Skip to main content
Glama
I-CAN-hack
by I-CAN-hack

ghidra-mcp

An MCP server for Ghidra that executes Python snippets in Ghidra's PyGhidra scripting environment through a local Java plugin.

The Ghidra extension lives in ghidra_extension/. The Python MCP server lives in ghidra_mcp/.

Setup

Nix development shell

If you use Nix, enter the repository development shell first:

nix develop

Set GHIDRA_INSTALL_DIR to a Ghidra 12.1.2 installation.

Build the Ghidra extension

Standalone builds require JDK 21. Build the extension ZIP with:

./ghidra_extension/build.sh

The result is written to ghidra_extension/dist/.

Install a release

Download ghidra-mcp-<tag>.zip from the GitHub Releases page. In Ghidra, open File -> Install Extensions..., click the + button, and select the downloaded ZIP without extracting it. Restart Ghidra after installation.

Every pushed tag creates a GitHub Release with an Extension Manager-compatible ZIP attached. Regular pushes and pull requests also build the ZIP as a workflow artifact for testing.

Install and enable the plugin

For local development, build and install the extension into your Ghidra user directory:

./ghidra_extension/install.sh

Restart Ghidra, open File -> Configure... in CodeBrowser, and enable GhidraMcpPlugin. The plugin starts a loopback HTTP bridge on 127.0.0.1:18489.

Ghidra must be launched with PyGhidra support:

~/ghidra_12.1.2_PUBLIC/support/pyghidraRun

Configure your MCP client

For Codex, add the server globally:

codex mcp add ghidra -- uvx --from git+https://github.com/I-CAN-hack/ghidra-mcp.git ghidra-mcp

For other MCP clients, use an equivalent configuration, for example:

{
  "mcpServers": {
    "ghidra": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/I-CAN-hack/ghidra-mcp.git",
        "ghidra-mcp"
      ]
    }
  }
}

Related MCP server: PcmHackMCP

Tools

Tools and their input schemas are published directly by the MCP server. Their descriptions live with the implementations as Python docstrings.

The tool implementations and their Ghidra-side snippets are kept together under ghidra_mcp/tools/core/. New tools are detected automatically from its tools.py module when the server starts.

Available Tools

24 tools
address_infoA

Return address context in one lookup.

The response includes the resolved address, containing memory block,
symbols at the address, containing function, containing instruction,
containing data, and incoming/outgoing references.

Args:
    target: Address, exact label name, or exact function name to inspect.
    program: Required Ghidra project path or name to target.
ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
programYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden. It clearly indicates a read-only operation ('Return') and enumerates the response contents, giving the agent a good sense of what to expect. It does not mention error handling, permission requirements, or edge cases, but for a lookup tool this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: a one-sentence purpose statement, a list of response components, and clear parameter explanations. It is front-loaded with the main purpose and every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, the description covers both inputs and the output structure (though an output schema exists). It explains the response components and parameter formats. It lacks details on error cases or behavior when the target is not found, but the presence of an output schema mitigates this need.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must fully explain parameters. It does: 'target' is defined as an address, exact label name, or exact function name; 'program' is defined as the required Ghidra project path or name. Both parameters are clearly documented, exceeding what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns address context in one lookup, listing the specific components included (resolved address, memory block, symbols, function, instruction, data, references). This distinguishes it from siblings like decompile or xrefs by positioning it as a comprehensive single-call lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in one lookup' implies the tool is intended for when comprehensive address context is needed, suggesting it as an alternative to making multiple focused calls (e.g., xrefs for references). However, it does not explicitly name alternatives or state when not to use it, so it stops short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyzeA

Run Ghidra auto-analysis for pending changes or the full program.

`scope="changes"` matches Ghidra's incremental analysis of pending work.
`scope="all"` schedules and runs analysis over the full program.

Args:
    program: Required Ghidra project path or name to target.
    scope: Either `changes` or `all`.
    timeout: Bridge execution timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
scopeNochanges
programYes
timeoutNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral disclosure burden. It usefully discloses incremental vs full-program behavior and introduces the Bridge timeout. However, it does not mention side effects on the Ghidra project, expected runtime, or whether analysis mutates state, leaving meaningful behavioral uncertainty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a clear two-line summary followed by a concise Args list. The key scope distinction is front-loaded, and every sentence earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter tool with an output schema and no annotations, the description covers the mechanics of scope, program, and timeout. It omits guidance on when to use this tool relative to siblings and does not set expectations about runtime or side effects, so an agent would still need to infer some context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema property descriptions are absent (0% coverage), but the description's Args section adds meaning for every parameter: program is a required project path/name, scope is limited to 'changes' or 'all', and timeout is in seconds. This compensates well for the schema gap, though the program path format could be more specific.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Run Ghidra auto-analysis' for pending changes or the full program. It clearly states what the tool does and distinguishes it at a high level from siblings like decompile or disassemble, though it does not explicitly name those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to choose scope='changes' vs scope='all' and identifies the required program target. However, it never states when to use analyze instead of sibling tools such as execute, decompile, or disassemble, nor whether analysis is a prerequisite for other operations. Usage is partly implied by 'pending changes' but not made explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

apply_typesA

Apply an existing datatype, or an array of it, at an address or label.

The datatype must already exist in the selected program's datatype manager;
create it first with `set_types` when needed. `data_type` can be an exact
datatype name or full datatype path. It may also include a simple array
suffix such as `uds27_dispatch_entry[8]`; otherwise pass `count` to create
an array. When `clear_existing` is true, conflicting code/data units across
the target byte range are cleared before the new data is created.

Args:
    target: Address or exact label where the data should be created.
    data_type: Existing datatype name/path, optionally with `[count]`.
    program: Required Ghidra project path or name to target.
    count: Number of elements to apply. Use 1 for a single item.
    clear_existing: Clear conflicting code/data over the byte range first.
    timeout: Bridge execution timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
countNo
targetYes
programYes
timeoutNo
data_typeYes
clear_existingNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It clearly warns that setting clear_existing to true will clear conflicting code/data over the byte range before creating new data. It also mentions the timeout. However, it does not explicitly state the default value of clear_existing (true in the schema) or what happens if clear_existing is false and conflicts exist, which is a minor gap given the destructive potential.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-sentence purpose, then a concise paragraph on key behaviors, followed by a bulleted Args list. Every sentence adds value, no fluff. It is structured so an agent can quickly grasp the purpose and parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers prerequisites, parameter semantics, and the main side-effect (clearing). An output schema exists, so return-value documentation is not needed. For a tool with six parameters and a mutation side-effect, this is complete enough for an agent to call it correctly and safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must fully compensate. It explains each parameter in a dedicated Args section: target, data_type (including array suffix semantics), program, count, clear_existing, and timeout. It adds meaning beyond the schema titles, such as the array-suffix option and the clearing behavior, which are critical for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb-resource-location statement: 'Apply an existing datatype, or an array of it, at an address or label.' It distinguishes itself from sibling set_types (which creates types) and get_types (retrieves) by focusing on application. This gives an agent an unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states a prerequisite and a routing rule: 'The datatype must already exist in the selected program's datatype manager; create it first with set_types when needed.' It also explains when to use the array suffix vs. the count parameter. This is precise guidance on when and how to use the tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clearA

Clear selected program metadata using Ghidra's Clear With Options command.

