re-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@re-mcpdecompile the function at address 0x401000"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
RE-MCP
A multi-backend reverse-engineering MCP server. Exposes binary analysis capabilities from IDA Pro and Ghidra over the Model Context Protocol, letting LLMs drive reverse-engineering tools directly. Supports multiple simultaneous databases through a supervisor/worker architecture.
Both backends are standalone servers, not plugins. They use headless APIs (idalib for IDA, pyghidra for Ghidra) to run analysis engines without a GUI.
Backends
Backend | Package | Requirements |
IDA Pro | IDA Pro 9+ with a valid license | |
Ghidra | Ghidra 12+, JDK 21+ |
Both backends share a common tool interface — core analysis tools use the same names, parameters, and response shapes — so LLM workflows are portable across backends. Each backend also has tools for platform-specific features (e.g. IDA: file region mapping, executable rebuilding, IDC evaluation, IDAPython scripting; Ghidra: Function ID analysis, data type archives).
Related MCP server: GhidraMCP
Requirements
Python 3.12+
uv package manager (recommended) or pip
macOS, Windows, or Linux
At least one supported backend installed on the same machine
Installation
Install individual backend packages directly, or install re-mcp and select a backend with --backend:
# Individual backend packages (each provides its own CLI)
uv tool install re-mcp-ida
uv tool install re-mcp-ghidra
# Or install the core package and use --backend to select
uv tool install re-mcp --with re-mcp-ida --with re-mcp-ghidraWith pip:
pip install re-mcp-ida # IDA only
pip install re-mcp-ghidra # Ghidra only
pip install re-mcp re-mcp-ida re-mcp-ghidra # Unified CLI with both backendsFrom source
git clone https://github.com/jtsylve/ida-mcp && cd ida-mcp
uv syncOr with pip:
git clone https://github.com/jtsylve/ida-mcp && cd ida-mcp
pip install -e packages/re-mcp-core -e packages/re-mcp-ida -e packages/re-mcp-ghidraFinding IDA Pro
The IDA backend looks for your IDA Pro installation in the following order:
IDADIRenvironment variable — checked first; set this if IDA is in a non-standard location.IDA's own config file —
Paths.ida-install-dirin~/.idapro/ida-config.json(macOS/Linux) or%APPDATA%\Hex-Rays\IDA Pro\ida-config.json(Windows). If theIDAUSRenvironment variable is set, it is used as the config directory instead.Platform-specific default paths:
Platform | Default search paths |
macOS |
|
Windows |
|
Linux |
|
The idapro package is loaded at runtime directly from your local IDA Pro installation — no extra setup steps or environment variables are needed if IDA is installed in a standard location.
Finding Ghidra
The Ghidra backend looks for your Ghidra installation in the following order:
GHIDRA_INSTALL_DIRenvironment variable — checked first; set this if Ghidra is in a non-standard location.Config file —
ghidra-install-dirin~/.ghidra/ghidra-config.json.Platform-specific default paths:
Platform | Default search paths |
macOS |
|
Windows |
|
Linux |
|
Usage
Running the server
Each backend has its own CLI, or use the unified re-mcp command with --backend:
# Individual backend CLIs
uvx re-mcp-ida
uvx re-mcp-ghidra
# Unified CLI (requires backend package installed alongside)
uvx --with re-mcp-ida re-mcp --backend ida
uvx --with re-mcp-ghidra re-mcp --backend ghidraBoth CLIs support the same subcommands:
Command | Description |
| Direct stdio mode — single-session, workers die on disconnect (default) |
| Stdio proxy that auto-spawns a persistent HTTP daemon |
| Start the HTTP daemon directly (for manual daemon management) |
| Gracefully shut down a running daemon |
| List installed backends (most useful with the unified |
The default mode runs a direct stdio server — the simplest transport, widely supported across MCP clients. Workers die when the client disconnects.
For persistent state across reconnections, use <backend> proxy. This mode auto-spawns a persistent HTTP daemon behind the scenes, handling port allocation and authentication transparently. Workers and database state survive client reconnections. The daemon shuts down automatically after 5 minutes of inactivity (configurable via <PREFIX>IDLE_TIMEOUT).
