Skip to main content
Glama

RE-MCP

A multi-backend reverse-engineering MCP server. Exposes binary analysis capabilities from IDA Pro and Ghidra over the Model Context Protocol, letting LLMs drive reverse-engineering tools directly. Supports multiple simultaneous databases through a supervisor/worker architecture.

Both backends are standalone servers, not plugins. They use headless APIs (idalib for IDA, pyghidra for Ghidra) to run analysis engines without a GUI.

Backends

Backend

Package

Requirements

IDA Pro

re-mcp-ida

IDA Pro 9+ with a valid license

Ghidra

re-mcp-ghidra

Ghidra 12+, JDK 21+

Both backends share a common tool interface — core analysis tools use the same names, parameters, and response shapes — so LLM workflows are portable across backends. Each backend also has tools for platform-specific features (e.g. IDA: file region mapping, executable rebuilding, IDC evaluation, IDAPython scripting; Ghidra: Function ID analysis, data type archives).

Related MCP server: GhidraMCP

Requirements

  • Python 3.12+

  • uv package manager (recommended) or pip

  • macOS, Windows, or Linux

  • At least one supported backend installed on the same machine

Installation

Install individual backend packages directly, or install re-mcp and select a backend with --backend:

# Individual backend packages (each provides its own CLI)
uv tool install re-mcp-ida
uv tool install re-mcp-ghidra

# Or install the core package and use --backend to select
uv tool install re-mcp --with re-mcp-ida --with re-mcp-ghidra

With pip:

pip install re-mcp-ida        # IDA only
pip install re-mcp-ghidra     # Ghidra only
pip install re-mcp re-mcp-ida re-mcp-ghidra  # Unified CLI with both backends

From source

git clone https://github.com/jtsylve/ida-mcp && cd ida-mcp
uv sync

Or with pip:

git clone https://github.com/jtsylve/ida-mcp && cd ida-mcp
pip install -e packages/re-mcp-core -e packages/re-mcp-ida -e packages/re-mcp-ghidra

Finding IDA Pro

The IDA backend looks for your IDA Pro installation in the following order:

  1. IDADIR environment variable — checked first; set this if IDA is in a non-standard location.

  2. IDA's own config filePaths.ida-install-dir in ~/.idapro/ida-config.json (macOS/Linux) or %APPDATA%\Hex-Rays\IDA Pro\ida-config.json (Windows). If the IDAUSR environment variable is set, it is used as the config directory instead.

  3. Platform-specific default paths:

Platform

Default search paths

macOS

/Applications/IDA Professional *.app/Contents/MacOS

Windows

C:\Program Files\IDA Professional 9.3, C:\Program Files\IDA Pro 9.3, and Program Files (x86) equivalents

Linux

/opt/ida-pro-9.3, /opt/idapro-9.3, /opt/ida-9.3, ~/ida-pro-9.3, ~/idapro-9.3

The idapro package is loaded at runtime directly from your local IDA Pro installation — no extra setup steps or environment variables are needed if IDA is installed in a standard location.

Finding Ghidra

The Ghidra backend looks for your Ghidra installation in the following order:

  1. GHIDRA_INSTALL_DIR environment variable — checked first; set this if Ghidra is in a non-standard location.

  2. Config fileghidra-install-dir in ~/.ghidra/ghidra-config.json.

  3. Platform-specific default paths:

Platform

Default search paths

macOS

/Applications/ghidra_*, ~/ghidra_*

Windows

C:\ghidra_*, ~/ghidra_*

Linux

/opt/ghidra_*, /usr/local/ghidra_*, ~/ghidra_*

Usage

Running the server

Each backend has its own CLI, or use the unified re-mcp command with --backend:

# Individual backend CLIs
uvx re-mcp-ida
uvx re-mcp-ghidra

# Unified CLI (requires backend package installed alongside)
uvx --with re-mcp-ida re-mcp --backend ida
uvx --with re-mcp-ghidra re-mcp --backend ghidra

Both CLIs support the same subcommands:

Command

Description

<backend> (or <backend> stdio)

Direct stdio mode — single-session, workers die on disconnect (default)

<backend> proxy

Stdio proxy that auto-spawns a persistent HTTP daemon

<backend> serve

Start the HTTP daemon directly (for manual daemon management)

<backend> stop

Gracefully shut down a running daemon

<backend> backends

List installed backends (most useful with the unified re-mcp CLI)

The default mode runs a direct stdio server — the simplest transport, widely supported across MCP clients. Workers die when the client disconnects.

For persistent state across reconnections, use <backend> proxy. This mode auto-spawns a persistent HTTP daemon behind the scenes, handling port allocation and authentication transparently. Workers and database state survive client reconnections. The daemon shuts down automatically after 5 minutes of inactivity (configurable via <PREFIX>IDLE_TIMEOUT).