If `clear_types` is omitted or empty, every clear option is enabled,
matching a full Clear With Options selection. Otherwise, only the requested
`clear_types` are enabled. Supported values are:
`instructions`, `data`, `symbols`, `comments`, `properties`, `functions`,
`registers`, `equates`, `user_references`, `analysis_references`,
`import_references`, `default_references`, and `bookmarks`. `all` expands
to every clear type.

With a single `target`, this clears the code unit containing that address,
matching Clear With Options with no listing selection. With `end`, `length`,
or `ranges`, it clears over that selection.

Args:
    program: Required Ghidra project path or name to target.
    clear_types: Clear option names to enable exactly. Omit to clear all
        supported types.
    target: Address, exact label, or function name. Required unless
        `ranges` is supplied.
    end: Inclusive end address for a contiguous selection.
    length: Byte length for a contiguous selection starting at `target`.
    ranges: Optional list of range objects, each with `start` plus optional
        `end` or `length`, for non-contiguous selections.
    timeout: Bridge execution timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
lengthNo
rangesNo
targetNo
programYes
timeoutNo
clear_typesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses key behaviors: all clear types enabled if clear_types omitted, supported values, single-target vs range behavior, and the fact that a single target clears the containing code unit. It does not explicitly state irreversibility or side effects, but the 'clear' semantics are reasonably transparent for a metadata-removal tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured and front-loaded with purpose and behavior, followed by an Args list. It is longer than minimal but every sentence adds necessary detail, such as the list of clear types and selection semantics. No redundancy is present, though it could be slightly tightened without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 params, 1 required) and zero schema coverage, the description fully specifies all parameters, valid values, and edge cases. It explains selection behavior and default handling, and the presence of an output schema covers return-value expectations. No critical information for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate. It explains each parameter: program, clear_types with supported values and expansion of 'all', target required unless ranges supplied, end/length for contiguous selections, ranges for non-contiguous, and timeout. This adds substantial meaning beyond the raw schema, detailing valid values and selection logic.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool clears selected program metadata using Ghidra's Clear With Options command, with a specific verb and resource. It distinguishes from siblings like rename or comment by focusing on metadata removal. The purpose is unambiguous and not a tautology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to use the tool (single target vs ranges, clear_types omission semantics) but does not explicitly mention when to choose it over alternatives or when not to use it. It provides clear operational context but lacks exclusionary guidance or sibling comparison, which is a gap given the tool's destructive nature.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

commentA

Set a Ghidra comment at an address, label, or function.

The comment is written at the resolved address. Function names resolve to
the function entry point. Supported comment types match Ghidra's listing
comment slots: `plate`, `pre`, `eol`, `repeatable`, and `post`.

Args:
    target: Address, exact label, or function name to comment.
    text: Replacement comment text.
    program: Required Ghidra project path or name to target.
    comment_type: One of `plate`, `pre`, `eol`, `repeatable`, or `post`.
ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
targetYes
programYes
comment_typeNoplate

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and adds useful behavioral detail: comments are written at the resolved address, function names resolve to their entry point, and text is a replacement. It does not cover permissions or reversibility, but the core behavior is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded purpose, compact sentences, and a structured Args section. Every sentence contributes meaning without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, resolution behavior, comment types, and all parameters. Output schema exists, so return details are unnecessary. It could explicitly state that existing comments are overwritten, but 'Replacement comment text' implies it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the Args block fully compensates. It explains target types, the role of text, the required program, and enumerates allowed values for comment_type. This is more than what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Set'), a clear resource ('Ghidra comment'), and target scopes (address, label, function). It also enumerates comment types, which distinguishes it from sibling tools like clear and rename.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states when to use the tool (to set or replace a comment at a target), but it does not explicitly mention alternatives or exclusions. Sibling tools like 'clear' are not referenced, so the usage context is clear but not formally differentiated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_functionA

Create a function at target, optionally with a user-defined name.

If a function already starts at `target`, it is returned and renamed when a
`name` is provided. If `target` falls inside an existing function, no new
function is created and the containing function is returned.

When `target` is not yet an instruction, it is first disassembled in the
language's correct default ISA mode (PowerPC VLE, ARM Thumb-default, or
microMIPS), clearing any conflicting data, so entries are not mis-decoded
into broken boundaries.

Args:
    target: Address, exact label, or function name where the function
        should start.
    program: Required Ghidra project path or name to target.
    name: Optional user-defined function name.
ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
targetYes
programYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently explains the return behavior (existing function returned, renamed if name given), the no-op when target is inside an existing function, and the disassembly side effect of clearing conflicting data. This is thorough and prevents surprising outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed and well-structured, with a clear main sentence followed by edge-case explanations and a bulleted args section. It is somewhat long, but each sentence adds necessary behavioral context. The structure is front-loaded with the core action, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent to invoke the tool correctly. It covers return values, side effects, and the disassembly mode. Since an output schema exists, return format details are not required. No essential context is missing, making it self-sufficient for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so effectively: target is defined as an address, exact label, or function name; program is explicitly required as a Ghidra project path or name; name is described as an optional user-defined function name. This adds semantic meaning far beyond the schema's type-only definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's primary function — creating a function at a target address — and immediately explains edge cases: existing function at target (return and rename), target inside an existing function (return containing function), and disassembly behavior when target is not an instruction. This is a specific verb+resource description that uniquely identifies the operation and distinguishes it from siblings like decompile or disassemble.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the tool's behavior in detail but does not explicitly state when to use it over alternatives or when not to use it. Usage is implied (when you want to create a function), but there is no mention of sibling tools or conditions that would make another tool more appropriate. This falls under implied usage rather than explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decompileA

Decompile the function at or containing target.

Args:
    target: Value accepted by the bridge's `toAddr`, such as `0x401000`,
        `FUN_00401000`, or an exact label/function name. The function at or
        containing the resolved address is decompiled.
    program: Required Ghidra project path or name to target.
    timeout: Decompiler timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
programYes
timeoutNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It clarifies that addresses may be inside a function and that the containing function is resolved, and it mentions timeout behavior. It does not state side effects, whether analysis is triggered, or read-only guarantees, but the main behavior is adequately disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded purpose in the first sentence, followed by a tight Args block. Every sentence adds necessary information with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Combined with the output schema, the description covers purpose, parameter semantics, resolution behavior, and timeout. It could add an explicit comparison to disassemble, but nothing essential to correctly invoking the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully document parameters. It explains target with valid forms and resolution semantics, states that program is required, and defines timeout. This fully compensates for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Decompile the function at or containing target.' It also gives concrete address/label examples)Skip and clearly differentiates from reading raw bytes or disassembling by targeting functions, which positions it against sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides useful invocation context such as required program and accepted target forms, and implies use for decompiling functions. However, it does not explicitly state when to choose decompile over disassemble or other reading tools, and gives no when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

disassembleA

Mark an address or address selection as code using Ghidra disassembly commands.

Returns a compact text summary of the disassembled byte ranges.

With a single `target`, this behaves like the GUI Disassemble action at the
current location. With `end`, `length`, or `ranges`, it behaves like
invoking Disassemble with a listing selection. `restricted=True` uses the
same restricted-set behavior as Ghidra's Disassemble (Restricted) action.

