, never the binary," which is the key distinction an agent needs. It does not explicitly contrast itself with siblings like set_comment or set_type, but the naming action is unambiguous enough to tell apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It supplies the operative conditions for a successful call — a taken name requires force=true, and the operation previews until dry_run=false — so the agent knows the preconditions. However, it never states when to choose this tool over set_comment/set_type or when to prefer the singular name vs the bulk names path beyond a bare "instead".

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_typeA
Idempotent

Define a struct, enum or typedef, or apply a type at an address so decompile names its fields; at a function, type sets the prototype. To infer a class use class_layout. Checked first; dry run until dry_run=false.

NameRequiredDescriptionDefault
varNoFunction variable to name/type (`a1`, `local_58`).
nameNoStruct, enum or typedef to define, or `var`'s new name.
sizeNoSize past the last field, or an enum's width (4 or 8).
typeNoType to apply or typedef (`Player *`), a prototype, or alone C declarations.
fieldsNoStruct fields, each `offset:name:type` (`0x1c:mp:u32`).
valuesNoEnum values, each `name:value` (`Run:1`).
addressNoData global to type, or a function for a prototype or `var`.
dry_runNoPreview only; false applies.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context beyond the annotations: it says inputs are checked first and that the operation remains a dry run until dry_run=false. Combined with annotations declaring idempotent=true and destructiveHint=false, this gives a clear safety profile, though it does not describe failure or rollback behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the main operations come first, followed by the class_layout alternative and the dry-run rule. Every sentence carries actionable information without filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 8-parameter tool with no output schema, the description explains the major modes, the dry-run behavior, and the class_layout alternative. It is largely complete, though it omits what the tool returns and how validation failures are surfaced.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the parameter descriptions already explain the formats for fields, values, type, address, and dry_run in detail. The description adds mode-level context, such as applying type at an address versus at a function, but does not add much parameter syntax beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states specific operations: defining structs/enums/typedefs, applying types to addresses, and setting function prototypes. It also explicitly distinguishes this tool from class_layout by saying to use class_layout to infer a class.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names class_layout as the alternative for class inference and gives the key safe-usage rule to dry run until dry_run=false. It does not clarify when to use set_type versus set_name for variable naming, which is a remaining gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stringsA
Read-only

List printable ASCII and UTF-16LE strings as va len enc text rows, paged, skipping bytes of code. Not for the code using one (use find_function_by_string).

NameRequiredDescriptionDefault
limitNoMax rows (default 200, max 500).
filterNoCase-insensitive substring filter.
offsetNoMatches to skip (paging).
encodingNoWhich strings to scan for (default both).
count_onlyNoHeader only (default false).
min_lengthNoMinimum length (default 5, min 4).

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint=false, so safety is covered; the description adds real behavioral detail by disclosing the output row layout and that it skips bytes of code (i.e., only non-code data sections are scanned). It omits default/max result sizing, but that lives in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, with the core behavior and output shape front-loaded and the exclusion placed immediately after. Nothing is padded or restated from structured fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, six-parameter listing tool with a fully documented schema, the description supplies the missing behavioral pieces (row format, code-section skipping, paging). No output schema exists, but the row layout is described inline, leaving only sizing defaults to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so limit, filter, offset, encoding, count_only, and min_length are all documented in the schema. The description reinforces paging and the ASCII/UTF-16 choice but adds no format or semantics beyond that text, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (list) plus resource (printable ASCII and UTF-16LE strings) plus the exact output row shape `va len enc text`, and it names the sibling it is not for (find_function_by_string). An agent can distinguish it from symbols, hexdump, or search without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly carves out a negative case and routes to the correct alternative: 'Not for the code using one (use find_function_by_string).' It does not cover other plausible overlaps such as search or hexdump, so it is clear context but not a full when/when-not map.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

symbolsA
Read-only

List imports, exports, forwards, locals and data as demangled kind addr name rows by module, paged. Not for discovered code (use functions) or call sites (use xrefs).