Running without installing
# Individual backend packages
IDADIR=/path/to/ida uvx re-mcp-ida
GHIDRA_INSTALL_DIR=/path/to/ghidra uvx re-mcp-ghidra
# Unified package
IDADIR=/path/to/ida uvx --with re-mcp-ida re-mcp --backend ida
GHIDRA_INSTALL_DIR=/path/to/ghidra uvx --with re-mcp-ghidra re-mcp --backend ghidra# Individual backend packages
$env:IDADIR = "C:\Program Files\IDA Professional 9.3"
uvx re-mcp-ida
$env:GHIDRA_INSTALL_DIR = "C:\ghidra_12.0.3_PUBLIC"
uvx re-mcp-ghidra
# Unified package
$env:IDADIR = "C:\Program Files\IDA Professional 9.3"
uvx --with re-mcp-ida re-mcp --backend idaMCP client configuration
Add to your MCP client config (e.g. Claude Desktop claude_desktop_config.json):
IDA backend:
{
"mcpServers": {
"ida": {
"command": "uvx",
"args": ["re-mcp-ida"]
}
}
}Ghidra backend:
{
"mcpServers": {
"ghidra": {
"command": "uvx",
"args": ["re-mcp-ghidra"]
}
}
}Both backends simultaneously:
{
"mcpServers": {
"ida": {
"command": "uvx",
"args": ["re-mcp-ida"]
},
"ghidra": {
"command": "uvx",
"args": ["re-mcp-ghidra"]
}
}
}Using the unified re-mcp CLI (when installed via uv tool install re-mcp --with re-mcp-ida):
{
"mcpServers": {
"ida": {
"command": "re-mcp",
"args": ["--backend", "ida"]
}
}
}If the backend command is installed on your PATH (e.g. via pip install), use it directly:
{
"mcpServers": {
"ida": {
"command": "re-mcp-ida"
}
}
}If the command isn't on your PATH, use the full path to the executable:
{
"mcpServers": {
"ida": {
"command": "/home/user/.pyenv/versions/<version>/bin/re-mcp-ida"
}
}
}If the backend (IDA or Ghidra) isn't in a default location, add the install directory via the env key:
{
"mcpServers": {
"ida": {
"command": "uvx",
"args": ["re-mcp-ida"],
"env": {
"IDADIR": "/path/to/ida"
}
},
"ghidra": {
"command": "uvx",
"args": ["re-mcp-ghidra"],
"env": {
"GHIDRA_INSTALL_DIR": "/path/to/ghidra"
}
}
}
}Connecting to a running daemon directly:
If you started the daemon manually with <backend> serve, the connection details (host, port, bearer token) are in the state file. Clients that support streamable HTTP can connect directly.
State file locations:
macOS:
~/Library/Application Support/<backend>/daemon.jsonLinux:
$XDG_STATE_HOME/<backend>/daemon.json(defaults to~/.local/state/<backend>/daemon.json)Windows:
%LOCALAPPDATA%\<backend>\daemon.json
Where <backend> is re-mcp-ida or re-mcp-ghidra.
{
"mcpServers": {
"ida": {
"type": "streamable-http",
"url": "http://127.0.0.1:<port>/mcp",
"headers": {
"Authorization": "Bearer <token>"
}
}
}
}Basic workflow
Open a binary — call
open_databasewith the path to a binary (or existing database file), thenwait_for_analysisto block until it is readyAnalyze — use the available tools (list functions, decompile, search strings, read bytes, etc.)
Close — call
close_databasewhen done (auto-saves by default)
Raw binaries must be in a writable directory since both backends create database files alongside them. When opening an existing database, the original binary does not need to be present.
Multi-database mode
Multiple databases can be open at the same time. By default, open_database keeps previously opened databases open. Pass keep_open=False to save and close databases owned by the current session before opening the new one. All tools except management tools (open_database, close_database, save_database, list_databases, wait_for_analysis, list_targets) require the database parameter (the stem ID returned by open_database or list_databases).
open_database("first.bin") # spawns worker (returns immediately)
wait_for_analysis(database="first") # blocks until ready
open_database("second.bin") # spawns second worker
wait_for_analysis(database="second") # blocks until ready
decompile_function(address="main", database="first") # targets first
close_database(database="second") # closes secondEnvironment variables
Each backend uses its own environment variable prefix (IDA_MCP_ or GHIDRA_MCP_). The table below uses <PREFIX> as a placeholder.
Backend installation:
Variable | Backend | Default | Description |
| IDA | (auto-detected) | Path to IDA Pro installation directory |
| Ghidra | (auto-detected) | Path to Ghidra installation directory |
Shared settings (replace <PREFIX> with IDA_MCP_ or GHIDRA_MCP_):
Variable | Default | Description |
| (unlimited) | Maximum simultaneous databases (clamped to 1-8 when set) |
|
| Logging level ( |
| (unset) | Directory for per-run log files. Each component logs to |
|
| Idle auto-shutdown timeout in seconds for auto-spawned daemons. Set to |
| (unset) | Set to |
| (unset) | Set to |
| (unset) | Set to |
IDA-only settings:
Variable | Default | Description |
| (unset) | Set to |
Tools
To keep token usage manageable, only common analysis tools and management tools are directly visible to clients. The rest are discoverable and callable through meta-tools:
search_tools— regex search over non-pinned tool names, descriptions, and tags (pinned tools are already visible).get_schema— parameter schemas and return shapes for tools by name.call— lightweight proxy for calling any tool by name, including hidden tools not in the client tool list.execute— sandboxed Python that chains multipleawait invoke(name, params)calls in a single round trip. Supportsasyncio.gatherfor parallel queries, loops, and conditional logic between calls.batch— sequential multi-tool execution with per-item error collection and progress reporting (up to 50 operations per call).