`mode="default"` chooses the normal Ghidra disassembler, except for
architecture/language combinations where a more specific default is known:
PowerPC VLE languages default to VLE, ARM Thumb-default languages default
to Thumb, and MIPS microMIPS language variants default to their alternate
ISA mode.

Architecture-specific modes are available when supported by the selected
program language:
- `thumb` or `arm` for ARM/Thumb
- `vle` or `book-e`/`ppc` for PowerPC VLE languages
- `mips16` or `mips` for MIPS16/MicroMIPS-capable languages
- `xgate` or `hcs12` for HCS12/XGATE
- `x86_32` or `x86_64` for 32-bit compatibility disassembly in x86-64

Args:
    program: Required Ghidra project path or name to target.
    target: Address, exact label, or function name. Required unless
        `ranges` is supplied.
    end: Inclusive end address for a contiguous selection.
    length: Byte length for a contiguous selection starting at `target`.
    ranges: Optional list of range objects, each with `start` plus optional
        `end` or `length`, for non-contiguous selections.
    mode: Disassembly mode. Default uses Ghidra's normal Disassemble
        command, but resolves to architecture-specific defaults for
        PowerPC VLE, ARM Thumb-default, and MIPS microMIPS languages.
        Special modes include `thumb`, `vle`, `book-e`, `mips16`,
        `xgate`, and `x86_32`.
    restricted: Restrict disassembly flow to the supplied selection/range.
    enable_analysis: Submit new instructions for incremental analysis.
    timeout: Bridge execution timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
modeNodefault
lengthNo
rangesNo
targetNo
programYes
timeoutNo
restrictedNo
enable_analysisNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly. It discloses that the tool returns a compact text summary, mimics GUI Disassemble (including the Restricted variant), details default mode resolution across languages, and explains the enable_analysis and timeout parameters. It implies mutation (marking code) without saying 'modifies the program' explicitly, but the behavior is transparent enough for an agent to infer side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-organized: an intro, a behavior paragraph, a mode list, and an Args section. Every sentence adds value, and the front-loaded purpose and GUI analogy are immediately useful. It is slightly verbose for a tool with 9 parameters, but that length is justified given the complexity of modes and selection logic.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 9 parameters, an output schema, and complex mode selection, the description covers all invocation patterns, mode defaults, restricted behavior, and return format. It even handles edge cases like non-contiguous ranges via the ranges parameter. Nothing an agent needs to call it correctly is missing, and the output schema exists for return details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain every parameter. It does exactly that: program, target, end, length, ranges, mode, restricted, enable_analysis, and timeout are all described with their roles and constraints. The mode section even enumerates architecture-specific options with conditions. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Mark an address or address selection as code using Ghidra disassembly commands.' It clearly distinguishes this from siblings like decompile or list_instructions by framing it as the GUI Disassemble action. The return value is also stated, so an agent knows what to expect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on how to invoke the tool: single target vs. selection via end/length/ranges, and explains the restricted flag's behavior. It does not explicitly list when to use this versus alternatives like decompile or create_function, but the GUI analogy and mode details give strong situational guidance. A dedicated 'when not to use' clause is missing, so not a perfect 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

executeA

Execute a Python snippet in Ghidra's scripting environment.

The snippet runs inside Ghidra with full access to the Ghidra API via
PyGhidra.

Available variables:
- currentProgram: exactly one program, selected via the required
  `program` argument
- flat: FlatProgramAPI-compatible script object
- toAddr(value): convert an address, function, symbol, or exact
  function/label name to an Address
- Helpers: getBytes, getDataAt, getFunctionAt, getFunctionContaining,
  getInstructionAt, getReferencesTo, getReferencesFrom
- state, monitor: Ghidra script state and task monitor

All Ghidra Java classes can be imported, e.g.:
  from ghidra.program.model.symbol import SymbolType
  from ghidra.app.decompiler import DecompInterface

Modifications are auto-wrapped in a transaction.
Use print() to return output.

The response includes:
- output: stdout captured from the snippet
- stderr: stderr captured from the snippet
- error: traceback string if execution failed

Program selection is based on the current Ghidra project name/path, not
the original imported filename. Use `get_programs()` to discover available
open programs.

Args:
    code: Python code to execute in Ghidra.
    program: Required Ghidra project path or name to target.
    timeout: Bridge execution timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
codeYes
programYes
timeoutNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and succeeds: it discloses full API access, auto-wrapping of modifications in a transaction, captured stdout/stderr, traceback error reporting, and a timeout mechanism. It also clarifies how program targets are resolved, which is a meaningful behavioral nuance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but efficiently organized with clear sections, bulleted variables, import examples, output details, and an Args list. Every sentence earns its place; no filler or redundant restatement of the schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a flexible code-execution tool, the description covers everything an agent needs: available predefined variables, import mechanics, transaction behavior, output capture, error reporting, and program name resolution. The output schema is also explained by naming the response fields, so the agent can reliably invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does. It documents all three parameters in an Args section: code, program (including the caveat that it is a project path/name rather than the original imported filename), and timeout. It also enriches the program parameter with guidance to use get_programs() for discovery.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific statement: 'Execute a Python snippet in Ghidra's scripting environment.' It names the verb, resource, and mechanism, and clearly distinguishes this general-purpose execution tool from the other data-specific sibling tools like decompile, read_data, or rename.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete context on how to use the tool: run arbitrary Python with Ghidra API access, use print() for output, and expect response fields for stdout/stderr/error. It also warns about program selection being based on project path/name and points to get_programs() for discovery. It does not explicitly contrast against sibling tools, but the arbitrary-execution use case is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_programsA

List the open Ghidra programs and the one that is currently active.

Program identifiers are based on the current Ghidra project name/path, not the original imported filename.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral disclosure. It does disclose the key behavioral nuance about identifier naming (project name/path vs. imported filename), which is valuable. However, it does not describe the output format or whether the active program is marked in a specific way, leaving some behavioral details unspecified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loads the main purpose, and adds a clarifying detail about identifiers. Every sentence earns its place with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter listing tool, the description is largely complete. It explains what is listed and the naming nuance. The only minor gap is not describing the output schema structure, but since an output schema exists, the description needn't explain return values in detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description doesn't need to explain parameter semantics. The baseline for 0 params is 4, and the description appropriately focuses on what the tool returns rather than parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: listing open Ghidra programs and identifying the active one. It also provides a useful distinction about program identifiers being based on project name/path rather than the original imported filename, which helps avoid confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is a read-only listing tool with no parameters, and its context is clear for an agent needing to know what programs are open. However, it does not explicitly state when to use this tool versus alternatives, nor does it mention any prerequisites (e.g., Ghidra must be running with programs open).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_typesA

Return matching struct/enum type declarations as C header text.

The `name` argument is a glob that matches either the datatype name or full
datatype path. Examples: `*`, `IMAGE_*`, `/my/category/Foo`.

Both direct structs/enums and typedefs that alias a struct/enum are
included, so normal C header style type names work as expected. Exported
enums also include comment directives like
`/* ghidra-mcp enum-size: Name=1 */` so enum storage sizes can be
round-tripped through `set_types()`.

