Hex-Rays IDA MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Hex-Rays IDA MCPdecompile main from the loaded binary and show its callers"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Hex-Rays IDA MCP
English announcement · 官方 IDA Nexus 之上的 MCP 服务器适配层。
本服务器让 Claude Code、Codex、GitHub Copilot 等 AI 代理直接对编译产物(ELF / PE / Mach-O / 固件 / IDB)做逆向分析:反编译为伪代码、反汇编、交叉引用、类型系统、字符串/常量检索、补丁、签名制作乃至动态调试。
除了官方的 6 个核心工具外,本仓库(feat/port-ida-pro-mcp 分支)还移植了社区服务器 ida-pro-mcp 的 95 个细化工具和 11 个资源(详见下文 Pro 工具面),两套工具面共用同一服务器、同一 open_database 生命周期、同一多数据库模型。
功能总览
能力 | 来源 | 说明 |
打开/保存/关闭数据库、执行任意 IDAPython | 官方 6 工具 |
|
反编译、反汇编、xref、调用图、批量分析 | Pro 工具面 |
|
内存读取、字节补丁、全局变量读写 | Pro 工具面 |
|
类型与结构体、栈变量 | Pro 工具面 |
|
重命名、注释、定义函数/代码、书签 | Pro 工具面 |
|
REPL 式 IDAPython | Pro 工具面 |
|
特征码制作 | Pro 工具面 |
|
CTF 辅助 | Pro 工具面 | 算法识别、混淆检测、patch 点定位、约束提取、一键分析报告等 7 个 |
动态调试 | Pro 扩展(默认隐藏) | 22 个 |
会话追踪与成本看板 | 本仓库 |
|
Related MCP server: IDA MCP
环境要求
安装
自动安装(上游正式发布版)
使用 hcli 安装,会装上 GUI 插件并交互式提供各代理插件:
uvx ida-hcli mcp install
# 或已安装 hcli 时:
hcli mcp install从本仓库安装(含 Pro 工具面)
Pro 工具面目前只在本仓库中,从源码安装:
git clone https://github.com/HexRaysSA/ida-mcp
cd ida-mcp
uv sync # 按 uv.lock 安装运行时 + 开发依赖
uv run ida-mcp --help # 验证 CLI 可用wheel 打包只包含 ida_mcp 包(pyproject.toml 中 only-include = ["ida_mcp"]),ida_mcp.pro 运行时会随包一起分发。
手动安装
IDA GUI 插件
GUI 插件让 MCP 服务器能访问 IDA GUI 里已打开的数据库:
uvx ida-hcli plugin install ida-mcp@https://github.com/HexRaysSA/ida-mcp
# 或:
hcli plugin install ida-mcp@https://github.com/HexRaysSA/ida-mcp注:不装 GUI 插件时,IDA MCP 仍可 headless 工作。
Claude Code
claude plugin marketplace add HexRaysSA/claude-marketplace
claude plugin install ida-mcp@HexRaysSA
claude plugin update ida-mcp@HexRaysSA # 升级到最新版Codex CLI
codex plugin marketplace add HexRaysSA/codex-marketplace
codex plugin add ida-mcp@HexRaysSAGitHub Copilot CLI
copilot plugin marketplace add HexRaysSA/copilot-marketplace
copilot plugin install ida-mcp@HexRaysSA
copilot plugin update ida-mcpPi
pi install git:github.com/HexRaysSA/ida-mcp@latest
pi update --extensionsoh-my-pi
omp plugin install github:HexRaysSA/ida-mcp#latest
omp plugin upgrade其他代理
在 MCP JSON 配置中配置一个常规 stdio 服务器:
{
"mcpServers": {
"ida": {
"command": "uvx",
"args": [
"--exclude-newer=1s",
"ida-mcp",
"stdio",
"--agent=my-agent"
]
}
}
}uvx 会从 PyPI 解析最新的稳定版 ida-mcp,无需随版本更新配置。
从本仓库源码运行时,把 uvx --exclude-newer=1s ida-mcp 换成 uv --project /path/to/ida-mcp run ida-mcp 即可。
--agent=my-agent 是人工命名的标签(如 claude-code、cursor、my-custom-agent),用于在看板里区分不同代理的会话。
CLI 参考
# 标准输入/输出上的 MCP 服务器
uvx ida-mcp stdio --agent=my-agent
# Streamable HTTP 上的 MCP 服务器(默认 127.0.0.1:8737)
uvx ida-mcp http --host 127.0.0.1 --port 8737
# 查看会话日志看板
uvx ida-mcp dashboard --open
# 导出会话日志用于排障(生成校验过的 ZIP 归档)
uvx ida-mcp logs
# 为 Claude / Codex / Copilot 的 pre-tool 载荷附加转录元数据
uvx ida-mcp hookstdio 与 http 共用的服务器参数:
参数 | 默认 | 说明 |
| 无 | 启动时打开并激活的执行文件或 IDB 路径 |
| 无 | 记录到 MCP 会话轨迹中的代理名 |
| 不超时 | 管理型 idalib 租约空闲该秒数后自动释放; |
| 空 | 启用的 |
其他环境变量:
变量 | 作用 |
| 等价于 |
| 等价于 |
| 语义轨迹根目录,默认 |
| 可选的进程级关联 ID,用于可信关联 |
官方六工具
工具 | 签名 | 说明 |
|
| 打开可执行文件/共享库/固件镜像或现成的 |
|
| 在目标 worker 中运行 IDAPython/IDA domain API,等待初始自动分析完成后执行;支持 MCP 取消(对未完成的只读请求转发取消,已执行的变更请求绝不重试) |
|
| 按 IDA domain API 用法查询参考(如"decompile function"、"xrefs to address"),返回签名与示例 |
| — | 列出 GUI / headless worker 中当前打开的数据库与实例 ID |
|
| 保存 IDB(renames、comments、types、patches 等持久化) |
|
| 释放本进程租约;绝不动 GUI 数据库或其他客户端的租约 |
官方工具 + pro 工具都支持尾部 instance_id 参数实现多数据库定向。
Pro 工具面
ida_mcp.pro 从社区服务器 ida-pro-mcp(MIT,© 2025 Duncan Ogilvie)移植,与官方六工具运行在同样的 Nexus worker 上。95 个 @tool 函数按运行时模块分成 9 组:
分组 | 数量 | 工具 | 备注 |
核心列表/查询 | 12 |
| 字符串检索使用 worker 侧增量缓存 |
内存 | 6 |
|
|
分析 | 19 |
|
|
类型与栈 | 12 |
| |
修改 | 11 |
| 写字节类工具标注 |
Python | 2 |
| REPL 局部变量按 worker 持久(跨调用、跨 MCP 会话) |
签名 | 4 |