Management tools (open_database, close_database, save_database, list_databases, wait_for_analysis, list_targets) are always visible. Most must be called directly — save_database and list_databases are the exceptions, also callable through call, execute, and batch for use in multi-step workflows.
The full tool catalog spans these areas:
Database — open/close/save/list databases, file region mapping, metadata
Functions — list, query, decompile, disassemble, rename, prototypes, chunks, stack frames
Decompiler — pseudocode variable renaming/retyping, decompiler comments, microcode
Ctree — AST exploration and pattern matching
Cross-References — xref queries, call graphs, xref creation/deletion
Imports & Exports — imported functions, exported symbols, entry point listing and manipulation
Search — string extraction, byte patterns, text in disassembly, immediate values, string-to-code references, string list rebuilding
Types & Structures — local types, structs, enums, type parsing and application, source declarations
Instructions & Operands — decode instructions, resolve operand values, change operand display format
Control Flow — basic blocks, CFG edges, switch/jump tables
Data — raw byte reading, hex dumps, segment listing, pointer tables
Patching — byte patching, instruction assembly, function/code creation, data loading
Data Definition — define bytes, words, dwords, qwords, floats, doubles, strings, and arrays
Segments — create, modify, and rebase segments
Names & Comments — rename addresses, manage comments (get, set, and append)
Demangling — C++ symbol name demangling
Analysis — auto-analysis, fixups, exception handlers, segment registers
Address Metadata — source line numbers, analysis flags, library item marking
Register Tracking — register and stack pointer value tracking
Register Variables — register-to-name mappings within functions
Signatures — FLIRT signatures/type libraries (IDA), Function ID/data type archives (Ghidra)
Export — batch decompilation/disassembly, output file generation
Snapshots — take, list, and restore database snapshots
Processor — architecture info, register names, instruction classification
Bookmarks — marked-position management
Colors — address/function coloring
Undo — undo/redo operations
Directory Tree — folder organization
Utility — number conversion, expression evaluation, scripting
All tools include MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so clients can distinguish safe reads from mutations and prompt for confirmation on destructive operations. Mutation tools return old values alongside new values for change tracking.
See docs/tools.md for the complete tools reference.
Resources
The server exposes MCP resources — read-only, cacheable endpoints for structured database context:
Static binary data — imports, exports, entry points (with regex search variants)
Aggregate snapshot — statistics (function/segment/entry point/string/name counts, code coverage)
Supervisor —
<scheme>://databaseslists all open databases with worker state
The URI scheme is ida:// for the IDA backend and ghidra:// for the Ghidra backend.
Prompts
The server provides MCP prompts — guided workflow templates that instruct the LLM to use tools in a structured sequence. Prompts are currently available for the IDA backend only.
survey_binary— binary triage producing an executive summaryanalyze_function— full single-function analysis with decompilation, data flow, and behavior summarydiff_before_after— preview the effect of renaming/retyping on decompiler outputclassify_functions— categorize functions by behavioral patternfind_crypto_constants— scan for known cryptographic constantsauto_rename_strings— suggest function renames based on string referencesapply_abi— apply known ABI type information to identified functionsexport_idc_script— generate a script that reproduces user annotations
Architecture
The project is a monorepo with three packages:
re-mcp-core— shared supervisor infrastructure, transport, and common utilitiesre-mcp-ida— IDA Pro backendre-mcp-ghidra— Ghidra backend
See docs/architecture.md for detailed architecture documentation.
Development
# With uv (recommended)
uv sync # Install dependencies
uv run ruff check packages/ # Lint
uv run ruff format packages/ # Format
uv run ruff check --fix packages/ # Lint with auto-fix
# With pip
pip install -e packages/re-mcp-core -e packages/re-mcp-ida -e packages/re-mcp-ghidra
pip install pre-commit pytest pytest-asyncio ruff jsonschema
ruff check packages/
ruff format packages/
ruff check --fix packages/Pre-commit hooks run REUSE compliance checks, ruff lint (with --fix --exit-non-zero-on-fix), ruff format, idalib threading lint, and pytest on every commit.
License
This project is dual-licensed under the MIT License and Apache License 2.0.
© 2026 Joe T. Sylve, Ph.D.