Running without installing

# Individual backend packages
IDADIR=/path/to/ida uvx re-mcp-ida
GHIDRA_INSTALL_DIR=/path/to/ghidra uvx re-mcp-ghidra

# Unified package
IDADIR=/path/to/ida uvx --with re-mcp-ida re-mcp --backend ida
GHIDRA_INSTALL_DIR=/path/to/ghidra uvx --with re-mcp-ghidra re-mcp --backend ghidra
# Individual backend packages
$env:IDADIR = "C:\Program Files\IDA Professional 9.3"
uvx re-mcp-ida

$env:GHIDRA_INSTALL_DIR = "C:\ghidra_12.0.3_PUBLIC"
uvx re-mcp-ghidra

# Unified package
$env:IDADIR = "C:\Program Files\IDA Professional 9.3"
uvx --with re-mcp-ida re-mcp --backend ida

MCP client configuration

Add to your MCP client config (e.g. Claude Desktop claude_desktop_config.json):

IDA backend:

{
  "mcpServers": {
    "ida": {
      "command": "uvx",
      "args": ["re-mcp-ida"]
    }
  }
}

Ghidra backend:

{
  "mcpServers": {
    "ghidra": {
      "command": "uvx",
      "args": ["re-mcp-ghidra"]
    }
  }
}

Both backends simultaneously:

{
  "mcpServers": {
    "ida": {
      "command": "uvx",
      "args": ["re-mcp-ida"]
    },
    "ghidra": {
      "command": "uvx",
      "args": ["re-mcp-ghidra"]
    }
  }
}

Using the unified re-mcp CLI (when installed via uv tool install re-mcp --with re-mcp-ida):

{
  "mcpServers": {
    "ida": {
      "command": "re-mcp",
      "args": ["--backend", "ida"]
    }
  }
}

If the backend command is installed on your PATH (e.g. via pip install), use it directly:

{
  "mcpServers": {
    "ida": {
      "command": "re-mcp-ida"
    }
  }
}

If the command isn't on your PATH, use the full path to the executable:

{
  "mcpServers": {
    "ida": {
      "command": "/home/user/.pyenv/versions/<version>/bin/re-mcp-ida"
    }
  }
}

If the backend (IDA or Ghidra) isn't in a default location, add the install directory via the env key:

{
  "mcpServers": {
    "ida": {
      "command": "uvx",
      "args": ["re-mcp-ida"],
      "env": {
        "IDADIR": "/path/to/ida"
      }
    },
    "ghidra": {
      "command": "uvx",
      "args": ["re-mcp-ghidra"],
      "env": {
        "GHIDRA_INSTALL_DIR": "/path/to/ghidra"
      }
    }
  }
}

Connecting to a running daemon directly:

If you started the daemon manually with <backend> serve, the connection details (host, port, bearer token) are in the state file. Clients that support streamable HTTP can connect directly.

State file locations:

  • macOS: ~/Library/Application Support/<backend>/daemon.json

  • Linux: $XDG_STATE_HOME/<backend>/daemon.json (defaults to ~/.local/state/<backend>/daemon.json)

  • Windows: %LOCALAPPDATA%\<backend>\daemon.json

Where <backend> is re-mcp-ida or re-mcp-ghidra.

{
  "mcpServers": {
    "ida": {
      "type": "streamable-http",
      "url": "http://127.0.0.1:<port>/mcp",
      "headers": {
        "Authorization": "Bearer <token>"
      }
    }
  }
}

Basic workflow

  1. Open a binary — call open_database with the path to a binary (or existing database file), then wait_for_analysis to block until it is ready

  2. Analyze — use the available tools (list functions, decompile, search strings, read bytes, etc.)

  3. Close — call close_database when done (auto-saves by default)

Raw binaries must be in a writable directory since both backends create database files alongside them. When opening an existing database, the original binary does not need to be present.

Multi-database mode

Multiple databases can be open at the same time. By default, open_database keeps previously opened databases open. Pass keep_open=False to save and close databases owned by the current session before opening the new one. All tools except management tools (open_database, close_database, save_database, list_databases, wait_for_analysis, list_targets) require the database parameter (the stem ID returned by open_database or list_databases).

open_database("first.bin")                              # spawns worker (returns immediately)
wait_for_analysis(database="first")                     # blocks until ready
open_database("second.bin")                             # spawns second worker
wait_for_analysis(database="second")                    # blocks until ready
decompile_function(address="main", database="first")    # targets first
close_database(database="second")                       # closes second

Environment variables

Each backend uses its own environment variable prefix (IDA_MCP_ or GHIDRA_MCP_). The table below uses <PREFIX> as a placeholder.