| vendored |
CTF 辅助 | 7 |
| 算法识别(md5/sha/aes/des/rc4/tea/xor/base64/crc32/zlib…)、控制流平坦化等混淆检测、可 patch 点定位、约束线索提取、一键 Markdown 分析报告 |
调试器 | 22 |
| 扩展组门控 |
调试器扩展(dbg)
22 个 dbg_* 工具(dbg_start、dbg_run_to、dbg_step_into/over、dbg_add_bp、dbg_set_bp_condition、dbg_read/write、dbg_regs*、dbg_stacktrace、dbg_status 等)需要 GUI 活动调试会话,默认从 tools/list 隐藏:
ida-mcp stdio --extensions dbg
# 或
export IDA_MCP_PRO_EXTENSIONS=dbg不开扩展时 tools/list 显示 79 个工具(6 官方 + 73 pro);调用被门控的工具会返回一条错误,消息中给出确切的开启方法。
资源
11 个 MCP 资源沿用上游 URI:ida://idb/metadata、ida://idb/segments、ida://idb/entrypoints、ida://cursor、ida://selection、ida://types、ida://structs,外加模板 ida://struct/{name}、ida://import/{name}、ida://export/{name}、ida://xrefs/from/{addr}。其中 ida://cursor 与 ida://selection 在 idalib worker(无 GUI)上返回明确的 GUI-only 错误,而不是过期数据。
与上游 ida-pro-mcp 的差异(有意为之)
所有工具多一个尾部
instance_id参数,对齐官方多数据库模型;server_health省去busy_tool/queued_calls(busy 上报由 Nexus 统一负责);py_eval不再注入mcp_time_left()/mcp_deadline_exceeded()(超时由 Nexus 在服务端强制);工具超时预算为
ida_mcp/pro/spec.py中记录的execute_python预算:每工具 30–300 s,默认 120 s(decompile90 s、py_eval300 s、analyze_component180 s 等);参数量超过 2 MiB(HTTP body 上限)的批量请求被拒绝并提示"收窄查询",而不是传输层报错。
完整文档见 docs/PRO_TOOLS.md。
使用示例
启动代理后直接下指令:
Reverse /path/to/sample.elf for me in IDA测试 GUI 集成(先在 IDA GUI 里打开某个文件):
What do I have open in the IDA GUI?典型工作流:
open_database打开样本 → 自动分析完成;survey_binary一览全貌(段布局、入口点、xref Top15 字符串/函数、导入分类、调用图摘要);decompile/analyze_function深挖重点函数;rename、set_type、set_comments持久化你的结论;make_signature_for_function提特征码、dbg_*(开启扩展后)动态验证;save_database保存 IDB,close_database释放。
架构
IDA MCP 是协议无关的 IDA Nexus 库之上的适配层:Nexus 负责 IDA 进程发现、认证的数据库服务、租约、worker 与 Python 执行;本仓库负责面向模型的 MCP 协议、语义追踪、代理转录关联、看板与支持日志归档。
agent / MCP client
│
├─ stdio 或 Streamable HTTP
│
ida_mcp.mcp (ZeroMCP 服务器:6 官方工具 + 95 pro 包装器 + 11 资源)
│
├─ 语义轨迹 ──> <IDA_MCP_STATE_DIR>/sessions/<server-id>.jsonl
│
└─ ida_nexus.DatabaseManager
│
└─ DatabaseHandle 租约 ──> GUI worker 或 idalib worker可靠关闭:stdio EOF、SIGINT/SIGTERM、解释器正常退出、HTTP 显式关停都会释放本进程句柄;最后一个租约消失时 Nexus 执行最终保存并关闭托管 worker。
Pro 移植机制:服务器进程从不导入运行时。
ida_mcp/pro/tools.py持有 95 个薄@tool包装器(zeromcp 从签名推导严格 schema);dispatch 把参数序列化为 JSON,经标准execute_python路径执行pro_call(...)程序。每个 worker 上的第一次 pro 调用会安装内容寻址的 bundle 模块(_ida_mcp_pro_<sha16>)——重新构建即产生新模块名,不存在旧代码窗口。worker 侧状态(find_regex字符串缓存、py_evalREPL 局部变量)放在 bundle 模块里,对挂在同一 worker 上的所有 MCP 会话共享。追踪:首次工具调用时惰性创建 schema-1 JSONL 轨迹(纯生命周期连接不落盘);每条记录含时间戳、服务器 ID、进程 ID 与事件,工具调用与结果靠
call_id配对。代理关联:代理 hook 用
<agent-kind>_session_path约定把转录路径放进隐藏请求元数据;嵌入元数据在 dispatch 前从公开参数中剥离、复制进语义记录,且只保留与配置的--agent匹配的键。看板:纯标准库实现的
ida-mcp dashboard读取本地轨迹或校验过的支持归档,关联工具调用与结果、渲染 Python 执行与错误、跟踪数据库目标,并按 Cost / Task time(根据关联转录估算的 LLM/工具墙钟时间)排序;ida-mcp logs生成带校验和的ida-mcp-logsZIP。归档安全:解压拒绝重复/不安全成员名,校验尺寸与哈希;缺失引用绝不解析到接收方文件系统。
嵌入 API:应用可从
ida_mcp.mcp导入serve_http、serve_stdio、stop_http_server、tool;serve_http接受DatabaseManager子类,便于云/枢纽应用自定义数据库解析而保留官方工具、追踪、取消与关停行为。
更多细节见 docs/ARCHITECTURE.md。
开发
依赖(pyproject.toml):运行时 packaging、ida-nexus>=0.13.4、zeromcp>=1.10.3;开发组 pytest>=9.0.3、ruff>=0.12.0、ty>=0.0.83。要求 Python 3.11+。
uv sync # 安装全部依赖
# 测试(16 个测试文件:CLI / MCP / dashboard / logs / hooks / pro 全链路 mock 覆盖)
uv run pytest
# Lint(ida_mcp/pro/runtime 为逐字移植的上游代码,已排除 house style)
uv run ruff check
# 类型检查(同样排除移植运行时)
uv run ty checkPro 表面的签名漂移由 tests/test_pro_signature_parity.py 围栏防护;tools.py 由 artifacts_port/gen_tools.py 生成。
许可证与致谢
本仓库以 MIT 许可发布(见 LICENSE)。
ida_mcp.pro 包基于两份 MIT 许可的第三方代码移植,两份许可文本原文收录于 ida_mcp/pro/NOTICE:
ida-pro-mcp(© 2025 Duncan Ogilvie):runtime 模块与工具包装表面;
ida-sigmaker(© 2024 Mahmoud Abdelkader):bundle 内 vendored 的特征码引擎。
Available Tools
79 toolsadd_bookmarkSet or replace a bookmarkA
Add or replace the IDA bookmark at an address. Set prefix="" for no prefix.