Args:
    program: Required Ghidra project path or name to target.
    name: Glob used to match one or more types. `*` returns all supported
        types in the selected program.
ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo*
programYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly explains inclusion of typedefs, enum comment directives, and glob matching behavior. It does not explicitly state that the operation is read-only, but the verb 'Return' and the output format make that obvious. It lacks details on error handling or empty results, but these are minor gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is multi-paragraph but every sentence contributes value. It front-loads the core purpose, then elaborates on glob matching, inclusion behavior, and enum directives. While a bit verbose, it is well-structured and not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity and the presence of an output schema, the description covers the essential call parameters and behaviors. It explains the matching semantics and output format, which is sufficient for an agent to invoke it correctly. Missing explicit error handling is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It thoroughly explains the 'name' parameter with glob examples and the '*' wildcard, but the 'program' parameter is only described as 'Required Ghidra project path or name to target' without elaboration on valid formats or how to discover it. This is partial compensation, not complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return'), a specific resource ('struct/enum type declarations'), and the output format ('C header text'). It also clarifies the matching mechanism via globs, which distinguishes it from sibling tools like set_types that write types. The purpose is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the read counterpart to set_types by mentioning round-tripping enum sizes, but it does not explicitly state when to use this tool versus alternatives, nor does it give exclusions or conditions. An agent would have to infer usage from context rather than receive direct guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

labelsA

Get matching labels or functions in the selected program.

The response is JSON containing the matched labels with their short names,
qualified namespace paths, symbol types, addresses, and function
signatures when applicable. Global data labels also include their
datatype.

Each entry also reports `namespace` (the qualified parent namespace, or
null for global symbols) and `namespace_type` (e.g. `Class`, `Namespace`,
`Function`, or `GLOBAL`). These come from the real Ghidra `Namespace`
object, so C++ class membership is reported accurately. Use this to list a
class's methods, e.g. `namespace="MyClass"` or `namespace="ns::*"`.

`kind="user"` returns user-defined symbols only. `kind="functions"` returns
all discovered functions, including analysis-created default names.
`kind="all"` returns both user-defined symbols and all functions.

Filter behavior (applies to both `filter` and `namespace`):
- `*` returns all labels
- If the value contains glob metacharacters (`*`, `?`, `[]`), glob matching
  is applied
- Otherwise, the value is treated as a case-sensitive substring

`filter` is matched against the symbol name, qualified name, and address.
`namespace` is matched against the qualified parent namespace.

Args:
    program: Required Ghidra project path or name to target.
    filter: Label filter expression. `*` returns all labels.
    kind: One of `user`, `functions`, or `all`.
    namespace: Parent-namespace filter. `*` returns labels in any
        namespace. Match against the qualified namespace, e.g. `MyClass`.
ParametersJSON Schema
NameRequiredDescriptionDefault
kindNouser
filterNo*
programYes
namespaceNo*

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the burden of behavioral disclosure. It explains the response format (JSON with specific fields), the source of namespace data (real Ghidra Namespace object), filter semantics (glob vs substring), and the meaning of 'kind' values. It is thorough and leaves no ambiguity about what the tool does or returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for response details, filter behavior, and arguments. It is longer than average but every sentence adds value; there is no fluff. The most critical information (what it does, filter behavior) is front-loaded, and the format is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent to correctly invoke the tool. It covers the response format, parameter details, filtering behavior, and the distinction between user labels and functions. Despite having an output schema, it still explains return fields in detail, ensuring the agent knows what to expect. No essential information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so comprehensively: 'program' is the required target, 'filter' is explained with glob and substring rules, 'kind' is defined with its three options, and 'namespace' is described with match behavior and examples. Every parameter is given meaningful semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's verb ('Get') and resource ('matching labels or functions in the selected program'). It distinguishes itself from siblings by covering both labels and functions, and from tools like 'rename' or 'namespaces' by its query/filter nature. The purpose is unambiguous and specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context, such as using namespace filters to list a class's methods and explaining the three 'kind' options (user, functions, all). It does not explicitly name alternatives or say 'use this instead of X', but the context of sibling tools makes the tool's role obvious. It lacks explicit exclusions but gives strong guidance on when to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_instructionsA

List disassembled instructions starting at an address or label.

The result is a compact, hexdump-style text view with one instruction per
line: address, raw bytes, and instruction text. Pass either `end` for an
inclusive address range or `length` for a byte count. `max_count` limits
returned instructions; use 0 or None for no instruction-count limit.

Args:
    target: Start address, exact label, or function name.
    program: Required Ghidra project path or name to target.
    end: Optional inclusive end address.
    length: Optional byte length from target.
    max_count: Maximum instructions to return. Use 0 or None for no limit.
ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
lengthNo
targetYes
programYes
max_countNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It does well by describing the hexdump-style output format, the inclusive end address, byte-count length, and the max_count behavior. It does not cover failure modes or what happens when no instructions are found, but the provided details are substantial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and output format, then moves to range options and parameter details. Every section earns its place, and the Args block is tidy and non-redundant given the schema has no descriptions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter tool with no annotations and no schema descriptions, the description covers the essential invocation details, output shape, and edge cases for max_count. It is nearly complete, but it would be stronger with an explicit contrast to the 'disassemble' sibling tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates. It explains each parameter in prose: target accepts an address, exact label, or function name; program is required; end is an inclusive address; length is a byte count; and max_count has explicit no-limit semantics via 0 or None.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists disassembled instructions starting at an address or label and describes the output format. It is specific about what the tool does, but it does not distinguish itself from the sibling tool 'disassemble', so it misses the top score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus the sibling 'disassemble' or other alternatives. The description does explain the choice between 'end' and 'length', but that is parameter-level guidance, not tool-selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memory_mapA

List memory blocks, or update permission flags for one memory block.

With no `target`, this returns every block in the program memory map with
address range, size, permissions, initialization state, source name, and
comment. With `target`, select a block either by exact block name or by an
address contained in the block. Passing any permission argument changes that
block's corresponding flag before returning the updated block record.

Args:
    program: Required Ghidra project path or name to target.
    target: Optional block name or address inside a block.
    read: Optional read permission value for the selected block.
    write: Optional write permission value for the selected block.
    execute: Optional execute permission value for the selected block.
    volatile: Optional volatile flag value for the selected block.
ParametersJSON Schema
NameRequiredDescriptionDefault
readNo
writeNo
targetNo
executeNo
programYes
volatileNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that passing any permission argument mutates the block's flag and that the tool returns the updated block record. It also clarifies the selection semantics (exact name or contained address). It does not mention side effects like persistence or reversibility, but the core read-vs-write behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a two-sentence summary followed by a compact Args list. Every sentence earns its place, and the dual-mode behavior is front-loaded. The Args list is slightly verbose but appropriate for six parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has six parameters, no annotations, and an output schema, so the description must cover both modes and parameter semantics. It does so adequately, including the return behavior for updates. It could mention what the list response contains, but the output schema likely covers that, and the description already names the fields returned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does. It explains the role of each parameter: program is the required target project, target selects a block, and read/write/execute/volatile are optional permission values. It also adds the crucial semantic that passing any permission argument changes the flag, which the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb-resource pair ('List memory blocks, or update permission flags for one memory block') and then details both modes. It clearly distinguishes the list-all behavior from the targeted-update behavior, which separates it from sibling tools like list_instructions or read_data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use each mode: no target returns all blocks, target selects a block by name or address, and passing a permission argument triggers an update. It does not explicitly name alternatives or exclusions, but the mode-based guidance is clear enough for an agent to decide when to call this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

namespacesA

List, create, or populate C++ namespaces and classes.