Backend installation:

Variable

Backend

Default

Description

IDADIR

IDA

(auto-detected)

Path to IDA Pro installation directory

GHIDRA_INSTALL_DIR

Ghidra

(auto-detected)

Path to Ghidra installation directory

Shared settings (replace <PREFIX> with IDA_MCP_ or GHIDRA_MCP_):

Variable

Default

Description

<PREFIX>MAX_WORKERS

(unlimited)

Maximum simultaneous databases (clamped to 1-8 when set)

<PREFIX>LOG_LEVEL

WARNING

Logging level (DEBUG, INFO, WARNING, ERROR, CRITICAL) — output goes to stderr

<PREFIX>LOG_DIR

(unset)

Directory for per-run log files. Each component logs to <dir>/<run_id>-<label>.log, each worker to <dir>/<run_id>-worker-<db>.log, and each worker's raw stderr to <dir>/<run_id>-worker-<db>.stderr. When unset, logs go only to stderr.

<PREFIX>IDLE_TIMEOUT

300

Idle auto-shutdown timeout in seconds for auto-spawned daemons. Set to 0 to disable. <backend> serve defaults to 0 (use --idle-timeout=N to override).

<PREFIX>DISABLE_EXECUTE

(unset)

Set to 1, true, yes, or on to hide the execute meta-tool (sandboxed Python code mode)

<PREFIX>DISABLE_BATCH

(unset)

Set to 1, true, yes, or on to hide the batch meta-tool

<PREFIX>DISABLE_TOOL_SEARCH

(unset)

Set to 1, true, yes, or on to disable server-side progressive tool disclosure — all tools become directly visible and callable, and the search_tools and get_schema meta-tools are removed. Useful with clients that provide their own tool deferral (e.g. Claude Code).

IDA-only settings:

Variable

Default

Description

IDA_MCP_ALLOW_SCRIPTS

(unset)

Set to 1, true, or yes to enable the run_script tool for arbitrary IDAPython execution

Tools

To keep token usage manageable, only common analysis tools and management tools are directly visible to clients. The rest are discoverable and callable through meta-tools:

  • search_tools — regex search over non-pinned tool names, descriptions, and tags (pinned tools are already visible).

  • get_schema — parameter schemas and return shapes for tools by name.

  • call — lightweight proxy for calling any tool by name, including hidden tools not in the client tool list.

  • execute — sandboxed Python that chains multiple await invoke(name, params) calls in a single round trip. Supports asyncio.gather for parallel queries, loops, and conditional logic between calls.

  • batch — sequential multi-tool execution with per-item error collection and progress reporting (up to 50 operations per call).

Management tools (open_database, close_database, save_database, list_databases, wait_for_analysis, list_targets) are always visible. Most must be called directly — save_database and list_databases are the exceptions, also callable through call, execute, and batch for use in multi-step workflows.

The full tool catalog spans these areas:

  • Database — open/close/save/list databases, file region mapping, metadata

  • Functions — list, query, decompile, disassemble, rename, prototypes, chunks, stack frames

  • Decompiler — pseudocode variable renaming/retyping, decompiler comments, microcode

  • Ctree — AST exploration and pattern matching

  • Cross-References — xref queries, call graphs, xref creation/deletion

  • Imports & Exports — imported functions, exported symbols, entry point listing and manipulation

  • Search — string extraction, byte patterns, text in disassembly, immediate values, string-to-code references, string list rebuilding

  • Types & Structures — local types, structs, enums, type parsing and application, source declarations

  • Instructions & Operands — decode instructions, resolve operand values, change operand display format

  • Control Flow — basic blocks, CFG edges, switch/jump tables

  • Data — raw byte reading, hex dumps, segment listing, pointer tables

  • Patching — byte patching, instruction assembly, function/code creation, data loading

  • Data Definition — define bytes, words, dwords, qwords, floats, doubles, strings, and arrays

  • Segments — create, modify, and rebase segments

  • Names & Comments — rename addresses, manage comments (get, set, and append)

  • Demangling — C++ symbol name demangling

  • Analysis — auto-analysis, fixups, exception handlers, segment registers

  • Address Metadata — source line numbers, analysis flags, library item marking

  • Register Tracking — register and stack pointer value tracking

  • Register Variables — register-to-name mappings within functions

  • Signatures — FLIRT signatures/type libraries (IDA), Function ID/data type archives (Ghidra)

  • Export — batch decompilation/disassembly, output file generation

  • Snapshots — take, list, and restore database snapshots

  • Processor — architecture info, register names, instruction classification

  • Bookmarks — marked-position management

  • Colors — address/function coloring

  • Undo — undo/redo operations

  • Directory Tree — folder organization

  • Utility — number conversion, expression evaluation, scripting

All tools include MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so clients can distinguish safe reads from mutations and prompt for confirmation on destructive operations. Mutation tools return old values alongside new values for change tracking.

See docs/tools.md for the complete tools reference.

Resources

The server exposes MCP resources — read-only, cacheable endpoints for structured database context:

  • Static binary data — imports, exports, entry points (with regex search variants)

  • Aggregate snapshot — statistics (function/segment/entry point/string/name counts, code coverage)

  • Supervisor<scheme>://databases lists all open databases with worker state

The URI scheme is ida:// for the IDA backend and ghidra:// for the Ghidra backend.