This project is REUSE compliant.
IDA Pro and Hex-Rays are trademarks of Hex-Rays SA. Ghidra is developed by the NSA. RE-MCP is an independent project and is not affiliated with or endorsed by Hex-Rays or the NSA.
Available Tools
11 toolsbatchA
Run 2+ independent tool calls in a single request with per-item error collection.
Preferred over execute for independent calls (no sandbox overhead).
Examples: decompile/disassemble N functions, rename N symbols, set N
comments, fetch N xrefs.
Use execute only when chaining one tool's output into another.
database is auto-injected into each operation — omit from params.
Override per-operation with explicit database for cross-DB work.
| Name | Required | Description | Default |
|---|---|---|---|
| database | Yes | Database to target (stem ID from open_database). Auto-injected into each operation's params. Individual operations can override by including `database` in their params. | |
| operations | Yes | List of tool calls to execute sequentially (max 50). | |
| stop_on_error | No | Stop on first error instead of continuing. |
Output Schema
| Name | Required | Description |
|---|---|---|
| failed | Yes | Number of failed operations. |
| results | Yes | Per-operation results. |
| cancelled | No | Whether batch stopped before completing all operations (stop_on_error or client cancellation). |
| succeeded | Yes | Number of successful operations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals key behaviors: per-item error collection, independent call execution, and auto-injection of the database parameter. While it does not explicitly state that operations execute sequentially (covered in the schema) or describe the exact return structure (output schema exists), the description adequately discloses the most critical behavioral traits for an agent to use the tool safely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise, using three short paragraphs. The main purpose is stated in the first sentence, followed by usage guidance and a note on database handling. Every sentence adds value without redundancy. It is front-loaded and well-organized, making it easy for an agent to quickly grasp the tool's function and when to use it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, array of operations, output schema), the description covers the essential aspects: purpose, usage, and database injection. It does not explicitly mention the maximum of 50 operations or sequential execution, but these are documented in the schema. The description is sufficient for an agent to correctly invoke the tool, especially since the schema provides the remaining details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds significant value by explaining the auto-injection behavior of `database` and how to override it for cross-database operations, which is not obvious from the schema alone. It also clarifies the 'independent' nature of operations, which complements the operations array schema. The description does not rehash the `stop_on_error` parameter, which is already described in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Run 2+ independent tool calls in a single request with per-item error collection.' It uses a specific verb ('run') and resource ('tool calls'), and explicitly differentiates from the sibling `execute` by mentioning it is preferred for independent calls. Concrete examples (decompile, rename, set comments, fetch xrefs) further clarify the intended use.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool vs. alternatives: 'Preferred over `execute` for independent calls' and 'Use `execute` only when chaining one tool's output into another.' It also instructs on parameter handling ('`database` is auto-injected into each operation — omit from params') and cross-database overrides, leaving no ambiguity about selection or invocation context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
callA
Call any tool by name, including hidden tools not in the client tool list.
Use for single hidden-tool calls. For multiple calls, prefer batch.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | Yes | Tool name to call. | |
| database | No | Database to target (stem ID from open_database). Auto-injected into arguments unless already present. | |
| arguments | No | Arguments to pass to the tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It does disclose key behaviors: it can call hidden tools, and it auto-injects the database parameter into arguments unless already present (via schema but also implied). It also implies single-call behavior. However, it does not describe what happens if a tool fails, error handling, or any side effects, leaving some gaps. Still, given the tool's meta nature, it covers essential aspects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, just two sentences. The primary purpose is front-loaded in the first sentence, and usage guidance follows immediately. Every word earns its place with no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity as a meta-tool with nested objects and an output schema, the description is fairly complete. It clarifies the main use case (single hidden-tool calls), the differentiation from batch, and the auto-injection behavior. However, it could benefit from a brief note on what the output schema represents (e.g., the result of the called tool) and how errors might be returned, but the output schema itself may cover return values. The absence of these details loses a point.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents all three parameters (tool, database, arguments). The description adds context about how the database parameter is auto-injected into arguments, which is additional value beyond the schema. However, it does not elaborate on the tool parameter's format or how arguments are structured. With full schema coverage, a baseline of 3 is appropriate, and the auto-injection note adds slight value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Call any tool by name, including hidden tools not in the client tool list.' It specifies the verb (call) and the resource (any tool by name), and distinguishes itself from batch for multiple calls. However, it does not explicitly differentiate from the sibling 'execute' or other calling mechanisms, so it loses one point for not naming alternatives beyond batch.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance: 'Use for single hidden-tool calls. For multiple calls, prefer **batch**.' This clearly indicates when to use this tool and names the alternative batch for multiple calls. It does not, however, mention other potentially relevant alternatives like execute or when not to use call, so it loses a point for not being more comprehensive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
close_databaseClose DatabaseA
Close a database and terminate its worker process.