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Address to bookmark | |
| name | Yes | Bookmark label text after the prefix | |
| prefix | No | Optional title prefix. Defaults to 'idaMCP: '; pass '' for no prefix. | idaMCP: |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ea | No | |
| ok | No | |
| addr | No | |
| slot | No | |
| error | No | |
| title | No | |
| prefix | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, but it does disclose the key behavioral trait that the operation is an upsert ('add or replace' an existing bookmark at the address). It does not state whether the bookmark persists to the IDB, what permissions are needed, or what the response returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the core action front-loaded and no wasted prose. The second sentence is slightly redundant with the schema's prefix description, which keeps it just shy of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the schema fully documents the parameters. For a simple mutation tool the description is nearly complete, though the absence of annotations leaves persistence and permission behavior unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all four parameters including the prefix default and instance_id. The description's only added parameter hint ('Set prefix="" for no prefix') merely repeats what the schema already says, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Add or replace the IDA bookmark at an address'), naming the exact effect and target. No sibling tool overlaps with bookmarking, so no differentiation is required and an agent can select it unambiguously.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance, no prerequisites, and no alternatives named. The only hint is the prefix='' instruction, which is a parameter detail rather than usage routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_batchBatch multi-function analysisCRead-only
Run comprehensive analysis over one or more target functions.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Comprehensive per-function analysis with selectable sections | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, so the safety profile is covered, but the description adds no behavioral context beyond that: it doesn't warn that analysis is potentially expensive/heavy, note that output volume scales with the number of queries and enabled sections, or mention any timeout or truncation behavior. For a batch tool with 16 per-function toggles this is a real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the purpose arrives immediately. It is efficient but borders on under-specification for a tool with this much configurable surface.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, but the description still omits routing versus analyze_function, guidance on section selection, and any note on cost/limits. For a complex batch tool with rich per-query options, one sentence is not sufficient context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every field (addr, include_*, max_*) carries its own description, so the baseline of 3 applies. The description adds nothing about how to shape the queries array or what instance_id does beyond the schema's own note.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (analyze) and resource (target functions) and conveys batch scope via 'one or more', which distinguishes it from a single-function variant. However, it never names the obvious sibling analyze_function or explain what 'comprehensive' entails, so the agent cannot confirm the distinction from the text alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance at all: nothing about choosing this over analyze_function, when batching is preferable to repeated single calls, or how instance_id interacts with the current target. The agent must infer usage entirely from the name and schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_componentGroup analysis of related functionsARead-only
Analyze related functions as a group: per-function summaries, internal call graph, shared data.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Function addresses (comma-separated or list) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | |
| functions | No | |
| string_usage | No | |
| internal_only | No | |
| shared_globals | No | |
| interface_functions | No | |
| internal_call_graph | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already covers the safety profile, so the description's job is smaller. It adds the useful detail that analysis spans a call graph and shared data across functions, but does not state cost, scale limits, or what happens with unrelated addresses, so it only modestly exceeds what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with a colon-delimited list of outputs; every clause carries information and there is zero padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be spelled out, and annotations cover safety. However, 'related' is never defined (related by call graph? by address adjacency?) and multi-address grouping behavior is left ambiguous, leaving a gap for a tool whose whole premise is grouping.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so addrs (comma-separated or list) and the optional instance_id are fully documented in the schema. The description adds no syntax or semantics beyond that, making baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('analyze') and resource ('related functions as a group') and enumerates the outputs: per-function summaries, internal call graph, shared data. This distinguishes it from analyze_function (single) and analyze_batch, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'group' implies usage (analyze several related functions together), but there is no explicit when-to-use, when-not, or named alternative among the many sibling tools like analyze_function, analyze_batch, or callgraph. The agent must infer the selection condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
analyze_functionCompact single-function analysisARead-only
Compact single-function analysis: pseudocode, strings, constants, callers, callees, xrefs, blocks.
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Function address or name | |
| include_asm | No | Include full disassembly (default: false, saves tokens) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| addr | No | |
| name | No | |
| size | No | |
| error | No | |
| xrefs | No | |
| callees | No | |
| callers | No | |
| strings | No | |
| assembly | No | |
| comments | No | |
| constants | No | |
| prototype | No | |
| decompiled | No | |
| basic_blocks | No | |
| decompile_error | No | |
| decompile_truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true, so the description carries the rest and does so usefully: it discloses that this is a bundled summary covering multiple data families (pseudocode, strings, constants, callers, callees, xrefs, blocks) and that output is condensed. That composite, compact nature is real behavioral context an agent cannot get from the annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the purpose front-loaded and the payload listed as a colon-delimited set. Nothing is wasted, though the list is terse enough that it functions more as a label than a full explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and all three parameters are documented in the schema. The description adequately conveys scope and payload for a read-only analysis tool; the missing piece is only routing guidance against sibling analysis tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so addr, include_asm, and instance_id are already fully documented. The description adds nothing parameter-specific beyond the implicit 'compact' framing that relates to include_asm's default of false. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (analysis of a single function) and enumerates exactly what it returns: pseudocode, strings, constants, callers, callees, xrefs, blocks. This makes it distinguishable as an aggregate/overview tool versus focused siblings like decompile, callees, or basic_blocks, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given. With close siblings such as decompile, survey_binary, func_profile, and analyze_batch available, the agent is left to infer that this is the lightweight composite option rather than a targeted one. The word 'compact' hints at a token tradeoff but the condition for choosing it is never stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
append_commentsAppend comments at addressesC
Append comments at addresses, deduping exact text by default.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses one trait — deduping exact text by default — which is already present in the schema's dedupe field, but says nothing about persistence, reversibility, permission requirements, or error behavior for a mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the key distinguishing behavior front-loaded. It is efficient, though arguably too spare for a mutation tool with no annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values needn't be explained, but for a batched mutating tool with no annotations and an undocumented required 'items' parameter, the description leaves too much unsaid about preconditions, per-item semantics, and effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%; the top-level 'items' parameter has an empty description. The description restates address/comment intent and the dedupe default (already in the schema) but adds nothing about scope values (auto|func|line) or instance_id selection.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (append), resource (comments) and target (addresses), and 'append' naturally contrasts with the sibling set_comments. It doesn't name or explicitly differentiate itself from set_comments, but the verb choice alone gives a reasonable signal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus set_comments, the obvious sibling, nor any prerequisite (e.g., whether a database must be open and saved). The only usage-adjacent statement is the dedupe default, which is behavior rather than when-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
basic_blocksFunction CFG blocks (paginated)BRead-only
Return function CFG blocks with offset/max_blocks pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Function addresses or names to get basic blocks for (e.g. '0x123e', 'main') | |
| offset | No | Skip first N blocks (default: 0) | |