Namespaces and classes are real Ghidra `Namespace`/`GhidraClass` objects,
not name prefixes. Use this to recover C++ structure in stripped firmware:
create a class per recovered vtable, then move its methods into it.

Actions:
- `list`: return the namespaces and classes in the program as JSON, each
  with its qualified name, `type` (`Namespace`/`Class`/...), and member
  count. Filter with `filter` (substring or glob over name/qualified name).
- `create`: create the namespace or class at `path` (a `::`-separated path
  such as `MyClass` or `ns::sub::Inner`). Missing parent levels are created
  as plain namespaces. `kind="class"` makes the final level a `GhidraClass`
  (an existing plain namespace at that path is converted to a class);
  `kind="namespace"` makes it a plain namespace. Existing entries are
  reused, so this is idempotent.
- `move`: move the symbol at `target` (address, label, or function name)
  into `namespace` (created if missing, honoring `kind`). Functions are
  reparented; other symbols are moved with their name preserved.
- `type_methods`: for the class at `path`, set the first parameter of every
  function member to `<class> *this` (adding one if a method has none) so
  the decompiler propagates the class type. The class is created if missing.
  Methods already typed with the class pointer are left as-is. Reports
  `typed_methods` and `already_typed`. Use this to type a whole class at
  once instead of calling `set_prototype` per method.

Args:
    program: Required Ghidra project path or name to target.
    action: One of `list`, `create`, `move`, or `type_methods`.
    path: Namespace/class path for `create`/`type_methods`, e.g. `MyClass`
        or `a::b::C`.
    target: Symbol selector for `move` (address, label, or function name).
    namespace: Destination namespace/class path for `move`.
    kind: `namespace` or `class`; the kind of the final level that
        `create`/`move` resolves or creates.
    filter: Substring/glob filter for `list`. `*` returns everything.
ParametersJSON Schema
NameRequiredDescriptionDefault
kindNonamespace
pathNo
actionNolist
filterNo*
targetNo
programYes
namespaceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral disclosure burden. It explains side effects such as missing parent levels being created, existing entries being reused idempotently, namespaces being converted to classes, move behavior for functions versus other symbols, and the exact type_methods transformation including already-typed functions being left as-is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but appropriately so for a multi-action tool with seven parameters and no schema-level descriptions. It is front-loaded with the purpose and use case, followed by clear per-action details and an Args section. Every section adds necessary information without filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, the absence of annotations, and 0% schema description coverage, the description provides enough detail for an agent to select the right action and invoke it correctly. The output schema covers return values, so the description does not need to repeat them.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain every parameter. The Args section covers all seven parameters, including allowed action values, path syntax with examples, namespace kind semantics, and filter behavior. This goes well beyond the bare schema titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List, create, or populate C++ namespaces and classes', giving a specific verb and resource. It further disambiguates by noting these are real Ghidra objects, not name prefixes, and enumerates the four actions, making the tool's scope clear relative to siblings like labels or get_types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit use case: 'Use this to recover C++ structure in stripped firmware: create a class per recovered vtable, then move its methods into it.' It also explicitly contrasts type_methods with calling set_prototype per method. It does not exhaustively explain when not to use the tool versus every sibling, but the provided guidance is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_dataA

Read raw memory bytes or structured Ghidra data at an address or label.

Raw mode returns a hexdump/xxd-style text view that includes both hex bytes
and printable ASCII by default. Pass `format` such as `u32be` with `count`
to decode raw integer tables as JSON. Structured mode returns compact JSON
for the defined data at, or containing, the resolved address, preserving
struct fields, arrays, unions, and pointer pointees without the older
metadata wrapper. `concise` remains accepted as a legacy alias for
`structured`.

If `length` is omitted in raw mode, the tool uses the remaining size of the
selected defined data item when available, otherwise it defaults to 64
bytes. If `count` is provided for a typed raw format, `length` is ignored
and the byte count is derived from `count * item_size`. Supplying `length`,
`count`, or a non-default `format` implies raw mode, so callers do not also
need to set `mode="raw"`.

Args:
    target: Address, exact label name, or exact function name to inspect.
    program: Required Ghidra project path or name to target.
    mode: One of `structured` or `raw`. `concise` is accepted as a legacy
        alias for `structured`.
    length: Optional byte count for raw mode.
    format: Raw output format: `hexdump`, `u8`, `u16be`, `u16le`, `u32be`,
        `u32le`, `u64be`, `u64le`.
    count: Optional number of typed raw values to read.
ParametersJSON Schema
NameRequiredDescriptionDefault
modeNostructured
countNo
formatNohexdump
lengthNo
targetYes
programYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It thoroughly explains output formats (hexdump vs. JSON), the legacy 'concise' alias, default length behavior, the interaction between length/count/format, and the mode implication rules. This is comprehensive and leaves no significant behavioral ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence contributes essential information. It is front-loaded with the purpose and then systematically covers modes, defaults, and parameter details. While slightly verbose, it avoids redundancy and maintains a logical structure, earning a high but not perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (two modes, multiple formats, parameter interactions) and the absence of annotations, the description is exceptionally complete. It covers all necessary calling conventions, defaults, and output behavior, and because an output schema exists, it does not need to detail return structures. Nothing critical is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero description coverage (0%), so the description must fully compensate for all six parameters. It does so in the 'Args' section, defining target, program, mode, length, format, and count with specific meanings and acceptable values. This is a textbook example of parameter documentation exceeding schema limitations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('Read raw memory bytes or structured Ghidra data') with a resource ('an address or label'), distinguishing it from siblings like disassemble or decompile. It also immediately clarifies the two modes (raw and structured), leaving no ambiguity about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the description provides excellent guidance on when to use raw vs. structured mode internally, it does not explicitly compare this tool to sibling tools such as disassemble, decompile, or memory_map. An agent can infer when to use it from the purpose, but no alternatives or exclusions are named, so the guidance is implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

renameA

Rename a function, global label/variable, function argument, or local variable.

The target can be selected either with a compact typed selector or with the
`kind` and `function` arguments:
- `function:main` or `kind="function", target="main"`
- `global:g_counter` or `kind="global", target="0x404020"`
- `arg:#0@main`, `arg:argc@main`, or `kind="argument", function="main"`
- `local:uVar4@main` or `kind="local", function="main"`
- `var:name@main` or `kind="variable", function="main"` to match either
  an argument or local variable

For the decompiler's "Split Out As New Variable" behavior, pass
`split_at` with the instruction address of the variable occurrence to
isolate, for example `target="local:res@handler", new_name="did_index",
split_at="0x90003482"`. The split variable is type-locked the same way
Ghidra's UI action does, so the split survives the next decompile.

If `kind` is `auto` and no `function` is supplied, the target is first
treated as a function at/containing the resolved address, then as a global
label/variable. Function, global, argument, and local renames are marked as
`USER_DEFINED` in Ghidra.

