List the names, findings and open questions (comments opening with ?) added this session, paged. Use it to resume work; not for binary symbols (use symbols) or user types (use types).

Summarize the loaded program: format, arch, entry, sections with entropy, imports, exports. load_binary already returns it; for protection and where to start, query borer://triage. Fails if nothing is loaded.

Draw a function's call graph as mermaid: callees, or callers with callers=true; imports are leaves and a %% line counts nodes cut by max_nodes. Not for one path (use reaches) or a caller list (use xrefs).

Draw a function's control-flow graph as mermaid: blocks and successor edges, 300 blocks a page, a %% line when cut. Not for reading logic (use decompile) or a block table (use function).

Infer a C++ class's fields, methods and vftable from how its methods use the object: offset, width, reads, writes. Use it on an unknown class; for a known layout use set_type. apply=Name saves it as a struct (dry run until dry_run=false).

Decompile one function to pseudo-C. Locals are local_N/arg_N (N hex bytes below the entry sp: higher N, lower address); /* asm */ marks unmodeled code. Line 2 says what was checked, // warn: what is wrong. Not for a first look (use function_summary).

Decompile many functions matching a name filter, in parallel, 6000 chars each and 40000 in all; out=<file.c> writes all uncapped to a file under the output root, kept unless overwrite=true. For one use decompile.

Disassemble count instructions from any address as va text rows. Use it for a few instructions or code outside functions; for a whole function use disassemble_function. Fails if unmapped.

Disassemble a whole function by blocks, with L_<addr>: labels and named call targets. Use it when exact instructions matter; for C use decompile, for a few instructions disassemble.

Find packed, compressed or encrypted data: chunks at or above threshold bits/byte, as off va len entropy rows, at most 200, paged. To name the packer query borer://protection instead.

Download the loaded PE's missing PDB over https into the cache, kept only if its GUID and age match. Use it when load_binary reports no PDB; dry run until dry_run=false, then load_binary again.

Find crypto constants and tables (AES, SHA, MD5, CRC-32, ChaCha, Blowfish, FNV, Base64) and hashed API names as va section algorithm rows, paged. Use it to locate crypto code, then xrefs a hit; not for strings (use strings).

Find the functions whose strings contain a text, case-insensitively: a numbered string legend, then entry name: 1 2 rows, paged. Not for one function's strings (use function_strings).

Show one function's raw facts: range, counts, callers, callees and block table (start size term successors), 300 blocks a page. Not for a readable triage (use function_summary).

List the string literals one function references as site string_va text rows, at most 100. Not for finding a text's functions (use find_function_by_string).

Triage one function in one call: shape, loops, jump tables, callers, callees, strings and data, then # next: lines. Use it before decompile; for the raw block table use function.

List discovered functions as entry size blocks instrs callers callees src name rows, paged; filter on name or entry hex, sort=size for the largest. Not for imports (use symbols).

Hexdump raw bytes at an address as address hex |ascii| rows; a range past mapped bytes shows what is there. Not for typed values (use read), text (use strings) or a live process (live_read).

Load a PE, ELF or Mach-O file (or raw bytes with arch) as the program all tools read, returning its summary. Clears the session's names: save_project first. A refused load changes nothing.

Replace the session's names, comments and types with a saved .json project. Another binary's project (by SHA-256) is refused unless force=true; for a rebuild use borer://carry.

Read a borer:// resource (triage, taint, emulate, solve, grep...) for hosts without MCP resources; same answer as resources/read. Use it for analyses no tool has; borer://help lists them, !offset=N!limit=N pages.

Find the shortest call chain from one function to another or to an import, or say none exists within depth. Not for the whole neighbourhood (use callgraph) or direct callers (use xrefs).

Read typed values (kind) as va value rows, or a user type (type) one row per field, pointers named; stops at the first unmapped byte. Not for raw bytes (use hexdump) or a live process (live_read).

Restart the borer server on its rebuilt binary, keeping the session, the loaded file and its annotations. Use it after rebuilding borer instead of restarting the client; live attaches end.

Save the session's names, comments and types to a .json project under the output root, keyed by SHA-256. Restore with load_project; an existing file is kept unless overwrite=true.

Run a sandboxed Rhai script on a snapshot of the program: query(uri) and rows(uri) read any resource. Use it when no single tool answers. Proposed names apply only with dry_run=false; a failed script applies nothing.

Search every byte of the file for a hex pattern with ?? wildcards, or text with kind=text, as function: va ... rows, paged. Not for listing strings (use strings).

Comment an address in the session overlay, never the binary; a comment opening with ? is an open question. To name it use set_name. Dry run until dry_run=false; save_project keeps it.

Name a function or data global in the session overlay, never the binary; names=[addr=name,...] renames many, checked first. A taken name needs force=true. Dry run until dry_run=false.

Define a struct, enum or typedef, or apply a type at an address so decompile names its fields; at a function, type sets the prototype. To infer a class use class_layout. Checked first; dry run until dry_run=false.

List printable ASCII and UTF-16LE strings as va len enc text rows, paged, skipping bytes of code. Not for the code using one (use find_function_by_string).

List imports, exports, forwards, locals and data as demangled kind addr name rows by module, paged. Not for discovered code (use functions) or call sites (use xrefs).

List user-defined types and where each is applied, paged. Not for defining one (use set_type) or names and comments (use annotations).

List references to an address or name, one row per function, paged; an import lists calls through its slot, Class+0x24 who touches that field. Not for call paths (use reaches).