| max_blocks | No | Max basic blocks per function (default: 1000, max: 10000) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safe-read profile is covered. The description adds the pagination behavior (offset/max_blocks), but does not disclose anything beyond the schema, such as multi-address batching semantics or ordering of returned blocks. With annotations and a full output schema present, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no padding; the resource and pagination scope lead immediately. It is efficient, though almost too terse to carry any routing or behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a full input schema, an output schema, and readOnlyHint annotations, the structured data carries most of the burden, and the description is minimally sufficient. It still omits any indication of how this differs from disassembly or function-listing siblings, which is the one contextual gap that matters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter (addrs, offset, max_blocks, instance_id) documented including defaults, max values, and example formats. The description merely restates the pagination parameters, adding no syntax or meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Return function CFG blocks') plus the pagination mechanism, so the agent knows exactly what comes back. It does not differentiate from nearby tools like disasm, func_query, or list_funcs, which also surface per-function structural data, leaving sibling selection to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no prerequisites, and no named alternative for retrieving control-flow information. An agent must infer that this is the CFG-block tool rather than disasm or func_query based on the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
calleesUnique callees per functionBRead-only
Return unique callees per function, capped by limit.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Function addresses or names to get callees for (e.g. '0x123e', 'main') | |
| limit | No | Max callees per function (default: 200, max: 500) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes that this is a safe read operation. The description adds that results are unique and capped by limit, but does not disclose anything further about behavior such as instance targeting or output structure. With annotations covering safety, this is minimally adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single front-loaded sentence with no filler. Every clause contributes directly to understanding what is returned and the cap behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, annotations cover read-only safety, and parameters are fully documented in the schema, so the description does not need to explain return values. However, for a tool with many graph-related siblings, it lacks routing guidance that would make selection unambiguous.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so addrs, limit, and instance_id are fully documented in the schema. The description only restates the limit cap idea and adds no syntax or format meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: returning unique callees per function, with a limit cap. It is clear what the tool does, but it does not distinguish itself from related siblings such as callgraph or xrefs_to.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no alternatives mentioned, and no conditions for choosing this tool over callgraph or other graph/query tools. Usage context is only implied by the tool name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
callgraphBounded call graph from rootsBRead-only
Build bounded callgraph from roots with depth/node/edge limits.
| Name | Required | Description | Default |
|---|---|---|---|
| roots | Yes | Root function addresses to start call graph traversal from | |
| max_depth | No | Maximum depth for call graph traversal | |
| max_edges | No | Max edges across the graph (default: 5000, max: 200000) | |
| max_nodes | No | Max nodes across the graph (default: 1000, max: 100000) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| max_edges_per_func | No | Max edges per function (default: 200, max: 5000) |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so safety is covered. The description adds that the graph is bounded by depth/node/edge limits, which is useful behavioral context beyond annotations. However, it doesn't disclose behavior when limits are exceeded or other operational details. Score 3.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with zero waste. It packs the action, source, and constraints into 11 words. Score 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values needn't be explained. The description covers the core operation and its bounding behavior. It omits edge-case behavior when limits are hit, but given rich structured data, it's adequately complete. Score 4.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters are already documented. The description only mentions 'depth/node/edge limits', which maps directly to existing schema fields without adding syntax or usage details. Baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies a clear verb+resource ('Build bounded callgraph from roots') and indicates the traversal is scoped by depth/node/edge limits. It distinguishes from a simple callees tool by emphasizing multi-level traversal with bounds, though it doesn't explicitly name a sibling. Score 4.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance or alternatives. It simply states what it does, leaving the agent to infer when a bounded callgraph is preferable to alternatives like callees or xrefs_to. Score 2.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
close_databaseRelease IDA databaseA
Release this session's lease on an IDA database (.i64/.idb) without disrupting other clients. If this is the final lease on a managed idalib worker, orphaned IDA Python execution is cancelled and this call waits for the IDB to shut down. Databases open in the IDA GUI stay open.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, release the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| closed | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that other clients are unaffected, that the final lease cancels orphaned IDA Python execution, that the call blocks until the IDB shuts down, and that GUI-opened databases stay open. The one gap is whether unsaved changes are lost on release, which matters for a close operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core action and its blast radius, then escalating to the final-lease edge case and the GUI exception. Every sentence adds a distinct fact with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, and the single parameter is covered by the schema. The description covers the key behavioral edges (final lease, blocking wait, GUI sessions) but omits the unsaved-changes question, which is the main remaining unknown for a close tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, and the schema already documents it fully (100% coverage) including the default and the 'release the current target' fallback. The description adds no format or semantics beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (release lease) and resource (an IDA database .i64/.idb) with scope qualifiers ('this session's lease', 'without disrupting other clients'). This is immediately distinguishable from open_database, save_database, and idb_save, which all operate on the same resource with different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the consequences of closing but never routes the agent explicitly — it does not say to use save_database/idb_save first if changes must persist, nor when to prefer close over just letting a session lapse. Usage is implied by the action but no alternative is named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
declare_stackCreate function stack variablesC
Create stack variables from typed stack declarations.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden yet says nothing about mutation semantics: whether declarations overwrite existing stack variables, whether they fail on conflict, or what state the database must be in. It does not even disclose that this writes to the IDB.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with no wasted clauses, but it is terse to the point of under-specification rather than efficient density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, an undocumented required array parameter, and sibling tools that overlap in purpose, the description is far too thin; the output schema offsets some of this, but input-side and behavioral gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: instance_id is documented in the schema, but the required 'items' parameter has an empty description and nested field meanings (addr/offset formats) are only terse labels. The description adds nothing about batching, item shape, or offset syntax to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb+resource (create stack variables) is identifiable, but 'typed stack declarations' is jargon that only marginally clarifies the operation, and nothing distinguishes it from nearby siblings like stack_frame, declare_type, or add/delete_stack.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this versus stack_frame, declare_type, type_apply_batch, or delete_stack, and no prerequisites such as needing an open database or defined function.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
declare_typeDeclare C types in the local libraryC
Declare C type definitions in local type library.
| Name | Required | Description | Default |
|---|---|---|---|
| decls | Yes | C type declarations | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, yet it discloses almost nothing beyond the bare action. It does not say whether declarations persist to the IDB, whether they overwrite existing types, what happens on conflicting definitions, or what the output looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short, front-loaded sentence with no filler. It is efficient, though its brevity is partly under-specification rather than disciplined conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the two parameters are fully covered by the schema. Still, for a mutation tool with no annotations, the description omits persistence behavior, overwrite semantics, and usage context, leaving meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (decls, instance_id) are documented in the schema, so the schema does the heavy lifting. The description adds no syntax, format, or scoping detail beyond what the schema already states, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Declare C type definitions'), so an agent knows it writes types into the local library. However, it does not distinguish itself from close siblings such as set_type, type_apply_batch, enum_upsert, or type_inspect, which an agent could easily confuse with this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no statement of prerequisites, and no mention of alternatives among the many type-related siblings. The agent must infer usage entirely from the name and title.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decompileDecompile function to pseudocodeARead-only
Decompile function(s) at address(es); returns pseudocode and per-item errors.