NameRequiredDescriptionDefault
kindNoOne kind of symbol only (default every kind); drops the kind column.
limitNoMax rows (default 50, max 1000).
filterNoCase-insensitive substring of the raw (module included) or demangled name.
offsetNoMatches to skip (paging).
count_onlyNoHeader only (default false).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered; the description adds real context by disclosing the output row format, module grouping, and paging behavior. It stops short of stating result ordering, what an empty result means, or how paging interacts with count_only, which keeps it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler: the first front-loads what is returned and in what shape, the second handles disambiguation. Every clause carries information an agent needs to select or call the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must convey the return shape, and it does so precisely (demangled `kind addr name` rows grouped by module, paged). Combined with the fully documented schema and safe-read annotations, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter is already documented, including the kind enum and defaults; the description only echoes paging and module grouping. That meets the baseline 3 for a fully documented schema with no added semantics such as filter matching rules or limit/count interplay.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ("List") plus the exact resource set (imports, exports, forwards, locals, data) and the row shape (`kind addr name` rows by module). It also names the two siblings it is not (functions, xrefs), so an agent can separate it from adjacent tools without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states explicitly what the tool is not for and routes the agent to the correct alternative in each case: discovered code goes to `functions`, call sites go to `xrefs`. That is a concrete when-not plus named alternatives, not implied guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

typesA
Read-only

List user-defined types and where each is applied, paged. Not for defining one (use set_type) or names and comments (use annotations).

NameRequiredDescriptionDefault
limitNoMax rows (default 50, max 500).
filterNoSubstring filter on name or applied address.
offsetNoRows to skip first (paging).
count_onlyNoHeader only (default false).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds that results are paged and that each type is paired with its applied address, which is useful return-content context, but says nothing about ordering, error behavior, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the core purpose front-loaded and the two exclusions following immediately. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with full schema documentation and no output schema, the description gives enough to call it correctly and understand the shape of results (types plus applied addresses). Minor gap: no indication of default ordering or how 'applied' is formatted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so limit, offset, filter, and count_only are fully documented in the schema including defaults and max. The description adds no parameter-level meaning beyond that, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (user-defined types) plus the scope of results (where each is applied, paged). The exclusion clauses make it trivially distinguishable from set_type and annotations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: use set_type to define a type, use annotations for names and comments, use this tool to list. Both negative cases and their alternatives are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

xrefsA
Read-only

List references to an address or name, one row per function, paged; an import lists calls through its slot, Class+0x24 who touches that field. Not for call paths (use reaches).

NameRequiredDescriptionDefault
limitNoMax groups (default 60, max 500).
offsetNoGroups to skip first (paging).
addressYesAddress or name (function, import, overlay name), or Class+offset.
count_onlyNoHeader only (default false).