Specify database when multiple are open. Fails if the DB is not attached to the current session unless force=True. When other sessions still use the DB, detaches this session but keeps the worker alive.
| Name | Required | Description | Default |
|---|---|---|---|
| save | No | ||
| force | No | ||
| database | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no meaningful annotations beyond the title, the description carries the full behavioral burden and does so well. It discloses the worker-process termination, the failure mode when the DB is not attached unless force=True, and the detach-but-keep-worker-alive behavior for multi-session cases. It does not mention the save parameter's effect, but the core side effects are clearly presented.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, with the primary action in the first sentence and supporting conditional behavior in three short follow-up sentences. Every sentence adds information, and there is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential invocation context: which database argument to provide, when force is needed, and what happens with concurrent sessions. Since an output schema exists, return values need not be described. The only notable gap is the undocumented save parameter, which could affect whether close persists or discards changes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for all three parameters. It explains database ('specify when multiple are open') and force ('unless force=True'), but save is never described. This is a meaningful but incomplete compensation for the schema's lack of parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-object pair, 'close a database and terminate its worker process', which makes the action unambiguous. It also clearly distinguishes this tool from siblings like open_database, save_database, and list_databases by focusing on closure and process termination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear conditions for use: specify database when multiple are open, force=True to override the attached-session requirement, and behavior when other sessions still use the database. It does not explicitly name alternative tools or say 'use save_database instead', but the context is strong enough for an agent to decide when this tool applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
executeA
Run Python code that chains tool calls. Use await invoke(name, params) to call tools; use return to produce output.
database is auto-injected into every invoke — omit it from params. Override per-call with explicit database for cross-database work.
When NOT to use execute
Single tool call → use the call meta-tool (or the direct tool if pinned).
N independent calls → use
batch(lower overhead, per-item errors). → Otherwise, use the batch meta-tool for sequential multi-tool execution with per-item error collection and progress reporting.Check if a tool has a built-in batch parameter first (e.g. get_strings
filters=[...]).
When to use execute
Multi-step pipelines — chaining one tool's output into another:
decomp = await invoke("decompile_function", {"address": "0x1234"})
addrs = re.findall(r'sub_([0-9A-Fa-f]+)', decomp["pseudocode"])
xrefs = [await invoke("get_xrefs_to", {"address": f"0x{a}"}) for a in addrs]
return {"decomp": decomp, "xrefs": xrefs}Cross-database parallel queries — use asyncio.gather with explicit database params. Same-database calls are serialized by the worker.
Reference
Blocked tools: open_database, close_database, wait_for_analysis, list_targets, and meta-tools (search_tools, get_schema, execute, batch, call) must be called directly. save_database and list_databases are allowed.
Addresses are strings: "0x401000", "4010a0", or symbol names.
filter_pattern is Python regex — use
re.escape()for literals.Available imports: asyncio, collections, functools, itertools, json, math, operator, re, struct, typing. No FS/network I/O.
Paginated results have
items,total,offset,limit,has_more— always checkhas_more.Use
get_schema(tools=[...])to look up parameter names and types.Return only what you need — filter before returning to save context.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Python async code to execute tool calls via invoke(name, arguments) | |
| database | Yes | Database to target (stem ID from open_database). Available as `database` variable in code and auto-injected into invoke params. Individual calls can override by passing `database` explicitly. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. It discloses important behavioral traits: database auto-injection, blocked tools, allowed imports, prohibition of FS/network I/O, paginated result shape, and the requirement to check has_more. This is far beyond a minimal summary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every section earns its place: main usage, examples, exclusions, reference constraints. It is well-structured with clear headings and code blocks, ensuring an agent can quickly extract the rules that matter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity and the absence of annotations and output schema, the description is exceptionally complete. It covers when to use, when not to use, parameter behavior, execution environment, tool-blocking rules, and result conventions. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds substantial meaning: database is auto-injected into invoke and can be overridden, code is Python async code, plus practical details like address formats, Python regex for filter_pattern, and available imports. This greatly aids correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Run Python code that chains tool calls.' It clearly distinguishes itself from siblings by positioning execute as the multi-step pipeline meta-tool, with explicit contrast to call and batch.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description has a dedicated 'When NOT to use execute' section naming alternatives (call, batch, built-in batch parameters) and a 'When to use execute' section with concrete scenarios (multi-step pipelines, cross-database parallel queries). This gives the agent unambiguous routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_schemaA
Get parameter schemas for specific tools by name (pinned and hidden).
Use after search_tools or before execute/batch to check parameter
types and return shapes. Pass detail="full" for complete JSON schemas.