Prompts

The server provides MCP prompts — guided workflow templates that instruct the LLM to use tools in a structured sequence. Prompts are currently available for the IDA backend only.

  • survey_binary — binary triage producing an executive summary

  • analyze_function — full single-function analysis with decompilation, data flow, and behavior summary

  • diff_before_after — preview the effect of renaming/retyping on decompiler output

  • classify_functions — categorize functions by behavioral pattern

  • find_crypto_constants — scan for known cryptographic constants

  • auto_rename_strings — suggest function renames based on string references

  • apply_abi — apply known ABI type information to identified functions

  • export_idc_script — generate a script that reproduces user annotations

Architecture

The project is a monorepo with three packages:

See docs/architecture.md for detailed architecture documentation.

Development

# With uv (recommended)
uv sync                              # Install dependencies
uv run ruff check packages/          # Lint
uv run ruff format packages/         # Format
uv run ruff check --fix packages/    # Lint with auto-fix

# With pip
pip install -e packages/re-mcp-core -e packages/re-mcp-ida -e packages/re-mcp-ghidra
pip install pre-commit pytest pytest-asyncio ruff jsonschema
ruff check packages/
ruff format packages/
ruff check --fix packages/

Pre-commit hooks run REUSE compliance checks, ruff lint (with --fix --exit-non-zero-on-fix), ruff format, idalib threading lint, and pytest on every commit.

License

This project is dual-licensed under the MIT License and Apache License 2.0.

© 2026 Joe T. Sylve, Ph.D.

This project is REUSE compliant.


IDA Pro and Hex-Rays are trademarks of Hex-Rays SA. Ghidra is developed by the NSA. RE-MCP is an independent project and is not affiliated with or endorsed by Hex-Rays or the NSA.

Available Tools

11 tools
batchA

Run 2+ independent tool calls in a single request with per-item error collection.

Preferred over execute for independent calls (no sandbox overhead). Examples: decompile/disassemble N functions, rename N symbols, set N comments, fetch N xrefs.

Use execute only when chaining one tool's output into another.

database is auto-injected into each operation — omit from params. Override per-operation with explicit database for cross-DB work.

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseYesDatabase to target (stem ID from open_database). Auto-injected into each operation's params. Individual operations can override by including `database` in their params.
operationsYesList of tool calls to execute sequentially (max 50).
stop_on_errorNoStop on first error instead of continuing.

Output Schema

ParametersJSON Schema
NameRequiredDescription
failedYesNumber of failed operations.
resultsYesPer-operation results.
cancelledNoWhether batch stopped before completing all operations (stop_on_error or client cancellation).
succeededYesNumber of successful operations.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals key behaviors: per-item error collection, independent call execution, and auto-injection of the database parameter. While it does not explicitly state that operations execute sequentially (covered in the schema) or describe the exact return structure (output schema exists), the description adequately discloses the most critical behavioral traits for an agent to use the tool safely.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise, using three short paragraphs. The main purpose is stated in the first sentence, followed by usage guidance and a note on database handling. Every sentence adds value without redundancy. It is front-loaded and well-organized, making it easy for an agent to quickly grasp the tool's function and when to use it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (3 parameters, array of operations, output schema), the description covers the essential aspects: purpose, usage, and database injection. It does not explicitly mention the maximum of 50 operations or sequential execution, but these are documented in the schema. The description is sufficient for an agent to correctly invoke the tool, especially since the schema provides the remaining details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds significant value by explaining the auto-injection behavior of `database` and how to override it for cross-database operations, which is not obvious from the schema alone. It also clarifies the 'independent' nature of operations, which complements the operations array schema. The description does not rehash the `stop_on_error` parameter, which is already described in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Run 2+ independent tool calls in a single request with per-item error collection.' It uses a specific verb ('run') and resource ('tool calls'), and explicitly differentiates from the sibling `execute` by mentioning it is preferred for independent calls. Concrete examples (decompile, rename, set comments, fetch xrefs) further clarify the intended use.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool vs. alternatives: 'Preferred over `execute` for independent calls' and 'Use `execute` only when chaining one tool's output into another.' It also instructs on parameter handling ('`database` is auto-injected into each operation — omit from params') and cross-database overrides, leaving no ambiguity about selection or invocation context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

callA

Call any tool by name, including hidden tools not in the client tool list.

Use for single hidden-tool calls. For multiple calls, prefer batch.