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/openWorld=false, so safety is covered; the description adds genuinely new behavior: results are grouped one row per referencing function, output is paged, and address semantics differ for imports (calls through slot) vs. Class+offset (field touches). Paging mechanics and ordering are left to the schema's limit/offset text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence pair with the exclusion front-loaded and no filler. The clause "`Class+0x24` who touches that field" is a sentence fragment that reads awkwardly, but it is information-dense rather than padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by describing the row granularity (per function) and paging. With annotations covering safety and the schema covering all four parameters, the only remaining gap is ordering/truncation behavior across pages, which is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns more by explaining what the `address` parameter means in two non-obvious forms (an import resolves to calls through its slot, a Class+offset resolves to field accesses). It adds interpretation the schema's one-line parameter text does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("List references to an address or name") and immediately qualifies the output shape ("one row per function, paged"). It also names the sibling it is NOT (reaches), so an agent can distinguish it without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly excludes the call-path use case and routes it to `reaches`, which is exactly the disambiguation an agent needs. It does not state positive preconditions (e.g., that a binary/project must be loaded), so it stops just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.2.2
    • Changeddecompile_batch1 field changed
      • changedInput schema / properties / out / description
        Previous value: -"Write every function to this `.c` file instead, uncapped, leaves\nfirst; not with `filter` or `max_functions`. Relative to the output\nroot, or absolute under it."New value: +"A `.c` file under the output root to write every function to; not with `filter` or `max_functions`."
    • Changedfetch_pdb1 field changed
      • changedInput schema / properties / dry_run / description
        Previous value: -"Preview only (default true); false fetches. The symbol server is the\nMicrosoft one, or the one `BORER_SYMBOL_SERVER` names."New value: +"Preview only (default true); false fetches from `BORER_SYMBOL_SERVER` or Microsoft's."
    • Changedsave_project1 field changed
      • changedInput schema / properties / path / description
        Previous value: -"Output `.json` path, relative to the output root or absolute under\nit."New value: +"Output `.json` path, relative to the output root or absolute under it."
  2. 34 tool updatesv0.2.1
    • First observedannotations
    • First observedbinary_info
    • First observedcallgraph
    • First observedcfg
    • First observedclass_layout
    • First observeddecompile
    • First observeddecompile_batch
    • First observeddisassemble
    • First observeddisassemble_function
    • First observedentropy
    • First observedfetch_pdb
    • First observedfind_crypto_constants
    • First observedfind_function_by_string
    • First observedfunction
    • First observedfunction_strings
    • First observedfunction_summary
    • First observedfunctions
    • First observedhexdump
    • First observedload_binary
    • First observedload_project
    • First observedquery
    • First observedreaches
    • First observedread
    • First observedreload
    • First observedsave_project
    • First observedscript
    • First observedsearch
    • First observedset_comment
    • First observedset_name
    • First observedset_type
    • First observedstrings
    • First observedsymbols
    • First observedtypes
    • First observedxrefs

TDQS

A4/5.0

Scored across 34 tools

Disambiguation4/5

Descriptions are unusually disciplined, including explicit "not for X (use Y)" redirects that resolve nearly every overlap (function vs function_summary, strings vs function_strings vs find_function_by_string, callgraph vs reaches vs xrefs). Still, the cluster of function/cfg/decompile/disassemble/function_summary tools is dense and an agent must read descriptions carefully to choose correctly, especially names differing only by plural (function/functions).

Naming Consistency4/5

A discernible two-tier convention holds: read-only inspectors use bare nouns (symbols, types, xrefs, strings, cfg, hexdump) while mutating or action tools use verb_noun (load_binary, save_project, set_name, find_crypto_constants, disassemble_function). Minor hazards exist—`function`/`functions` and `disassemble`/`disassemble_function` differ only by inflection, and `query`/`script` are vague one-worders—but nothing is camelCase-mixed or chaotic.

Tool Count4/5

34 tools is at the upper bound, but this is a full binary-analysis platform (load, inspect, decompile, annotate, save) where nearly every tool maps to a distinct analysis operation. A few could plausibly merge (disassemble/disassemble_function, function/function_summary), but none look like filler.

Completeness3/5

Core lifecycle is thorough—load, symbols/types, functions, decompile/disassemble, xrefs/callgraph/CFG, strings/search/entropy, annotation overlay, and project save/restore. However, several descriptions point to tools that are absent from the surface (live_read, live attach via reload), and there is no live-process read path or any means to compare/patch state beyond the overlay, leaving referenced dead ends.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server for targeted binary analysis with Kuna, enabling listing and decompiling specific functions via natural language.
    1
    MIT
  • F
    license
    A
    quality
    B
    maintenance
    Enables MCP clients to execute Python snippets and interact with Ghidra through its PyGhidra scripting environment via a local Java plugin.
    24
    1
    -
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables agents to reverse-engineer software across native binaries, managed code, Electron apps, websites, and live runtime behavior, returning findings linked to the evidence and limitations behind each conclusion. It also maintains a durable workspace where those behaviors can be inspected, questioned, compared against real execution, and exported as runnable handoffs.
    397,275 npm
    MIT