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Function address or name to decompile | |
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| include_addresses | No | Append /*0xNNNN*/ markers per line (default: true). Set false to save tokens. |
Output Schema
| Name | Required | Description |
|---|---|---|
| addr | Yes | |
| code | Yes | |
| refs | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With only readOnlyHint=true in annotations, the description adds useful behavioral context by stating it returns pseudocode and per-item errors. This tells the agent the output format and that partial failures are possible, though it does not discuss performance or analysis-state prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no redundant or wasted wording. It efficiently conveys the core action and output in one pass.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description need not explain return values in detail, and annotations cover the read-only safety profile. However, it provides no usage context relative to the many sibling analysis tools, leaving a meaningful gap for tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents all three parameters. The description mentions address(es) but adds no additional syntax, format, or constraint details beyond what the input schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Decompile function(s) at address(es); returns pseudocode and per-item errors.' It clearly states what the tool does, but it does not explicitly distinguish itself from siblings such as disasm or analyze_function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives like disasm, analyze_function, or func_query. It simply states the action, leaving the agent to infer usage context on its own.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
define_codeDefine code instructionsC
Convert bytes to code instruction(s) at address(es).
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, and it does not mention that this mutates the database/IDB, whether the change is reversible, what happens on invalid byte sequences at an address, or any permission requirements. It discloses only the bare conversion act.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the action front-loaded and no filler. However, the brevity tips into under-specification rather than true conciseness for a mutating tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but for a database-mutating tool with no annotations and thin parameter documentation, the description omits usage context, mutation semantics, and error behavior that an agent needs before invoking it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, and the top-level 'items' parameter has an empty description in the schema. The description only alludes to 'address(es)' and adds no detail about the item object shape, hex/decimal formatting, 'start:end' bounds, or the instance_id targeting parameter, so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: converting bytes into code instruction(s) at given addresses. This distinguishes it from the sibling make_data (bytes to data) and define_func, though the differentiation from those siblings is left implicit rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no mention of prerequisites, and no routing to alternatives such as make_data (the inverse operation) or undefine/disasm. The agent must infer context entirely from the name and siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
define_funcDefine functions from bytesC
Define functions; IDA infers bounds unless end is provided.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose one useful trait — that IDA infers bounds unless 'end' is supplied — but says nothing about permissions, whether existing definitions are overwritten, or what happens on invalid addresses.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with no filler, and the default-bound behavior is front-loaded. However, its brevity comes at the cost of the context the tool actually needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and a required parameter whose schema description is blank, the description is too thin. An output schema exists, so return values need not be explained, but batching semantics and usage context should be.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, and the required 'items' parameter has an empty description in the schema, leaving its array-of-objects shape unexplained. The description partially compensates by clarifying the addr/end relationship, but does not explain the batching nature of 'items'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a verb+resource ('Define functions') but the operation is opaque — defining a function from bytes is not self-explanatory, and the description offers no frame like 'converts raw bytes at an address into a recognized function'. It does not distinguish itself from siblings such as define_code or analyze_function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or prerequisite guidance is given, and no sibling is named as an alternative despite define_code and analyze_function being adjacent. The agent must infer the entire context of use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_stackDelete function stack variablesC
Delete stack variables by name or offset.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not disclose whether deletions are reversible, what permissions are required, how batch items are processed, or what happens when a name/offset is not found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is appropriately terse for the tool's surface-level purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists so return values need not be described, the definition is incomplete for a destructive mutation tool with no annotations and 50% schema coverage. It omits usage context, deletion semantics, and required parameter structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%, with the required 'items' parameter left undocumented and structured as a confusing anyOf of array or object. The description mentions 'offset', but the schema exposes only 'addr' and 'name', and it does not explain the batch/list semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Delete') and resource ('stack variables'), and identifies the selectors ('by name or offset'). It does not distinguish itself from sibling tools like declare_stack or stack_frame, but the core purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no when-to-use guidance, no prerequisites, and no comparison to alternative tools such as declare_stack or stack_frame. The agent must infer that this tool is used to remove existing stack variables.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_obfuscationDetect obfuscation patternsBRead-only
检测常见混淆模式:控制流平坦化、字符串加密、反调试、死代码,返回各标志与详情。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| function_address | Yes | 要检测混淆的函数地址 |
Output Schema
| Name | Required | Description |
|---|---|---|
| details | No | |
| dead_code | No | |
| anti_debug | No | |
| flattening | No | |
| string_encryption | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a non-mutating analysis. The description adds useful context by naming the pattern categories covered and noting it returns per-flag results and details, but it says nothing about analysis cost, timeouts, or limits on functions that can be scanned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that lists the detection scope and the return shape with zero padding. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover the safety profile; the description covers purpose and detection scope adequately. Minor gap: no note about how this differs from the broader analyze_function report tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are documented there, including the optional instance_id fallback and the function_address meaning. The description adds no parameter-level detail beyond confirming the target is a function, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (detect) and resource (obfuscation patterns) and enumerates the concrete pattern classes checked (control-flow flattening, string encryption, anti-debugging, dead code). This distinguishes it from analysis siblings, though it never names an alternative tool directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use / when-not-to-use guidance and no mention of related siblings such as analyze_function or analyze_batch that also operate on a function. The agent must infer the entry condition (having a function address) from the schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diff_before_afterBefore/after decompile of one editA
Rename a function, set its type, or add a comment, and immediately see the before/after decompilation side by side. Use this instead of calling rename then decompile separately when you want to verify that a rename or type change actually improved readability. Actions: 'rename_func' (action_args: {name: str}), 'set_type' (action_args: {type: str}), 'set_comment' (action_args: {comment: str}). Returns {before, after, action_applied, changes_detected}. Especially useful during batch renaming to confirm each change had the intended effect.