For C++, `new_name` may be namespace-qualified, e.g.
`new_name="MyClass::method"` or `new_name="ns::sub::g_table"`. The namespace
hierarchy is created if missing (missing levels become plain namespaces;
existing namespaces/classes are reused), and the function or global symbol
is placed in that namespace. To create a real C++ class first (so methods
land in a `Class` rather than a plain namespace), use `namespaces(...,
action="create", kind="class")`. Namespace-qualified names are only valid
for function and global renames, not argument/local variables.

Args:
    target: Rename target selector. Local/argument selectors can use
        `<kind>:<variable-or-#index>@<function>`.
    new_name: Replacement name.
    program: Required Ghidra project path or name to target.
    kind: One of `auto`, `function`, `global`, `argument`, `local`, or
        `variable`.
    function: Function address/name for argument, local, or variable
        renames when not using the `@function` selector syntax.
    split_at: Optional instruction address of the local/argument
        occurrence to split out as a new variable before renaming.
    timeout: Decompiler timeout in seconds for local/argument renames.
ParametersJSON Schema
NameRequiredDescriptionDefault
kindNoauto
targetYes
programYes
timeoutNo
functionNo
new_nameYes
split_atNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does a strong job: it states that renames are marked as USER_DEFINED in Ghidra, that split variables are type-locked the same way Ghidra's UI action does so the split survives the next decompile, and that namespace hierarchies are created if missing. It doesn't explicitly state that renames are destructive/irreversible or require write permissions, but the mutation semantics are clear from 'rename' and the USER_DEFINED detail adds meaningful context. A 4 is appropriate because it discloses key behavioral traits without explicitly covering reversibility or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place: selector syntax, split behavior, auto resolution, C++ namespaces, and parameter summaries. It is front-loaded with the core purpose and selector examples before diving into edge cases. It could be tightened slightly (the selector examples and the Args section overlap), but the density of useful information justifies the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 parameters, 5 target kinds, split behavior, C++ namespace handling) and the absence of annotations, the description is remarkably complete. It covers selector syntax, auto-resolution order, split_at semantics, namespace qualification rules, and parameter roles. The only notable omissions are return value details (though an output schema exists) and explicit error/edge-case behavior (e.g., what happens if the target doesn't resolve). For a tool this complex, a 4 is strong; a 5 would require explicit failure-mode documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the schema's bare parameter names. It does: it explains the target selector grammar in detail, defines each kind value, clarifies when function is needed, and gives a concrete split_at example. The only minor gap is that timeout is mentioned as 'Decompiler timeout in seconds for local/argument renames' but the description doesn't explain why a timeout matters or what happens on timeout. Still, this is far beyond what the schema provides, so a 4 is warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Rename a function, global label/variable, function argument, or local variable.' It then enumerates the exact selector forms for each target kind, which distinguishes it from sibling tools like rename_batch, labels, and set_register. The scope is precise and immediately actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: it explains the compact selector syntax versus the kind/function arguments, covers the decompiler's 'Split Out As New Variable' behavior with a concrete example, and even tells the agent when to use a sibling tool (namespaces(... action='create', kind='class')) for creating a real C++ class. It also states that namespace-qualified names are only valid for function and global renames, not argument/local variables. This is comprehensive routing and exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rename_batchA

Run multiple rename commands against the selected program in one request.

Each command object accepts the same fields as `rename`: `target`,
`new_name`, optional `kind`, optional `function`, optional `split_at`, and
optional per-command `timeout`. Commands are executed sequentially in one
Ghidra snippet. The JSON result contains one entry per attempted command
with `ok: true` and the rename result, or `ok: false` and an error string.

Example command objects:
- `{"target": "function:main", "new_name": "app_main"}`
- `{"target": "arg:#0@main", "new_name": "argc"}`
- `{"target": "local:res@handler", "new_name": "did_index",
   "split_at": "0x90003482"}`

Args:
    commands: Rename command objects to execute sequentially.
    program: Required Ghidra project path or name to target.
    timeout: Default decompiler timeout in seconds for local/argument
        renames. A command may override this with its own `timeout`.
    stop_on_error: Stop after the first command failure when true.
ParametersJSON Schema
NameRequiredDescriptionDefault
programYes
timeoutNo
commandsYes
stop_on_errorNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses sequential execution, per-command result entries with ok/error structure, per-command timeout override, and stop_on_error behavior. It does not explicitly state persistence or side effects of the renames, but the rename semantics are strongly implied by the tool name and examples.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a front-loaded purpose, an Args section, and concrete examples. Every section earns its place; the examples make the nested command format concrete without adding fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and 0% schema coverage, the description is quite complete: it covers execution order, result format, timeout behavior, and stop_on_error. It relies on the sibling rename tool for nested field semantics and does not describe the success result shape in detail, but an output schema is present, so that detail is not strictly required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does: it explains `commands`, `program`, `timeout`, and `stop_on_error`, plus the nested fields accepted by each command object. The semantics of `kind`, `function`, and `split_at` are delegated to the sibling `rename` tool rather than explained inline, which is a minor gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Run multiple rename commands against the selected program in one request.' It clearly differentiates from the sibling rename tool by emphasizing batch execution rather than a single rename.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the batch context explicit: 'Commands are executed sequentially in one Ghidra snippet,' and references the sibling `rename` tool for the command object shape. It does not explicitly state 'use rename for a single command' or list exclusions, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_prototypeA

Set a function's prototype, including a C++ this pointer and methods.

This is the main tool for typing C++ methods so the decompiler propagates
the class type through callers and grows the class struct. Datatypes are
resolved from the program's datatype manager (create them first with
`set_types` when needed). The result reports the signature before and after.

Two ways to specify the signature:
- `prototype`: a full C declaration string, e.g.
  `"int process(MyClass *this, int cmd)"`. Parsed and applied as-is.
- structured: `return_type` (e.g. `"void"`), `parameters` (a list of
  `{"name": ..., "type": ...}` objects; a bare type string is also
  accepted), and optionally a leading `this` pointer (see below).

C++ method typing (structured mode):
- `class_name`: attach the function as a method of this class (a real
  `GhidraClass`, created if missing) and, unless `this_type` is given, add a
  leading `this` parameter of type `<class_name> *`. An empty struct named
  after the class is created if one does not exist yet, so the decompiler
  has a type to grow.
- `this_type`: explicit type for the leading `this` parameter, e.g.
  `"MyClass"` (a ` *` is added if absent). Overrides the class-derived type.

`calling_convention` is applied only if the program's language defines it
(e.g. `__thiscall` exists on x86 but usually not on embedded targets); an
undefined convention is reported in `notes` and left unchanged. On most
embedded ABIs the `this` pointer is simply the first argument under the
default convention, which this tool sets up correctly without a special
convention. When you do use `__thiscall`, omit the explicit `this` (Ghidra
injects it); otherwise pass `this` via `class_name`/`this_type`.

