Binary Ninja Headless MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BINARY_NINJA_HEADLESS_MCP_FAKE_BACKEND | No | Set to '1' to enable fake backend mode (no Binary Ninja required). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| health.pingA | Health check. |
| mcp.response_formatA | Explain MCP tool result fields ( |
| binja.infoA | Return Binary Ninja version/install info. |
| binja.callC | Generic API bridge: call |
| binja.evalC | Evaluate Python code with |
| session.openC | Open a binary and create a session. |
| session.open_bytesC | Open a binary session from base64-encoded bytes. |
| session.open_existingC | Open another session from an existing session's file. |
| session.closeC | Close one open session. |
| session.listB | List open sessions. |
| session.modeA | Get session safety/determinism mode. |
| session.set_modeC | Update session safety/determinism mode. |
| analysis.statusC | Get analysis status. |
| analysis.progressC | Get analysis progress snapshot. |
| analysis.updateC | Trigger async analysis update. |
| analysis.update_and_waitC | Run analysis update and wait for completion. |
| analysis.abortC | Abort analysis. |
| analysis.set_holdC | Hold/release analysis queue. |
| binary.summaryC | Get binary/session summary. |
| binary.saveC | Save the current binary view to a file path. |
| binary.functionsC | List functions with pagination. |
| binary.stringsC | List discovered strings with pagination. |
| binary.search_textC | Search raw text/bytes in a session. |
| binary.sectionsC | List sections with pagination. |
| binary.segmentsC | List segments with pagination. |
| binary.symbolsC | List symbols with pagination. |
| binary.data_varsC | List data variables with pagination. |
| binary.get_function_atB | Find function by address. |
| binary.get_function_disassembly_atC | Get full disassembly for the function containing an address. |
| binary.get_function_il_atC | Get full IL for the function containing an address. |
| binary.functions_atC | List functions at an address. |
| binary.basic_blocks_atB | List basic blocks at an address with pagination. |
| function.basic_blocksC | List basic blocks in a function with pagination. |
| disasm.linearD | Get linear disassembly lines. |
| search.dataC | Search for raw byte patterns (hex string). |
| search.next_textD | Find next text match. |
| search.all_textC | Find all text matches in range (regex optional). |
| search.next_dataC | Find next data/byte-pattern match. |
| search.all_dataC | Find all data/byte-pattern matches in range. |
| search.next_constantC | Find next constant occurrence. |
| search.all_constantC | Find all constant occurrences in range. |
| xref.code_refs_toC | Code references to an address. |
| xref.code_refs_fromC | Code references from an address. |
| xref.data_refs_toB | Data references to an address. |
| xref.data_refs_fromD | Data references from an address. |
| function.callersD | Callers of a function. |
| function.calleesD | Callees of a function. |
| function.variablesC | List function variables. |
| function.var_refsC | List variable references in MLIL/HLIL. |
| function.var_refs_fromC | List variable references originating from an address. |
| function.ssa_var_def_useC | Get SSA variable definition and uses. |
| function.ssa_memory_def_useC | Get SSA memory definition and uses by memory version. |
| value.regC | Get register value at/after an address. |
| value.stackC | Get stack contents at/after an address. |
| value.possibleC | Get IL possible value set at an address. |
| value.flags_atC | Get lifted IL flag read/write state at an address. |
| memory.readC | Read bytes from the view. |
| memory.writeC | Write bytes (hex) to the view. |
| memory.insertC | Insert bytes (hex) into the view. |
| memory.removeC | Remove bytes from the view. |
| memory.reader_readD | Read integer values via BinaryReader. |
| memory.writer_writeD | Write integer values via BinaryWriter. |
| data.typed_atD | Get typed data variable at an address. |
| disasm.functionC | Get full disassembly for the function containing an address. |
| disasm.rangeC | Address-range disassembly lines. |
| il.functionD | IL function listing. |
| il.instruction_by_addrC | Get IL instruction by source address. |
| il.address_to_indexC | Map address to IL index/indices. |
| il.index_to_addressC | Map IL index to source address. |
| annotation.rename_functionD | Rename a function. |
| annotation.rename_symbolC | Rename symbol at address. |
| annotation.undefine_symbolC | Undefine user symbol at address. |
| annotation.define_symbolC | Define symbol at address. |
| annotation.rename_data_varD | Rename data variable. |
| annotation.define_data_varD | Define data variable. |
| annotation.undefine_data_varD | Undefine data variable. |
| annotation.set_commentC | Set comment at address. |
| annotation.get_commentC | Get comment at address. |
| annotation.add_tagC | Add user data tag at address. |
| annotation.get_tagsC | Get tags at address. |
| metadata.storeD | Store metadata by key. |
| metadata.queryC | Query metadata by key. |
| metadata.removeC | Remove metadata by key. |
| function.metadata_storeC | Store function metadata by key. |
| function.metadata_queryC | Query function metadata by key. |
| function.metadata_removeC | Remove function metadata by key. |
| patch.assembleC | Assemble and patch instruction bytes at address. |
| patch.statusC | Inspect patch availability at address. |
| patch.convert_to_nopC | Patch instruction to NOP when supported. |
| patch.always_branchC | Patch conditional branch to always branch when supported. |