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Function address | |
| action | Yes | Action: 'rename_func', 'set_type', 'set_comment' | |
| action_args | Yes | Arguments for the action | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| after | No | |
| error | No | |
| before | No | |
| action_applied | No | |
| changes_detected | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, and it does disclose the return shape {before, after, action_applied, changes_detected} and the exact effect of each action. What it leaves unstated is whether the edit is persisted/committed to the database or reversible, which matters for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action-then-observe behavior and tight overall, but the opening clause ('rename a function, set its type, or add a comment') is partially restated by the following 'Actions:' list, so one sentence is somewhat redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the actions, their arguments, the intended workflow, and the return payload; an output schema exists so return values needn't be spelled out, and the remaining schema parameter (instance_id) is self-documented. Nothing required to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema documents addr/action/action_args/instance_id at 100% coverage, but the nested action_args is a bare untyped object; the description compensates by enumerating the per-action payloads ('rename_func' -> {name: str}, 'set_type' -> {type: str}, 'set_comment' -> {comment: str}), which is genuine meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource: apply a specific edit (rename/set_type/set_comment) to a function and return before/after decompilation. It contrasts itself against the sibling pattern (rename then decompile separately), so an agent can distinguish it from 'rename', 'set_type', and 'decompile' without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative workflow it replaces (calling rename then decompile separately) and the condition that selects it (verifying a rename or type change improved readability), plus a second scenario (confirming each change during batch renaming). When-to-use is stated, not inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
disasmDisassemble a functionBRead-only
Disassemble function with offset/max_instructions pagination and optional total count.
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Function address or name to disassemble | |
| offset | No | Skip first N instructions (default: 0) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| include_total | No | Compute total instruction count (default: false) | |
| max_instructions | No | Max instructions per function (default: 5000, max: 50000) |
Output Schema
| Name | Required | Description |
|---|---|---|
| asm | No | |
| addr | No | |
| error | No | |
| cursor | No | |
| instruction_count | No | |
| total_instructions | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes that this is a safe read operation. The description adds that results support offset/max_instructions pagination and optional total counting, but does not explain output shape, limits behavior, or permissions beyond what the schema provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. It names the action and the notable behavioral controls immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and all parameters are fully described in the schema. However, given the large set of disassembly-adjacent siblings, the description should do more to explain when this tool is preferable to decompile or instruction-query tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters thoroughly. The description mentions offset, max_instructions, and total count, but adds no syntax or semantic detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: disassemble a function, with pagination and total-count features. It is clear what the tool does, but it does not distinguish itself from nearby siblings such as decompile, insn_query, or basic_blocks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool instead of decompile, insn_query, basic_blocks, or get_bytes. Usage is only implied by the word 'Disassemble', with no alternatives or exclusions named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
entity_queryGeneric IDB entity queryCRead-only
Query IDB entities with typed filters, projection, and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Generic entity query with filtering, projection, and pagination | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read. The description adds essentially nothing behavioral beyond that: it does not mention multi-query batching semantics, that count=0 means all, instance_id fallback to the current target, or any rate/size limits. With annotations covering safety, the description contributes only restated structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no padding, which is appropriately sized for a thin wrapper tool. It is efficient, though minimal to the point of under-specification for a tool of this breadth.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and annotations carry the safety profile. What is missing is the routing context: with ~60 sibling tools, a generic query tool needs at least a pointer to when it is the right choice. Minimum viable but with a clear gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every flag (kind, filter, regex, sort_by, offset, count, etc.). The description's mention of "typed filters, projection, and pagination" loosely maps to those params but adds no syntax or interaction detail. Baseline 3 when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a generic verb+resource ("query IDB entities") and hints at capability areas (typed filters, projection, pagination). However, "IDB entities" is vague and never names the concrete kinds (functions/globals/imports/strings/names) that the schema exposes, and it does nothing to distinguish this from the many specialized siblings like func_query, xref_query, insn_query, and type_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance at all. Given the sibling list contains numerous purpose-built query tools, the agent has no signal for when the generic entity_query is preferred over func_query/list_funcs/imports_query. It states what it can do but not when to reach for it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enum_upsertCreate or extend a local enumB
Create or extend local enums in an idempotent way.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Create enums if missing and upsert enum members without destructive replacement | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose one genuine behavioral trait: the operation is idempotent. However it omits other relevant traits for a mutating tool, such as persistence (local to the database, requiring a save), permission needs, or what happens to existing members on conflict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is arguably slightly under-specified for a mutation tool, but it is not padded or redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, and the parameters are well covered by the schema. Still, for a mutating tool with no annotations, the description should say more about scope and effect (local enum in the current database, non-destructive member upsert) than the single sentence provides.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents 'queries', the nested name/members/bitfield structure, and 'instance_id'. The description adds no syntax or format detail beyond the schema, which is the expected baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (create/extend) and resource (local enums) and adds the distinguishing modifier 'idempotent way'. An agent can tell it apart from the broader type tools (declare_type, set_type), though it does not explicitly name which sibling is the non-idempotent alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance, and no routing to alternatives like declare_type or type_apply_batch. The word 'idempotent' hints at a use case (safe repeated upserts) but leaves the choice between siblings entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_pythonRun IDA Python analysisA
Run Python (IDAPython and the ida-domain API) against the binary open in IDA: decompile a function to Hex-Rays pseudocode, disassemble (disasm) instructions, enumerate functions, strings, imports, exports, symbols, segments and sections, find cross references (xrefs to/from an address, callers, callees, call graph), get the function at an address, inspect or apply types and structs, rename functions and variables, add comments, and patch bytes. Returns the result plus stdout/stderr. Look up API names with reference first.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Python code that runs against an already-open database. Call reference(query) first; do not guess the API shape. `db` is the current ida-domain Database, and `ida_domain` is also imported globally. Imports, variables, and definitions persist for this agent's database lease. A single or trailing expression is returned. For function-style code, define run(db), execute(db), or main(db); it is invoked automatically when there is no trailing expression. | |
| timeout | No | Python execution timeout in seconds. This does not include the separate initial autoanalysis wait. | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes | |
| stderr | Yes | |
| stdout | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations were provided, the description carries the full burden of behavioral transparency. It details critical operational characteristics such as returning 'the result plus stdout/stderr,' and importantly, that 'Imports, variables, and definitions persist for this agent's database lease.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description suffers from being a massive, highly detailed feature list, making it lengthy. However, given the nature of an arbitrary execution tool, the high density of crucial information justifies keeping it from a lower score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is extremely complete for such a complex execution tool. It defines the operational scope (what can be done), the environment constraints (persistence, APIs), the input format, and the output behavior (result + I/O streams).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds deep semantic value to the `code` parameter. It specifies architectural requirements for writing code, such as using `run(db)` or `execute(db)` for function-style code, and defining the scope of the global variables (`db`, `ida_domain`).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly defines the tool as a general execution engine for IDA Python (IDAPython and ida-domain API). It distinguishes itself from specialized sibling tools (like `decompile` or `patch`) by providing a comprehensive list of arbitrary analysis capabilities the code can perform.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides essential usage guidance by advising the agent to 'Look up API names with reference first.' Furthermore, the input schema reinforces this by stating, 'Call reference(query) first; do not guess the API shape,' guiding the agent on workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_funcsExport function prototypesCRead-only