Hidden tools must be called via call, batch, or execute — direct calls will fail because they are not in the client tool list.
| Name | Required | Description | Default |
|---|---|---|---|
| tools | Yes | Tool names to get schemas for. | |
| detail | No | 'brief' for a one-line signature + summary per tool, 'detailed' for parameter schemas as markdown (default), 'full' for complete JSON schemas | detailed |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden. It discloses meaningful behavioral details: the nuance of detail levels, that hidden tools are included, and that direct calls to hidden tools fail unless routed through call, batch, or execute. It does not cover unknown-tool error behavior, but the output schema covers return structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: one sentence for purpose, one for workflow context, one for an important parameter tip, and one for the hidden-tool caveat. Every sentence earns its place and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity, the description covers purpose, workflow placement, and the critical hidden-tool caveat. Since an output schema exists, the description does not need to explain return values. A small gap is that 'pinned' is never defined, but this is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The description adds only a usage hint ('Pass detail="full"'), which is helpful but not extra semantic meaning beyond the enum documentation. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Get parameter schemas for specific tools by name.' It further narrows scope to 'pinned and hidden' tools and positions itself relative to search_tools and execute/batch, so an agent can clearly distinguish it from siblings without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit workflow placement: 'Use after search_tools or before execute/batch to check parameter types and return shapes.' It also provides a when-not and alternative behavior for hidden tools by stating that direct calls will fail and that call, batch, or execute must be used instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesList DatabasesA
List all open databases with metadata (includes opening/analyzing status).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds useful behavioral context by noting that metadata includes opening/analyzing status. However, with no annotations like readOnlyHint or destructiveHint, the description carries the full burden of disclosing side effects. It does not explicitly state that the operation is read-only or that it has no side effects, though 'List' implies it. The added metadata detail is valuable but insufficient for full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the action and resource. It includes relevant detail about metadata without any fluff or redundancy. Every word earns its place, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters) and the presence of an output schema, the description is largely complete. It clearly states what the tool does and the key additional detail about status. It does not mention any prerequisites or limitations beyond 'open' databases, which is inherent in the wording. For a list tool with an output schema, this is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description does not need to explain any parameter semantics, and the schema is empty with 100% coverage. No additional parameter guidance is necessary.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: listing all open databases with metadata, including opening/analyzing status. It distinguishes from siblings like list_targets (which lists targets) and open_database (which opens a database). The verb 'List' and resource 'all open databases' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool versus alternatives. It does not mention that it only covers open databases (which is implied) or that list_targets should be used for targets. No exclusions, conditions, or recommended contexts are given, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_targetsList TargetsA
List available targets (processors, loaders, languages, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The verb 'List' conveys a read-only enumeration behavior, and 'available' suggests the result set is context-dependent. However, the description does not explain how availability is determined, what exactly counts as a target, or any behavior beyond returning a list. Since annotations provide no readOnlyHint or other safety signals, the description bears most of the burden but only partially fulfills it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no wasted words. The core action and object are front-loaded, and the parenthetical adds clarifying examples without bloating the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with an output schema present, little else is strictly required. The description names the target categories and implies an enumeration, which is enough for an agent to call it. The main gap is the lack of usage context relative to sibling listing tools, but this is a minor omission for such a simple operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the schema has nothing to document and the description cannot add parameter-level meaning. Per the baseline for zero-parameter tools, this is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List available targets' and elaborates with examples ('processors, loaders, languages, etc.'). This clearly distinguishes it from siblings such as list_databases, since it targets a different object type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool instead of alternatives like list_databases or search_tools. The use case is only implied by the word 'List', but there is no explicit context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_databaseOpen DatabaseA
Open a binary or existing IDA database (.i64/.idb) for analysis.
Returns immediately with "opening": true — call
wait_for_analysis before using other tools on this database.
Re-opening an already-open database returns the existing worker.
Multiple binaries: use a separate subagent per binary. Each agent calls open_database then wait_for_analysis. Do NOT serialize open+wait calls — that blocks parallel loading.
force_new=True is destructive: deletes existing .i64/.idb and all prior analysis. Use only for stale/incompatible DBs.
Fat Mach-O: requires explicit fat_arch (e.g. arm64).
