JNISleuth-MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| IDA_INSTALL_DIR | No | Path to the IDA Pro 9.0+ installation directory (e.g. /opt/idapro-9.0). | |
| GHIDRA_INSTALL_DIR | No | Path to the Ghidra 11.0+ installation directory (e.g. /opt/ghidra). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| resolve_apk_jni_mapC | Extracts all |
| get_cross_boundary_sliceC | Returns the decompiled Java caller (via Jadx) and the typed, decompiled C/ARM64 implementation (via Ghidra/IDA) in a single unified response. |
| trace_jni_upcallsC | Lists every Java reflection callback ( |
| sync_ghidra_jni_typesB | Applies |
| sync_ida_jni_typesC | Applies |
| resolve_ollvm_indirect_branchesC | Resolves OLLVM |
| extract_jni_onload_stringsC | Dumps stack-constructed and XOR-decrypted strings inside |
| list_jni_methodsD | Alias for resolve_apk_jni_map. |
| get_cross_boundary_callgraphD | Alias for get_cross_boundary_slice. |
| trace_jni_callbacksD | Alias for trace_jni_upcalls. |
| import_dynamic_traceD | Alias for sync_ghidra_jni_types. |
| deobfuscate_jni_stringsC | Alias for extract_jni_onload_strings. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 12 tools
Five of the twelve tools are explicit aliases of other tools, so nearly half the surface duplicates existing functionality. Although the descriptions label the aliases, an agent still has multiple names for the same operation, creating avoidable overlap and misselection risk.
All tool names use snake_case and generally follow a verb_noun pattern, with parallel names such as sync_ghidra_jni_types and sync_ida_jni_types. The main weakness is that aliases use different verbs and resource names for the same underlying operation, which is a minor inconsistency in an otherwise predictable naming scheme.
The nominal count of 12 is still within a reasonable range, but five entries are redundant aliases, leaving only about seven unique capabilities. The surface is artificially inflated rather than genuinely broad.
The core JNI reverse-engineering workflow is covered: mapping native methods, cross-boundary slicing, upcall tracing, type syncing for Ghidra/IDA, OLLVM branch resolution, and string extraction. However, some advertised operations such as callgraph retrieval and dynamic trace import are merely aliases, so an agent expecting those distinct capabilities will hit gaps.