ParametersJSON Schema
NameRequiredDescriptionDefault
toolYesTool name to call.
databaseNoDatabase to target (stem ID from open_database). Auto-injected into arguments unless already present.
argumentsNoArguments to pass to the tool.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does disclose key behaviors: it can call hidden tools, and it auto-injects the database parameter into arguments unless already present (via schema but also implied). It also implies single-call behavior. However, it does not describe what happens if a tool fails, error handling, or any side effects, leaving some gaps. Still, given the tool's meta nature, it covers essential aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, just two sentences. The primary purpose is front-loaded in the first sentence, and usage guidance follows immediately. Every word earns its place with no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity as a meta-tool with nested objects and an output schema, the description is fairly complete. It clarifies the main use case (single hidden-tool calls), the differentiation from batch, and the auto-injection behavior. However, it could benefit from a brief note on what the output schema represents (e.g., the result of the called tool) and how errors might be returned, but the output schema itself may cover return values. The absence of these details loses a point.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents all three parameters (tool, database, arguments). The description adds context about how the database parameter is auto-injected into arguments, which is additional value beyond the schema. However, it does not elaborate on the tool parameter's format or how arguments are structured. With full schema coverage, a baseline of 3 is appropriate, and the auto-injection note adds slight value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Call any tool by name, including hidden tools not in the client tool list.' It specifies the verb (call) and the resource (any tool by name), and distinguishes itself from batch for multiple calls. However, it does not explicitly differentiate from the sibling 'execute' or other calling mechanisms, so it loses one point for not naming alternatives beyond batch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance: 'Use for single hidden-tool calls. For multiple calls, prefer **batch**.' This clearly indicates when to use this tool and names the alternative batch for multiple calls. It does not, however, mention other potentially relevant alternatives like execute or when not to use call, so it loses a point for not being more comprehensive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

close_databaseClose DatabaseA

Close a database and terminate its worker process.

Specify database when multiple are open. Fails if the DB is not attached to the current session unless force=True. When other sessions still use the DB, detaches this session but keeps the worker alive.

ParametersJSON Schema
NameRequiredDescriptionDefault
saveNo
forceNo
databaseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no meaningful annotations beyond the title, the description carries the full behavioral burden and does so well. It discloses the worker-process termination, the failure mode when the DB is not attached unless force=True, and the detach-but-keep-worker-alive behavior for multi-session cases. It does not mention the save parameter's effect, but the core side effects are clearly presented.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with the primary action in the first sentence and supporting conditional behavior in three short follow-up sentences. Every sentence adds information, and there is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential invocation context: which database argument to provide, when force is needed, and what happens with concurrent sessions. Since an output schema exists, return values need not be described. The only notable gap is the undocumented save parameter, which could affect whether close persists or discards changes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all three parameters. It explains database ('specify when multiple are open') and force ('unless force=True'), but save is never described. This is a meaningful but incomplete compensation for the schema's lack of parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-object pair, 'close a database and terminate its worker process', which makes the action unambiguous. It also clearly distinguishes this tool from siblings like open_database, save_database, and list_databases by focusing on closure and process termination.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear conditions for use: specify database when multiple are open, force=True to override the attached-session requirement, and behavior when other sessions still use the database. It does not explicitly name alternative tools or say 'use save_database instead', but the context is strong enough for an agent to decide when this tool applies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

executeA

Run Python code that chains tool calls. Use await invoke(name, params) to call tools; use return to produce output.

database is auto-injected into every invoke — omit it from params. Override per-call with explicit database for cross-database work.

When NOT to use execute

  • Single tool call → use the call meta-tool (or the direct tool if pinned).

  • N independent calls → use batch (lower overhead, per-item errors). → Otherwise, use the batch meta-tool for sequential multi-tool execution with per-item error collection and progress reporting.

  • Check if a tool has a built-in batch parameter first (e.g. get_strings filters=[...]).

When to use execute

Multi-step pipelines — chaining one tool's output into another:

decomp = await invoke("decompile_function", {"address": "0x1234"})
addrs = re.findall(r'sub_([0-9A-Fa-f]+)', decomp["pseudocode"])
xrefs = [await invoke("get_xrefs_to", {"address": f"0x{a}"}) for a in addrs]
return {"decomp": decomp, "xrefs": xrefs}

Cross-database parallel queries — use asyncio.gather with explicit database params. Same-database calls are serialized by the worker.

Reference

  • Blocked tools: open_database, close_database, wait_for_analysis, list_targets, and meta-tools (search_tools, get_schema, execute, batch, call) must be called directly. save_database and list_databases are allowed.

  • Addresses are strings: "0x401000", "4010a0", or symbol names.

  • filter_pattern is Python regex — use re.escape() for literals.

  • Available imports: asyncio, collections, functools, itertools, json, math, operator, re, struct, typing. No FS/network I/O.

  • Paginated results have items, total, offset, limit, has_more — always check has_more.

  • Use get_schema(tools=[...]) to look up parameter names and types.

  • Return only what you need — filter before returning to save context.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesPython async code to execute tool calls via invoke(name, arguments)
databaseYesDatabase to target (stem ID from open_database). Available as `database` variable in code and auto-injected into invoke params. Individual calls can override by passing `database` explicitly.