Error lists available slices. Use distinct database_id per
slice for concurrent analysis. fat_arch must be omitted for
non-fat files and existing databases.
| Name | Required | Description | Default |
|---|---|---|---|
| loader | No | IDA loader (e.g. "ELF", "PE", "Binary file"). Auto-detected when omitted. See list_targets. | |
| options | No | Extra IDA CLI arguments. Do not duplicate processor/loader/base_address flags here. | |
| fat_arch | No | Mach-O fat slice (``x86_64``, ``arm64``, etc.). Required for fat binaries; must be omitted for thin files and existing databases. | |
| file_path | Yes | Path to the binary file or IDA database. | |
| force_new | No | Delete existing DB files and start fresh. | |
| keep_open | No | Keep other open databases (default True). | |
| processor | No | IDA processor module (e.g. ``metapc``, ``arm``, ``mips``). Auto-detected when omitted. **ARM:** defaults to AArch64 — use ``arm:ARMv7-M`` for Cortex-M, ``arm:ARMv7-A`` for 32-bit. Use list_targets to see options. | |
| database_id | No | Custom ID (must match [a-z][a-z0-9_]{0,31}). | |
| base_address | No | Base address for raw binaries (hex/decimal, 16-byte aligned). Ignored for structured formats. | |
| run_auto_analysis | No | Run IDA auto-analysis after opening. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are minimal (title only), so the description carries the full behavioral burden. It discloses the immediate return with opening:true, the need to wait, re-opening returning the existing worker, the destructive effect of force_new, and fat-arch requirements. This is far beyond what the annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is organized into short, bolded sections that each carry distinct operational guidance. There is no filler; every sentence contributes to correct invocation, including concurrency notes, destructive-force warning, and Mach-O edge cases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 10 parameters and an output schema, the description covers the critical behavioral contract: return semantics, sequencing with wait_for_analysis, concurrency model, destructive flag, fat-arch constraints, and re-opening behavior. The presence of an output schema means return-value details do not need to be repeated here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is already solid, but the description adds meaningful cross-parameter context: force_new deletes prior analysis, fat_arch must be omitted for thin/existing databases, distinct database_id values are needed for concurrent slices, and re-opening an open DB reuses the worker. These constraints are not fully inferable from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Open a binary or existing IDA database (.i64/.idb) for analysis.' It also distinguishes itself from the sibling wait_for_analysis by stating it returns immediately with opening:true and instructs the agent to wait before using other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-to-use and when-not-to-use guidance: call wait_for_analysis after opening, use a separate subagent per binary, do not serialize open+wait calls, and only use force_new for stale or incompatible databases. It also covers fat Mach-O handling and maps to sibling wait_for_analysis without confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_databaseSave DatabaseA
Save the current database to disk (may take minutes for large DBs).
Specify database when multiple are open. Fails if the DB is not attached to the current session unless force=True. Progress notifications are sent every 5s during long saves.
| Name | Required | Description | Default |
|---|---|---|---|
| flags | No | ||
| force | No | ||
| outfile | No | ||
| database | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations contain only a title, so the description carries the full behavioral burden and delivers: it discloses a potentially long-running operation ('may take minutes for large DBs'), a specific failure condition (unattached DB unless force=True), and progress notification cadence (every 5s). It also makes the disk-write nature explicit given no destructiveHint/readOnlyHint exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each earning its place: core purpose, multi-DB guidance, failure-mode caveat, and progress behavior. The purpose is front-loaded and the length is proportional to the tool's complexity, with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, duration, failure conditions, and two of four parameters, and an output schema exists to document return values. However, outfile and flags remain unexplained at 0% schema coverage, and with no safety annotations an agent cannot fully predict behavior without opening the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains 'database' (needed when multiple are open) and 'force' (overrides the attachment requirement), but 'outfile' and 'flags' are never described—a real gap for a save operation where outfile plausibly controls the destination path and flags is entirely opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Save the current database to disk', which is unambiguous about what the tool does. It doesn't explicitly name sibling distinctions, but a save/persist operation is naturally distinct from siblings like open_database, close_database, list_databases, and execute.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete usage conditions: 'Specify *database* when multiple are open' and the force=True escape when the DB is not attached to the current session. This gives an agent actionable guidance on how to call it correctly, though it never explicitly mentions when to prefer an alternative—likely because no sibling performs saving.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_toolsA
Search hidden tools by regex (pinned tools excluded; use .* for all).
Returns one-line signatures by default. Use detail="detailed"
for parameter schemas, or follow up with get_schema(tools=[...]).
Hidden tools must be called via call, batch, or execute — direct calls will fail because they are not in the client tool list.