| patch.never_branchC | Patch conditional branch to never branch when supported. |
| patch.invert_branchC | Patch conditional branch by inversion when supported. |
| patch.skip_and_return_valueD | Patch instruction to skip and return value when supported. |
| undo.beginC | Begin undo transaction. |
| undo.commitC | Commit undo transaction. |
| undo.revertD | Revert undo transaction. |
| undo.undoD | Perform undo. |
| undo.redoD | Perform redo. |
| task.analysis_updateC | Start async analysis update task. |
| task.search_textC | Start async search task. |
| task.statusC | Get task status. |
| task.resultC | Get task result. |
| task.cancelC | Cancel task (best-effort). |
| database.create_bndbC | Create .bndb from session. |
| database.save_auto_snapshotD | Save auto snapshot. |
| type.parse_stringD | Parse a single type string. |
| type.parse_declarationsC | Parse C declarations for types/variables/functions. |
| type.define_userD | Define user type from type source. |
| type.renameD | Rename a type. |
| type.undefine_userD | Undefine a user type. |
| type.import_library_typeC | Import type from type library. |
| type.import_library_objectC | Import object type from type library. |
| type.export_to_libraryC | Export type into a type library. |
| type_library.createC | Create and optionally attach a type library. |
| type_library.loadC | Load and optionally attach a type library. |
| type_library.listC | List type libraries attached to the view. |
| type_library.getC | Get one tracked type library. |
| type_archive.createC | Create and optionally attach a type archive. |
| type_archive.openC | Open and optionally attach a type archive. |
| type_archive.listC | List attached type archives. |
| type_archive.getC | Get one tracked type archive. |
| type_archive.pullD | Pull types from a type archive. |
| type_archive.pushC | Push types to a type archive. |
| type_archive.referencesC | Query archive incoming/outgoing references for one type. |
| debug.parsersC | List debug info parsers valid for this view. |
| debug.parse_and_applyC | Parse debug info and apply it to the view. |
| workflow.listA | List registered workflows. |
| workflow.describeC | Describe workflow topology and settings. |
| workflow.cloneD | Clone workflow. |
| workflow.insertC | Insert activities before an activity. |
| workflow.insert_afterC | Insert activities after an activity. |
| workflow.removeC | Remove workflow activity. |
| workflow.graphD | Summarize workflow graph. |
| workflow.machine.statusC | Get workflow machine status. |
| workflow.machine.controlD | Control workflow machine runtime. |
| il.rewrite.capabilitiesC | List IL rewrite support for one function and IL level. |
| il.rewrite.noop_replaceC | Perform no-op IL expression replacement. |
| il.rewrite.translate_identityD | Translate IL with identity mapping callback. |
| uidf.parse_possible_valueC | Parse user-informed possible value set string. |
| uidf.set_user_var_valueC | Set function user variable value. |
| uidf.clear_user_var_valueC | Clear function user variable value. |
| uidf.list_user_var_valuesC | List all user variable values for a function. |
| loader.rebaseD | Rebase BinaryView. |
| loader.load_settings_typesC | List loader settings type names. |
| loader.load_settings_getC | Get loader settings values. |
| loader.load_settings_setC | Set one loader setting value. |
| segment.add_userD | Add user segment. |
| segment.remove_userC | Remove user segment. |
| section.add_userD | Add user section. |
| section.remove_userD | Remove user section. |
| external.library_addC | Add external library. |
| external.library_listD | List external libraries. |
| external.library_removeC | Remove external library. |
| external.location_addD | Add external location mapping. |
| external.location_getC | Get external location mapping. |
| external.location_removeC | Remove external location mapping. |
| arch.infoC | Get architecture and platform metadata. |
| arch.disasm_bytesC | Disassemble bytes with selected architecture. |
| arch.assembleC | Assemble instruction text with selected architecture. |
| transform.inspectD | Inspect/process transform pipeline. Requires session_id or path. |
| project.createD | Create project. |
| project.openC | Open project. |
| project.closeC | Close tracked project. |
| project.listC | List project folders/files. |
| project.create_folderD | Create project folder. |
| project.create_fileC | Create project file from base64 data. |
| project.metadata_storeC | Store project metadata. |
| project.metadata_queryD | Query project metadata. |
| project.metadata_removeC | Remove project metadata. |
| database.infoC | Get database status for session. |
| database.snapshotsC | List database snapshots. |
| database.read_globalC | Read database global string key. |
| database.write_globalC | Write database global string key. |
| plugin.valid_commandsC | List context-valid plugin commands. |
| plugin.executeD | Execute a context-valid plugin command. |
| plugin_repo.statusB | List plugin repositories and plugin states. |
| plugin_repo.check_updatesD | Check plugin repository updates. |
| plugin_repo.plugin_actionC | Run install/uninstall/enable/disable action on repository plugin. |
| baseaddr.detectD | Run base-address detection. |
| baseaddr.reasonsC | Get base-address detection reasons. |
| baseaddr.abortC | Abort base-address detection. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/mrphrazer/binary-ninja-headless-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server