Skip to main content
Glama
JNISleuth-MCP

JNISleuth-MCP

by nighthawkk

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
IDA_INSTALL_DIRNoPath to the IDA Pro 9.0+ installation directory (e.g. /opt/idapro-9.0).
GHIDRA_INSTALL_DIRNoPath to the Ghidra 11.0+ installation directory (e.g. /opt/ghidra).

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": false
}

Tools

Functions exposed to the LLM to take actions

NameDescription
resolve_apk_jni_mapC

Extracts all native declarations from DEX and maps them to exact ELF file offsets in lib/*.so.

get_cross_boundary_sliceC

Returns the decompiled Java caller (via Jadx) and the typed, decompiled C/ARM64 implementation (via Ghidra/IDA) in a single unified response.

trace_jni_upcallsC

Lists every Java reflection callback (FindClass, GetMethodID, CallObjectMethod, SetByteArrayRegion) invoked inside a native ARM64 function.

sync_ghidra_jni_typesB

Applies JNIEnv*, JavaVM*, JNINativeMethod structs, and recovered function signatures directly into an active or headless Ghidra project.

sync_ida_jni_typesC

Applies JNIEnv*, JavaVM*, JNINativeMethod structs, and recovered function signatures into IDA Pro 9.0 (idalib / idapyswitch / idat64).

resolve_ollvm_indirect_branchesC

Resolves OLLVM CSEL + BR X8 state-machine dispatchers and .rodata jump tables in JNI_OnLoad, optionally patching the ELF binary.

extract_jni_onload_stringsC

Dumps stack-constructed and XOR-decrypted strings inside .init_array and JNI_OnLoad.

list_jni_methodsD

Alias for resolve_apk_jni_map.

get_cross_boundary_callgraphD

Alias for get_cross_boundary_slice.

trace_jni_callbacksD

Alias for trace_jni_upcalls.

import_dynamic_traceD

Alias for sync_ghidra_jni_types.

deobfuscate_jni_stringsC

Alias for extract_jni_onload_strings.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

TDQS

C2.3/5.0

Scored across 12 tools

Disambiguation2/5

Five of the twelve tools are explicit aliases of other tools, so nearly half the surface duplicates existing functionality. Although the descriptions label the aliases, an agent still has multiple names for the same operation, creating avoidable overlap and misselection risk.

Naming Consistency4/5

All tool names use snake_case and generally follow a verb_noun pattern, with parallel names such as sync_ghidra_jni_types and sync_ida_jni_types. The main weakness is that aliases use different verbs and resource names for the same underlying operation, which is a minor inconsistency in an otherwise predictable naming scheme.

Tool Count3/5

The nominal count of 12 is still within a reasonable range, but five entries are redundant aliases, leaving only about seven unique capabilities. The surface is artificially inflated rather than genuinely broad.

Completeness3/5

The core JNI reverse-engineering workflow is covered: mapping native methods, cross-boundary slicing, upcall tracing, type syncing for Ghidra/IDA, OLLVM branch resolution, and string extraction. However, some advertised operations such as callgraph retrieval and dynamic trace import are merely aliases, so an agent expecting those distinct capabilities will hit gaps.

Maintenance

ActivityMaintained
ResponsivenessSyncing