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility. It discloses important behavioral traits: database auto-injection, blocked tools, allowed imports, prohibition of FS/network I/O, paginated result shape, and the requirement to check has_more. This is far beyond a minimal summary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place: main usage, examples, exclusions, reference constraints. It is well-structured with clear headings and code blocks, ensuring an agent can quickly extract the rules that matter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the absence of annotations and output schema, the description is exceptionally complete. It covers when to use, when not to use, parameter behavior, execution environment, tool-blocking rules, and result conventions. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds substantial meaning: database is auto-injected into invoke and can be overridden, code is Python async code, plus practical details like address formats, Python regex for filter_pattern, and available imports. This greatly aids correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Run Python code that chains tool calls.' It clearly distinguishes itself from siblings by positioning execute as the multi-step pipeline meta-tool, with explicit contrast to call and batch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description has a dedicated 'When NOT to use execute' section naming alternatives (call, batch, built-in batch parameters) and a 'When to use execute' section with concrete scenarios (multi-step pipelines, cross-database parallel queries). This gives the agent unambiguous routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_schemaA

Get parameter schemas for specific tools by name (pinned and hidden).

Use after search_tools or before execute/batch to check parameter types and return shapes. Pass detail="full" for complete JSON schemas.

Hidden tools must be called via call, batch, or execute — direct calls will fail because they are not in the client tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault
toolsYesTool names to get schemas for.
detailNo'brief' for a one-line signature + summary per tool, 'detailed' for parameter schemas as markdown (default), 'full' for complete JSON schemasdetailed

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It discloses meaningful behavioral details: the nuance of detail levels, that hidden tools are included, and that direct calls to hidden tools fail unless routed through call, batch, or execute. It does not cover unknown-tool error behavior, but the output schema covers return structure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: one sentence for purpose, one for workflow context, one for an important parameter tip, and one for the hidden-tool caveat. Every sentence earns its place and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, the description covers purpose, workflow placement, and the critical hidden-tool caveat. Since an output schema exists, the description does not need to explain return values. A small gap is that 'pinned' is never defined, but this is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The description adds only a usage hint ('Pass detail="full"'), which is helpful but not extra semantic meaning beyond the enum documentation. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get parameter schemas for specific tools by name.' It further narrows scope to 'pinned and hidden' tools and positions itself relative to search_tools and execute/batch, so an agent can clearly distinguish it from siblings without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit workflow placement: 'Use after search_tools or before execute/batch to check parameter types and return shapes.' It also provides a when-not and alternative behavior for hidden tools by stating that direct calls will fail and that call, batch, or execute must be used instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_databasesList DatabasesA

List all open databases with metadata (includes opening/analyzing status).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context by noting that metadata includes opening/analyzing status. However, with no annotations like readOnlyHint or destructiveHint, the description carries the full burden of disclosing side effects. It does not explicitly state that the operation is read-only or that it has no side effects, though 'List' implies it. The added metadata detail is valuable but insufficient for full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that front-loads the action and resource. It includes relevant detail about metadata without any fluff or redundancy. Every word earns its place, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters) and the presence of an output schema, the description is largely complete. It clearly states what the tool does and the key additional detail about status. It does not mention any prerequisites or limitations beyond 'open' databases, which is inherent in the wording. For a list tool with an output schema, this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description does not need to explain any parameter semantics, and the schema is empty with 100% coverage. No additional parameter guidance is necessary.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: listing all open databases with metadata, including opening/analyzing status. It distinguishes from siblings like list_targets (which lists targets) and open_database (which opens a database). The verb 'List' and resource 'all open databases' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives. It does not mention that it only covers open databases (which is implied) or that list_targets should be used for targets. No exclusions, conditions, or recommended contexts are given, leaving the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_targetsList TargetsA

List available targets (processors, loaders, languages, etc.).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The verb 'List' conveys a read-only enumeration behavior, and 'available' suggests the result set is context-dependent. However, the description does not explain how availability is determined, what exactly counts as a target, or any behavior beyond returning a list. Since annotations provide no readOnlyHint or other safety signals, the description bears most of the burden but only partially fulfills it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no wasted words. The core action and object are front-loaded, and the parenthetical adds clarifying examples without bloating the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless list tool with an output schema present, little else is strictly required. The description names the target categories and implies an enumeration, which is enough for an agent to call it. The main gap is the lack of usage context relative to sibling listing tools, but this is a minor omission for such a simple operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the schema has nothing to document and the description cannot add parameter-level meaning. Per the baseline for zero-parameter tools, this is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List available targets' and elaborates with examples ('processors, loaders, languages, etc.'). This clearly distinguishes it from siblings such as list_databases, since it targets a different object type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool instead of alternatives like list_databases or search_tools. The use case is only implied by the word 'List', but there is no explicit context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

open_databaseOpen DatabaseA

Open a binary or existing IDA database (.i64/.idb) for analysis.

Returns immediately with "opening": true — call wait_for_analysis before using other tools on this database. Re-opening an already-open database returns the existing worker.

Multiple binaries: use a separate subagent per binary. Each agent calls open_database then wait_for_analysis. Do NOT serialize open+wait calls — that blocks parallel loading.

force_new=True is destructive: deletes existing .i64/.idb and all prior analysis. Use only for stale/incompatible DBs.