Export function data for addresses in json/c_header/prototypes formats.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Function addresses or names to export (e.g. '0x123e', 'main') | |
| format | No | Export format: json (default), c_header, or prototypes | json |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true is the only behavioral signal, and the description adds little beyond it. 'Export' is ambiguous about whether output is written to a file or returned inline, and there's no mention of permissions, limits, or handling of unresolved addresses.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with the formats front-loaded and no filler. It is appropriately terse, though it could have used the space to disambiguate the export behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and params are fully documented in the schema. However, the core ambiguity of whether this produces a file or a data payload is left unresolved, which matters for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents addrs, format, and instance_id with examples and defaults. The description only restates the format list, adding no syntax or edge-case detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb+resource ('Export function data') and enumerates the output formats. It doesn't differentiate itself from nearby siblings like decompile, list_funcs, or func_query, so an agent can't easily tell why it would pick this over them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no conditions, and no alternatives named. The description never explains when exporting is preferable to querying or decompiling, leaving the agent to infer the use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
findSearch strings/immediates/refsBRead-only
Search strings/immediates/refs for targets with offset/limit pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| type | Yes | Search type: 'string', 'immediate', 'data_ref', or 'code_ref' | |
| limit | No | Max matches per target (default: 1000, max: 10000) | |
| offset | No | Skip first N matches (default: 0) | |
| targets | Yes | Search targets (strings, integers, or addresses) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds the offset/limit pagination behavior, which is useful, but says nothing about result shape beyond what the output schema carries and nothing about rate or scope caveats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with no filler and the pagination trait placed at the end. It is appropriately sized, though somewhat telegraphic for a 5-parameter search tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, and the schema covers all parameters. What is missing is context that would let an agent choose this tool over its many search siblings, so completeness is only minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (type, targets, limit, offset, instance_id) is already documented in the schema. The description only restates offset/limit pagination and adds no syntax or semantics beyond that, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource ('Search strings/immediates/refs for targets'), so an agent knows it retrieves occurrences of specific values inside a binary. However, it never distinguishes itself from close siblings like find_regex, find_bytes, search_text, or xref_query, which an agent could easily confuse with this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no prerequisites, and no comparison to alternatives. Given a large sibling set of similarly named search tools (find_regex, find_bytes, search_text, entity_query), the absence of routing guidance is a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_bytesByte pattern searchBRead-only
Search byte patterns (supports ??) with offset/limit pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max matches per pattern (default: 1000, max: 10000) | |
| offset | No | Skip first N matches (default: 0) | |
| patterns | Yes | Byte patterns to search for (e.g. '48 8B ?? ??') | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already declares this a safe read. The description adds the wildcard and pagination context, but the offset/limit behavior is already documented in the schema parameters, so the added value beyond structured fields is thin. Nothing contradicts the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the key capability is stated first. It is efficient, though arguably terse given the sibling landscape.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and full schema coverage, the description need not explain returns or parameters. It is minimally adequate, but missing sibling differentiation and any prerequisite context (e.g. reliance on an open/current database target) given the four related search tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, covering patterns, offset, limit, and instance_id, so the schema carries the parameter burden. The description's mention of '??' syntax adds a small amount that overlaps with the schema example '48 8B ?? ??'. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search byte patterns') and names a distinguishing capability (?? wildcards, offset/limit pagination). However, it does not distinguish itself from closely related siblings such as find_regex, get_bytes, search_text, or find.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only describes what the tool does, not when to choose it over alternatives. With siblings like find_regex and search_text available, an agent gets no guidance on which search tool applies to which case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_regexSearch strings by regexARead-only
Search strings by case-insensitive regex with offset/limit pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max matches (default: 30, max: 500) | |
| offset | No | Skip first N matches (default: 0) | |
| pattern | Yes | Regex pattern to search for in strings | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| n | No | |
| error | No | |
| cursor | No | |
| matches | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true (safety profile), so the description adds real behavior: matching is case-insensitive, which is non-obvious and not stated in the schema, and results are paginated via offset/limit. It still omits any note on scope limits (e.g., which database/instance is searched by default) or match-count behavior at the 500 cap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the operation, the matching mode, and the pagination model with zero filler. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and all parameters are covered by schema descriptions. The only meaningful gap is the absence of routing guidance relative to the many other search/lookup siblings, which an agent must guess at.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (limit, offset, pattern, instance_id) are already documented with defaults and ranges. The description only restates the offset/limit pagination concept and adds no format or syntax detail for the regex itself, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (search) and resource (strings) plus the mechanism (regex), so the agent knows exactly what the tool returns. It does not distinguish itself from nearby siblings such as search_text, find_bytes, or find, which leaves ambiguity about which search tool applies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no exclusions, and never names an alternative search tool even though the sibling list contains find, find_bytes, and search_text. Usage must be inferred entirely from the name and title.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_xref_signaturesSignature generation at xref sitesARead-only
Find signatures for code locations that reference an address. For each input address, finds all code cross-references TO it, generates a unique signature at each xref site, and returns the shortest ones. Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Number of shortest signatures to return per address (default: 5) | |
| addrs | Yes | Address(es) or name(s) to find XREF signatures for (e.g. a data address referenced by code) | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| max_length | No | Maximum signature length in bytes (default: 250) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, so the bar is lower. The description adds genuinely useful behavior beyond that: it locates xrefs TO each address, generates a unique signature per xref site, and returns the shortest ones, which is non-obvious pipeline behavior an agent needs to interpret results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: verb/resource first, mechanism second, use case last. Front-loaded and free of filler, though the middle sentence could be marginally trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the read-only annotation covers safety. The description covers purpose, mechanism, and use case adequately. The only minor gap is that it doesn't hint at how to choose among the related signature-generation siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (top, addrs, format, max_length, instance_id) is already documented in the schema. The description only reinforces that it operates 'for each input address,' adding no syntax or format detail beyond the schema. Baseline 3 applies when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Find signatures for code locations that reference an address.' It spells out the mechanism (finds xrefs TO the address, generates a signature at each xref site) which clearly separates it from siblings like make_signature, make_signature_for_function, and make_signature_for_range that operate on directly-signaturable targets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Ideal for creating signatures for data addresses, vtable entries, or string references that can't be signatured directly' gives a clear when-to-use condition. It stops short of naming the sibling alternatives (e.g. make_signature for directly-signaturable code) as an explicit fallback, so it is context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
force_recompileInvalidate Hex-Rays decompile cacheA
Invalidate the Hex-Rays decompile cache for one or more functions.