Args:
    target: Function selector (address, exact label, or function name).
    program: Required Ghidra project path or name to target.
    prototype: Full C declaration string. Takes precedence when supplied.
    return_type: Return datatype name (structured mode).
    parameters: Ordered parameter list as `{"name", "type"}` objects
        (structured mode), excluding the auto-added `this`.
    calling_convention: Optional calling-convention name to apply if the
        language defines it.
    this_type: Explicit `this`-pointer datatype (structured mode).
    class_name: Class to attach the method to and derive `this` from.
    timeout: Bridge execution timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
programYes
timeoutNo
prototypeNo
this_typeNo
class_nameNo
parametersNo
return_typeNo
calling_conventionNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden, and it delivers: it discloses that datatypes are resolved from the datatype manager, that an empty struct may be created when the class does not exist, that `calling_convention` is only applied when supported and otherwise reported in notes, and that the result reports the signature before and after. These are meaningful side effects and edge cases beyond the input schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but the tool is complex with 9 parameters, two specification modes, and calling-convention nuances. It is well structured with a lead sentence, short explanatory sections, an example, and a compact Args list. Every sentence adds functional or behavioral information; there is no filler or repetition of schema defaults.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, no annotation support, and zero schema parameter descriptions, the description covers all necessary context: parameter formats, prerequisites, side effects, precedence rules, and platform-specific calling-convention behavior. The output schema exists, so the mention of before/after signature reporting is sufficient for return-value understanding. An agent can invoke this tool correctly without external documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema description coverage is 0%, so the description must fully explain every parameter. It does: the Args section explains target, program, prototype, return_type, parameters, calling_convention, this_type, class_name, and timeout. It also adds crucial semantics like prototype precedence, auto-added `this`, and the ` *` appended to `this_type`, which the schema alone would never convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Set a function's prototype, including a C++ `this` pointer and methods.' It further distinguishes the tool as 'the main tool for typing C++ methods,' which separates it from siblings like set_types, apply_types, and create_function. The purpose is concrete and not a tautology or vague restatement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use context: 'This is the main tool for typing C++ methods so the decompiler propagates the class type through callers.' It also names an alternative prerequisite ('create them first with set_types when needed') and gives mode-selection guidance, such as when to use `prototype` vs structured mode and when to omit the explicit `this` with `__thiscall`. This is thorough, practical guidance an agent can act on.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_registerA

Set or assume a register value over an address range or selection.

This writes a Ghidra program-context register value. Pass a single `target`,
optionally with `end` or `length`, or pass non-contiguous `ranges` entries
with `start` plus optional `end` or `length`.

Args:
    register: Register name.
    value: Integer register value, for example `0`, `13`, or `0x40000000`.
    program: Required Ghidra project path or name to target.
    target: Address, exact label, or function name. Required unless
        `ranges` is supplied.
    end: Inclusive end address for a contiguous selection.
    length: Byte length for a contiguous selection starting at `target`.
    ranges: Optional list of range objects, each with `start` plus optional
        `end` or `length`, for non-contiguous selections.
ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
valueYes
lengthNo
rangesNo
targetNo
programYes
registerYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. It explicitly states 'This writes a Ghidra program-context register value,' disclosing the mutation. However, it does not mention side effects like overwriting existing values, reversibility, or error conditions. This is adequate but leaves room for deeper disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and then organizes the two modes clearly before a concise arg list. Every sentence adds value—no filler or repetition. It is appropriately sized for a tool with 7 parameters and two distinct call patterns.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all 7 parameters, explains both usage modes, and provides concrete examples. Since an output schema exists, return-value details are not needed. An agent has everything required to call the tool correctly without additional lookups.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description provides detailed semantics for every parameter: explains `register` and `value` with examples, defines `program` as the target path, and clarifies the conditional requirements among `target`, `end`, `length`, and `ranges`. This fully compensates for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with 'Set or assume a register value over an address range or selection,' using a specific verb and resource. It clearly distinguishes the two invocation modes (contiguous vs. ranges) and is unique among siblings (no other tool sets registers), so an agent can immediately identify its purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description explains when to use `target` versus `ranges`, and explicitly states that `target` is required unless `ranges` is supplied. It also clarifies the optional `end`/`length` relationships. While it doesn't name alternatives (there are none), the guidance is contextually sufficient for correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_typesA

Create or update one or more struct/enum types from C header text.

The input accepts normal C header style declarations, including `typedef
struct`, `typedef enum`, plain `struct`, and plain `enum` definitions.
Enum sizes can be set with comment directives such as
`/* ghidra-mcp enum-size: Name=1 */`.
Field comments are accepted from trailing `// ...` or `/* ... */`
comments and are applied to the resulting struct members.
To intentionally leave unknown bytes in a struct, add explicit placeholder
fields using Ghidra's undefined types, for example:
`undefined1 _pad[3];`, `undefined2 _pad;`, `undefined4 _reserved;`.
Use that for deliberate gaps; omitted fields only produce whatever natural
ABI padding the parsed C layout would normally create.
Missing referenced types are resolved from the current program's datatype
manager when possible, so new definitions can refer to already-existing
program types without re-declaring them inline.
Imported structs are stored as explicit-layout, non-packed Ghidra structs
so their size and padding remain directly editable after import.

The return value is the stored type definitions exported back out of Ghidra
as C header text.

Args:
    types: One or more type declarations in C header syntax.
    program: Required Ghidra project path or name to target.
    timeout: Timeout in seconds for the bridge-side parse/import/export.
ParametersJSON Schema
NameRequiredDescriptionDefault
typesYes
programYes
timeoutNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It discloses how imported structs are stored (explicit-layout, non-packed), how missing types are resolved, how padding is handled, how to add deliberate gaps, and the return value format. This goes far beyond a simple 'create/update' statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose and then provides detailed but relevant information on syntax, padding, resolution, and return value. It is somewhat lengthy but every sentence adds value; could be tightened slightly without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (parsing C headers, importing types, handling padding) and no annotations, the description is complete. It covers input format, behavioral nuances, return value, and parameter details, leaving no ambiguity for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does. It explains each parameter: types (C header syntax), program (required Ghidra path/name), and timeout (seconds). This adds meaning beyond the schema's bare type definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (create/update) on a specific resource (struct/enum types) from C header text. It clearly distinguishes from siblings like get_types (retrieval) and apply_types (possibly applying elsewhere) by emphasizing the import and storage behavior, even if not naming them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool: for creating or updating types from C headers, with details on accepted syntax, padding, placeholders, and resolution. However, it does not explicitly mention alternatives or when not to use it, which prevents a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vtableA

Recover a C++ vtable: type the function-pointer table at address.

Point this at the start of a vtable (the address an object's vptr holds,
i.e. the first virtual-function slot — not the Itanium offset-to-top/typeinfo
prefix). It reads consecutive pointer-sized words, classifies each as a code
pointer or not (respecting the program's pointer size, endianness, and the
ARM/Thumb low bit), and reports the slots as JSON. This is discovery-by-hand:
you supply the address; it does not scan memory for vtables.

With `count` unset, slots are read until the first non-code pointer (bounded
by `max_count`). With `count` set, exactly that many slots are read.

