Skip to main content
Glama

omni_inspect_symbol

Inspect and recover symbols from binaries, disassemble or decompile code, and analyze crypto, Android, WASM, or web bundles to support reverse engineering and triage.

Instructions

Granular reverse engineering & cryptanalysis: inspect PE symbols, disassemble with Capstone, decompile Java with JADX, decompile C with Ghidra, recover Go/Rust/Flutter symbols, simplify MBA expressions with Z3, compute Hensel lifting / modular inverses, rebuild unpacked PEs, detect honeypot traps, read bytes/RVAs, search byte patterns, detect crypto constant tables, extract structured IoC indicators, disassemble WASM modules via WABT, unpack web sourcemaps, and extract Android XRef/resources.

Input Schema

NameRequiredDescriptionDefault
archNoArchitecture for disassembly: 'x64', 'x86', 'arm64', 'arm'. Default 'x64'.x64
countNoNumber of instructions to disassemble (default 25).
queryNoAddress/offset (e.g. '0x140001000' or RVA) for disassembly/pseudo_c/rebuild_pe/read_bytes/read_rva, search pattern (hex '55 48 89 E5' or 'str:admin'), MBA expression, hex value for modular/Hensel inverse, or Java class name.
actionYesInspection action: 'pe_symbols', 'disassemble_address', 'android_class', 'pseudo_c', 'go_symbols', 'rust_metadata', 'flutter_dart', 'simplify_mba', 'hensel_inverse', 'modular_inverse', 'rebuild_pe', 'scan_honeypots', 'read_bytes', 'read_rva', 'search_bytes', 'crypto_signatures', 'indicators', 'capabilities', 'wasm_disasm', 'wasm_headers', 'unpack_sourcemap', 'analyze_web_bundle', 'android_xref', 'android_resources', 'pe_lea_xrefs', 'native_crypto_prologues'.pe_symbols
target_pathYesPath to target binary (.exe, .dll, .apk, .so, .dex, .wasm, .js).

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv3.2.0

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing about behavior. It does not say whether actions are read-only, whether rebuild_pe or unpack_sourcemap write files to disk, whether targets are modified in place, whether elevated permissions or long runtimes are involved, or what any action returns. For a 26-action tool that includes mutations like rebuild_pe, this is a substantial gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is a single run-on sentence that mechanically re-lists the 26 enum values already present in the schema, which is wasteful duplication. It is front-loaded with 'Granular reverse engineering & cryptanalysis', which is the only genuinely informative clause. There is no structure to help an agent scan the 26 actions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 26 distinct actions, 5 parameters, no annotations, and no output schema, the description should explain at minimum which parameters apply to which action and what each action produces. It does neither, leaving the agent to guess, for example, what read_bytes versus read_rva returns or how search_bytes differs from crypto_signatures. The definition is under-specified relative to the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so target_path, action, arch, count, and query are already documented in the schema, including the multi-purpose nature of query. The description adds no parameter-level meaning beyond restating the action list in prose, so the baseline 3 applies. It does not clarify which parameters are relevant to which action (e.g., arch/count only matter for disassembly).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description enumerates a very long list of concrete capabilities (PE symbols, Capstone disassembly, JADX, Ghidra pseudo-C, Z3 MBA simplification, etc.), so an agent can see the general domain: binary reverse engineering and cryptanalysis. But it is a catch-all enumerating 26 actions that duplicate the action enum verbatim, and it never distinguishes this tool from overlapping siblings such as omni_deep_reverse, omni_advanced_native, or omni_mobile_deep. The purpose reads as 'everything binary' rather than a sharply bounded verb+resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over the many siblings that appear to overlap (omni_deep_reverse, omni_modern_unpacker, omni_mobile_deep, omni_advanced_native). No prerequisites, no when-not-to-use conditions, and no indication of which action fits which scenario are given. The agent must infer routing purely from the action names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.