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | 'brief' (default) for a one-line signature + summary per tool, 'detailed' for parameter schemas as markdown, 'full' for complete JSON schemas | brief |
| pattern | Yes | Regex pattern to match against tool names, descriptions, and tags |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that pinned tools are excluded, that direct calls to hidden tools will fail, and that they must be called via call, batch, or execute. This is significant behavioral information beyond a simple search function, though it doesn't detail edge cases like regex matching nuances or performance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each with a distinct purpose: scope definition, output/detail guidance, and invocation warning. It is front-loaded with the core action and is entirely free of filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a simple two-parameter interface, an output schema (so return values are handled there), and the description covers the search scope, detail levels, and the critical invocation constraint. An agent has everything it needs to correctly search and then call hidden tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by explaining the default 'brief' output and the alternative of using detail='detailed' or get_schema for richer schemas, but the parameter descriptions in the schema already cover the meanings. It doesn't introduce new semantics beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Search hidden tools by regex', and adds a critical scoping detail (pinned tools excluded). It differentiates from siblings by implying that get_schema is for schema retrieval, not search, and that call/batch/execute are for invocation. This leaves no ambiguity about the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: it explains how to use the detail parameter and suggests get_schema as a follow-up for full schemas. It also warns that hidden tools must be invoked via call, batch, or execute, and that direct calls will fail. While it doesn't explicitly contrast with list_targets or list_databases, the primary usage scenario is well-defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_for_analysisWait for AnalysisA
Block until database(s) finish opening and optional auto-analysis.
Single: pass database to wait for one DB.
Multi: pass databases list — returns when at least one
is ready. Work on the ready one, call again for the rest.
While analysis runs, the backend thread is blocked — tool calls queue.
| Name | Required | Description | Default |
|---|---|---|---|
| database | No | Single database ID to wait for. | |
| databases | No | List of database IDs (returns when first is ready). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no readOnly or destructive annotations, the description carries the behavioral disclosure burden. It explicitly reveals that the call blocks, that backend thread becomes blocked while analysis runs, and that tool calls queue during that time. It also discloses the subtle 'at least one' multi-database return condition, which is not inferable from the schema alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, well-organized with bold single/multi sections, and every sentence contributes useful information. The core behavior is front-loaded, and the concurrency warning is placed at the end without unnecessary filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the schema, output schema, and the provided behavioral notes, the description is largely complete for correct invocation. The main gap is that neither parameter is required, but the description does not state what happens if both 'database' and 'databases' are omitted or how conflicts between them are resolved.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents both parameters at 100% coverage, so the baseline is 3. The description adds practical meaning beyond the schema by mapping each parameter to a specific usage scenario: 'database' for single and 'databases' for multi. It clarifies the intended interaction pattern but does not add new constraints or format details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Block' and clearly identifies the resource: database(s) finishing opening and optional auto-analysis. It distinguishes itself from siblings by defining wait behavior rather than open/save/close actions, and it explicitly covers single vs multi-database semantics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear instructions for the two invocation patterns: pass 'database' for one DB and pass 'databases' for multiple, returning when at least one is ready. It also advises the caller to work on the ready one and call again for the rest. However, it does not explicitly name alternative tools or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.1.0- First observed
batch - First observed
call - First observed
close_database - First observed
execute - First observed
get_schema - First observed
list_databases - First observed
list_targets - First observed
open_database - First observed
save_database - First observed
search_tools - First observed
wait_for_analysis
TDQS
Scored across 11 tools
Most tools have clearly distinct roles: database lifecycle, target listing, and tool discovery are well-separated. The main ambiguity is between call, batch, and execute, which all invoke tools, but the descriptions provide enough use-case distinction to guide selection.
The naming mostly follows a clear verb_noun snake_case pattern (open_database, save_database, list_databases, search_tools). The meta-tools deviate with bare verbs (execute, batch, call), and there is minor singular/plural inconsistency, but the pattern is still predictable overall.
11 tools is well within the ideal range for a purpose-built server. Each tool serves a necessary role: database lifecycle management, target discovery, hidden tool access, and execution orchestration. No tool feels redundant or superfluous.
The visible surface covers the full database lifecycle (open, wait, save, close, list) and provides meta-tools to discover and invoke hidden analysis tools. The only minor gap is that direct analysis operations are not visible in the pinned tool list, but this is clearly intentional and workable through search_tools/call/batch/execute.
Maintenance
Related MCP Connectors
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
MCP server for progressive tool usage at any scale (see https://klavis.ai)
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn MCP server that allows LLMs to autonomously reverse engineer applications by exposing Ghidra functionality, enabling decompilation, analysis, and automatic renaming of methods and data.10,026Apache 2.0
- AlicenseNot gradedqualityDmaintenanceAn MCP server that allows LLMs to autonomously reverse engineer applications by exposing Ghidra's functionality, including decompiling binaries, analyzing code, and renaming methods and data.Apache 2.0
- AlicenseNot gradedqualityDmaintenanceAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through MCP-compatible clients.Apache 2.0
- FlicenseNot gradedqualityDmaintenanceA PyGhidra-based MCP server that exposes Ghidra's reverse engineering capabilities to AI agents, enabling binary analysis via tools like overview, search, view, list, edit, script execution, and version control.1-