When `apply` is true it also:
- creates a struct (`<class>_vtable` or `vtable_<address>`) of function
  pointers — one named `vfuncN` field per slot, with the target function in
  the field comment — and applies it at `address`;
- labels the table (as `<class>::vftable` when `class_name` is given);
- creates a function at each code slot when `create_functions` is true. A
  slot whose target is not yet an instruction (stale data, or bytes left
  decoded in the wrong ISA mode such as PowerPC VLE vs Book-E) is cleared
  and re-disassembled in the language's correct default mode before the
  function is created; slots that still can't be recovered are reported in
  `unrecovered_slots` rather than silently skipped;
- when `class_name` is given and `type_methods` is true, reparents each slot
  method into the class and sets its first parameter to `<class> *this`
  (adding one if the method has no parameters), so the decompiler propagates
  the class type. Reports `typed_methods`.

Set `apply=false` for a read-only report (always safe).

Args:
    address: Start of the vtable (address or exact label).
    program: Required Ghidra project path or name to target.
    count: Exact number of slots to read. Omit to auto-detect by code-run.
    max_count: Upper bound on slots when auto-detecting. Default 256.
    apply: Create the struct/label/functions. False = report only.
    create_functions: Create functions at slot targets (recovering stale or
        wrong-ISA-mode targets first).
    class_name: Associate the table with this class (created if missing);
        the table is labeled `<class_name>::vftable`.
    type_methods: When a class is given, reparent slot methods into the
        class and type their `this` pointer. Default true; no-op without
        `class_name`.
    timeout: Bridge execution timeout in seconds.
ParametersJSON Schema
NameRequiredDescriptionDefault
applyNo
countNo
addressYes
programYes
timeoutNo
max_countNo
class_nameNo
type_methodsNo
create_functionsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden, and it does so thoroughly. It discloses side effects: creating a struct, labeling the table, creating functions, clearing and re-disassembling stale/wrong-ISA-mode targets, reporting unrecovered slots, reparenting methods, and setting the 'this' parameter. It also explains the safe read-only mode and the JSON reporting behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence earns its place: it front-loads the core purpose, explains behavioral modes, details side effects, and then lists parameter semantics. The structure is logical and scannable, with no filler or repetition despite the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, nine parameters, and no annotations, the description is fully complete. It covers required parameters, edge cases like stale data and wrong ISA mode, defaults, failure reporting through unrecovered_slots, and the distinction between report-only and apply modes. An output schema exists, so return-value details do not need to be duplicated here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does. The Args section explains every parameter, including optionality, defaults, and behavioral meaning: count's exact vs auto-detect mode, max_count bounding auto-detection, apply=false being read-only, type_methods being a no-op without class_name, and timeout as the bridge execution limit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line states a specific verb and resource: 'Recover a C++ vtable: type the function-pointer table at address.' It further distinguishes the tool from memory-scanning approaches by saying 'This is discovery-by-hand: you supply the address; it does not scan memory for vtables.' An agent can clearly identify what this tool does and how it differs from other discovery tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives precise placement guidance ('Point this at the start of a vtable... not the Itanium offset-to-top/typeinfo prefix') and explains the count behavior with and without a value. It also advises 'Set apply=false for a read-only report (always safe).' It does not name specific sibling alternatives or list explicit exclusions, but the context is clear enough for correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

xrefsA

Get incoming and outgoing cross-references for an address, label, or function.

The target is resolved through Ghidra's `toAddr()` helper, so normal
address strings, exact label names, and exact function names are accepted.

The response is JSON containing the resolved address plus both incoming and
outgoing references, including reference type and nearby label/function
context for the opposite end of each edge.
When `include_pointer_bytes` is true, initialized memory is also scanned
for raw pointer-sized values equal to the resolved address. These are byte
matches, not Ghidra reference records.

Args:
    target: Address, exact label name, or exact function name to inspect.
    program: Required Ghidra project path or name to target.
    include_pointer_bytes: Also scan memory for raw pointer-byte matches.
ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
programYes
include_pointer_bytesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses target resolution through Ghidra's toAddr(), JSON output shape, both incoming/outgoing edges, reference types, nearby label/function context, and raw pointer-byte scan behavior. It also explicitly distinguishes byte matches from Ghidra reference records.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well structured and front-loaded with the primary purpose, followed by helpful resolution and response details. It is slightly repetitive with the pointer-bytes explanation appearing twice, but every sentence adds enough value to justify its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, the description already covers the necessary context: target resolution, required parameters, optional behavior, and response content. The description is complete enough for an agent to call the tool correctly without needing further documentation or annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the description fully compensates by explaining each of the three parameters: target's accepted forms, program as the required Ghidra project path/name, and include_pointer_bytes as the memory-scan switch. This provides all semantics missing from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get incoming and outgoing cross-references' for an address, label, or function. It clearly states the tool's scope and differentiates it from sibling tools such as list_instructions, labels, and address_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear guidance on what target forms are accepted (address strings, exact label names, exact function names), the required program parameter, and the optional pointer-byte scan. It does not explicitly compare against an alternative tool or say when not to use it, but the context is strong enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 24 tool updatesv0.2.0
    • First observedaddress_info
    • First observedanalyze
    • First observedapply_types
    • First observedclear
    • First observedcomment
    • First observedcreate_function
    • First observeddecompile
    • First observeddisassemble
    • First observedexecute
    • First observedget_programs
    • First observedget_types
    • First observedlabels
    • First observedlist_instructions
    • First observedmemory_map
    • First observednamespaces
    • First observedread_data
    • First observedrename
    • First observedrename_batch
    • First observedsearch
    • First observedset_prototype
    • First observedset_register
    • First observedset_types
    • First observedvtable
    • First observedxrefs

TDQS

A3.9/5.0

Scored across 24 tools

Disambiguation4/5

Each tool targets a distinct reverse-engineering concern such as renaming, decompiling, cross-references, type editing, or vtable recovery. The main ambiguities are the overlapping information-retrieval roles of labels, address_info, and xrefs, plus the fact that create_function can also trigger disassembly.

Naming Consistency3/5

Most tools use readable lowercase snake_case verb or verb_noun names like rename, create_function, set_types, and list_instructions. However, the pattern is inconsistent: several query tools are bare nouns (labels, xrefs, namespaces, vtable) and the get/list prefixes vary, so no strict convention is maintained.

Tool Count3/5

At 24 tools, this is on the heavy side and beyond the typical well-scoped 3-15 tool range. The breadth is justifiable for a Ghidra automation server, but some tools such as rename_batch and vtable are specialized additions rather than core necessities.

Completeness4/5

The tool surface covers the main reverse-engineering workflow well: disassembly, decompilation, renaming, references, memory/data inspection, type management, classes/vtables, analysis, and search. Minor gaps such as byte patching/assembling and a dedicated delete tool are workable around because clear() can remove most artifacts.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Exposes Ghidra reverse engineering capabilities via MCP, enabling LLMs and agents to analyze binaries, decompile, search, and edit programs headlessly or with GUI integration.
    426
    Apache 2.0
  • A
    license
    Not graded
    quality
    B
    maintenance
    MCP server and Ghidra plugin for reverse engineering, enabling clients like Claude to control Ghidra. Adds a run_python tool to execute arbitrary Jython scripts server-side.
    2
    Apache 2.0
  • F
    license
    Not graded
    quality
    D
    maintenance
    A PyGhidra-based MCP server that exposes Ghidra's reverse engineering capabilities to AI agents, enabling binary analysis via tools like overview, search, view, list, edit, script execution, and version control.
    1
    -