Fat Mach-O: requires explicit fat_arch (e.g. arm64). Error lists available slices. Use distinct database_id per slice for concurrent analysis. fat_arch must be omitted for non-fat files and existing databases.

ParametersJSON Schema
NameRequiredDescriptionDefault
loaderNoIDA loader (e.g. "ELF", "PE", "Binary file"). Auto-detected when omitted. See list_targets.
optionsNoExtra IDA CLI arguments. Do not duplicate processor/loader/base_address flags here.
fat_archNoMach-O fat slice (``x86_64``, ``arm64``, etc.). Required for fat binaries; must be omitted for thin files and existing databases.
file_pathYesPath to the binary file or IDA database.
force_newNoDelete existing DB files and start fresh.
keep_openNoKeep other open databases (default True).
processorNoIDA processor module (e.g. ``metapc``, ``arm``, ``mips``). Auto-detected when omitted. **ARM:** defaults to AArch64 — use ``arm:ARMv7-M`` for Cortex-M, ``arm:ARMv7-A`` for 32-bit. Use list_targets to see options.
database_idNoCustom ID (must match [a-z][a-z0-9_]{0,31}).
base_addressNoBase address for raw binaries (hex/decimal, 16-byte aligned). Ignored for structured formats.
run_auto_analysisNoRun IDA auto-analysis after opening.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are minimal (title only), so the description carries the full behavioral burden. It discloses the immediate return with opening:true, the need to wait, re-opening returning the existing worker, the destructive effect of force_new, and fat-arch requirements. This is far beyond what the annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into short, bolded sections that each carry distinct operational guidance. There is no filler; every sentence contributes to correct invocation, including concurrency notes, destructive-force warning, and Mach-O edge cases.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with 10 parameters and an output schema, the description covers the critical behavioral contract: return semantics, sequencing with wait_for_analysis, concurrency model, destructive flag, fat-arch constraints, and re-opening behavior. The presence of an output schema means return-value details do not need to be repeated here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is already solid, but the description adds meaningful cross-parameter context: force_new deletes prior analysis, fat_arch must be omitted for thin/existing databases, distinct database_id values are needed for concurrent slices, and re-opening an open DB reuses the worker. These constraints are not fully inferable from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Open a binary or existing IDA database (.i64/.idb) for analysis.' It also distinguishes itself from the sibling wait_for_analysis by stating it returns immediately with opening:true and instructs the agent to wait before using other tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use and when-not-to-use guidance: call wait_for_analysis after opening, use a separate subagent per binary, do not serialize open+wait calls, and only use force_new for stale or incompatible databases. It also covers fat Mach-O handling and maps to sibling wait_for_analysis without confusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_databaseSave DatabaseA

Save the current database to disk (may take minutes for large DBs).

Specify database when multiple are open. Fails if the DB is not attached to the current session unless force=True. Progress notifications are sent every 5s during long saves.

ParametersJSON Schema
NameRequiredDescriptionDefault
flagsNo
forceNo
outfileNo
databaseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations contain only a title, so the description carries the full behavioral burden and delivers: it discloses a potentially long-running operation ('may take minutes for large DBs'), a specific failure condition (unattached DB unless force=True), and progress notification cadence (every 5s). It also makes the disk-write nature explicit given no destructiveHint/readOnlyHint exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each earning its place: core purpose, multi-DB guidance, failure-mode caveat, and progress behavior. The purpose is front-loaded and the length is proportional to the tool's complexity, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, duration, failure conditions, and two of four parameters, and an output schema exists to document return values. However, outfile and flags remain unexplained at 0% schema coverage, and with no safety annotations an agent cannot fully predict behavior without opening the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains 'database' (needed when multiple are open) and 'force' (overrides the attachment requirement), but 'outfile' and 'flags' are never described—a real gap for a save operation where outfile plausibly controls the destination path and flags is entirely opaque.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Save the current database to disk', which is unambiguous about what the tool does. It doesn't explicitly name sibling distinctions, but a save/persist operation is naturally distinct from siblings like open_database, close_database, list_databases, and execute.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete usage conditions: 'Specify *database* when multiple are open' and the force=True escape when the DB is not attached to the current session. This gives an agent actionable guidance on how to call it correctly, though it never explicitly mentions when to prefer an alternative—likely because no sibling performs saving.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_toolsA

Search hidden tools by regex (pinned tools excluded; use .* for all).

Returns one-line signatures by default. Use detail="detailed" for parameter schemas, or follow up with get_schema(tools=[...]).

Hidden tools must be called via call, batch, or execute — direct calls will fail because they are not in the client tool list.

ParametersJSON Schema
NameRequiredDescriptionDefault
detailNo'brief' (default) for a one-line signature + summary per tool, 'detailed' for parameter schemas as markdown, 'full' for complete JSON schemasbrief
patternYesRegex pattern to match against tool names, descriptions, and tags

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that pinned tools are excluded, that direct calls to hidden tools will fail, and that they must be called via call, batch, or execute. This is significant behavioral information beyond a simple search function, though it doesn't detail edge cases like regex matching nuances or performance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each with a distinct purpose: scope definition, output/detail guidance, and invocation warning. It is front-loaded with the core action and is entirely free of filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a simple two-parameter interface, an output schema (so return values are handled there), and the description covers the search scope, detail levels, and the critical invocation constraint. An agent has everything it needs to correctly search and then call hidden tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by explaining the default 'brief' output and the alternative of using detail='detailed' or get_schema for richer schemas, but the parameter descriptions in the schema already cover the meanings. It doesn't introduce new semantics beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Search hidden tools by regex', and adds a critical scoping detail (pinned tools excluded). It differentiates from siblings by implying that get_schema is for schema retrieval, not search, and that call/batch/execute are for invocation. This leaves no ambiguity about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: it explains how to use the detail parameter and suggests get_schema as a follow-up for full schemas. It also warns that hidden tools must be invoked via call, batch, or execute, and that direct calls will fail. While it doesn't explicitly contrast with list_targets or list_databases, the primary usage scenario is well-defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_analysisWait for AnalysisA

Block until database(s) finish opening and optional auto-analysis.

Single: pass database to wait for one DB. Multi: pass databases list — returns when at least one is ready. Work on the ready one, call again for the rest.

While analysis runs, the backend thread is blocked — tool calls queue.

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseNoSingle database ID to wait for.
databasesNoList of database IDs (returns when first is ready).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no readOnly or destructive annotations, the description carries the behavioral disclosure burden. It explicitly reveals that the call blocks, that backend thread becomes blocked while analysis runs, and that tool calls queue during that time. It also discloses the subtle 'at least one' multi-database return condition, which is not inferable from the schema alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, well-organized with bold single/multi sections, and every sentence contributes useful information. The core behavior is front-loaded, and the concurrency warning is placed at the end without unnecessary filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the schema, output schema, and the provided behavioral notes, the description is largely complete for correct invocation. The main gap is that neither parameter is required, but the description does not state what happens if both 'database' and 'databases' are omitted or how conflicts between them are resolved.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents both parameters at 100% coverage, so the baseline is 3. The description adds practical meaning beyond the schema by mapping each parameter to a specific usage scenario: 'database' for single and 'databases' for multi. It clarifies the intended interaction pattern but does not add new constraints or format details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Block' and clearly identifies the resource: database(s) finishing opening and optional auto-analysis. It distinguishes itself from siblings by defining wait behavior rather than open/save/close actions, and it explicitly covers single vs multi-database semantics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear instructions for the two invocation patterns: pass 'database' for one DB and pass 'databases' for multiple, returning when at least one is ready. It also advises the caller to work on the ready one and call again for the rest. However, it does not explicitly name alternative tools or state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.1.0
    • First observedbatch
    • First observedcall
    • First observedclose_database
    • First observedexecute
    • First observedget_schema
    • First observedlist_databases
    • First observedlist_targets
    • First observedopen_database
    • First observedsave_database
    • First observedsearch_tools
    • First observedwait_for_analysis

TDQS

A4.2/5.0

Scored across 11 tools

Disambiguation4/5

Most tools have clearly distinct roles: database lifecycle, target listing, and tool discovery are well-separated. The main ambiguity is between call, batch, and execute, which all invoke tools, but the descriptions provide enough use-case distinction to guide selection.

Naming Consistency4/5

The naming mostly follows a clear verb_noun snake_case pattern (open_database, save_database, list_databases, search_tools). The meta-tools deviate with bare verbs (execute, batch, call), and there is minor singular/plural inconsistency, but the pattern is still predictable overall.

Tool Count5/5

11 tools is well within the ideal range for a purpose-built server. Each tool serves a necessary role: database lifecycle management, target discovery, hidden tool access, and execution orchestration. No tool feels redundant or superfluous.

Completeness4/5

The visible surface covers the full database lifecycle (open, wait, save, close, list) and provides meta-tools to discover and invoke hidden analysis tools. The only minor gap is that direct analysis operations are not visible in the pinned tool list, but this is clearly intentional and workable through search_tools/call/batch/execute.

Maintenance

ActivityMaintained
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that allows LLMs to autonomously reverse engineer applications by exposing Ghidra functionality, enabling decompilation, analysis, and automatic renaming of methods and data.
    10,026
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that allows LLMs to autonomously reverse engineer applications by exposing Ghidra's functionality, including decompiling binaries, analyzing code, and renaming methods and data.
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    An Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through MCP-compatible clients.
    Apache 2.0
  • F
    license
    Not graded
    quality
    D
    maintenance
    A PyGhidra-based MCP server that exposes Ghidra's reverse engineering capabilities to AI agents, enabling binary analysis via tools like overview, search, view, list, edit, script execution, and version control.
    1
    -