Use after set_type, rename (especially of locals), set_op_type, or
make_data so the next decompile call regenerates fresh pseudocode
instead of returning a cached, stale view.
| Name | Required | Description | Default |
|---|---|---|---|
| items | No | List of {addr: function-entry-EA} ops, or a single op. Omit / pass empty list to recompile every function. | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the bundle and does well: it discloses that this is a state-invalidating side effect whose observable result appears on the subsequent `decompile`. It omits cost/performance implications of a full-cache regeneration and any concurrency or permission notes, which would be the remaining gap for an unannotated mutation-style tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences: the action first, then the trigger conditions and rationale. No filler, no repetition of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, and the description covers what the tool does, when to call it, and why. Everything needed to invoke it correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both `items` (including the omit-to-recompile-everything default) and `instance_id` are already documented in the schema. The description only echoes the 'one or more functions' scope without adding format or semantic detail, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (Invalidate) plus precise resource (Hex-Rays decompile cache) plus scope (one or more functions). Clearly distinguishable from siblings like decompile, which reads the cache rather than invalidating it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the precondition tools (`set_type`, `rename`, `set_op_type`, `make_data`) that require this call and explains the payoff: the next `decompile` returns fresh rather than stale pseudocode. This is the when-to-use guidance an agent needs, with a named downstream tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
func_profileFunction profiling queryBRead-only
Profile functions with summary metrics and optional sampled details.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Function profiling query (supports name/address filters + pagination) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint=true annotation already establishes that this is a safe read operation. The description adds useful behavioral context by noting sampled and optional details, but it does not mention permissions, rate limits, or execution cost.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the core action and scope. It wastes no words and is appropriately sized given that the schema and output schema carry the detailed structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema handles return values and 100% schema coverage handles parameters, so the remaining need is usage context. The description omits when to choose func_profile over func_query, lookup_funcs, or analyze_function, leaving a routing gap for this profiling tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; fields like addr, count, filter, sort_by, include_lists, and instance_id are all documented in the schema. The description adds no parameter meaning beyond that, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb 'Profile' and resource 'functions' and clarifies that output includes summary metrics plus optional sampled details. It does not differentiate from sibling tools such as func_query, lookup_funcs, or analyze_function, so it earns 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no when-to-use guidance, no prerequisites, and no named alternatives. It leaves the agent to infer context from the many sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
func_queryQuery functions by filtersBRead-only
Query functions with richer filtering than list_funcs.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Richer function query (size/type/name filters + pagination) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true is already provided, and the description adds essentially no behavioral context beyond it — no note on pagination via count/offset, result limits, sorting, or how the multi-clause queries list is combined. For a query tool this leaves real behavioral gaps unfilled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler, and the sibling comparison is placed first. It is arguably too terse for a filtering tool, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, and the schema fully documents the two parameters. The remaining gap is that 'richer filtering' is undefined and pagination/sorting behavior is never surfaced, leaving the description only minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (count, filter, sort_by, min/max_size, etc.) is already documented in the schema. The description adds nothing about filter syntax or how the queries array/object alternatives behave, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Query) and resource (functions) and explicitly differentiates from the sibling list_funcs by claiming 'richer filtering.' However, it never says what 'richer' means, so an agent must open the schema to learn the actual filter dimensions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names list_funcs as the comparator, implying this tool is for cases needing more filtering power than list_funcs offers. But it gives no explicit when-to-use/when-not guidance nor states the concrete conditions that select it over the sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_analysis_report_mdStructured markdown reportARead-only
一键生成结构化 markdown 报告,帮助快速理解程序核心逻辑(全量函数扫描)。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes that this is a safe read operation. The description adds useful scope context by noting a full function scan, which signals that the operation may be expensive. It does not say whether the report is returned or written to disk, and it gives no cost, time, or output-location details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence front-loads the action (“一键生成结构化 markdown 报告”) and then states the purpose. There is no redundant or filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an annotation covering safety and a fully documented optional parameter. However, with no output schema, the description should clarify whether the markdown report is returned, saved, or shown elsewhere, and should distinguish this tool from the closely related get_analysis_report sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the sole optional instance_id parameter is fully documented in the schema. The description adds no parameter-level guidance beyond the schema. Baseline 3 is appropriate when the schema already does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description supplies a specific verb and object, “一键生成结构化 markdown 报告,” which clearly states what the tool produces. It adds “帮助快速理解程序核心逻辑(全量函数扫描)” to set scope. However, it never distinguishes this tool from the sibling get_analysis_report, so the agent cannot tell which one to call.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical “(全量函数扫描)” implies the tool is for a broad analysis pass, and “帮助快速理解程序核心逻辑” suggests a context where the tool is useful. There is no explicit guidance on when to use this tool versus get_analysis_report or analyze_batch, and no exclusions or prerequisites are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_algorithm_signatureDetect common crypto/algorithm patternsBRead-only
自动识别常见算法(md5/sha/aes/des/rc4/tea/xor/base64/crc32/zlib 等),返回算法类型和置信度。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| function_address | Yes | 要识别算法的函数地址 |
Output Schema
| Name | Required | Description |
|---|---|---|
| algorithm | Yes | |
| confidence | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already establishes this is a safe read operation, lowering the disclosure bar. The description adds that it returns algorithm type and confidence, but that return content is already covered by the output schema, and it discloses nothing about detection coverage, false-positive behavior, or cost. It adds only marginal behavioral context beyond the annotation and schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the action, the algorithm list, and the return shape, all front-loaded with no filler. It is efficient, though the parenthetical list is somewhat long relative to the payload.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With readOnlyHint covering safety and an output schema covering the return format (algorithm type and confidence), the description need not explain return values. It adequately frames a read-only detection tool, with the only gap being the absence of routing guidance against adjacent analysis tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented in the schema (instance_id defaulting to current target, function_address as the target function). The description adds no parameter-level meaning beyond this, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (自动识别/automatically identify) and resource (common algorithms, listing md5/sha/aes/des/rc4/tea/xor/base64/crc32/zlib) and indicates the return value (algorithm type and confidence). An agent can immediately grasp what the tool does, though it does not explicitly name which sibling (e.g. detect_obfuscation) it should be chosen over.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use/when-not-to-use guidance and no mention of alternatives such as detect_obfuscation or analyze_function, which are adjacent analysis tools. Usage is only weakly implied by the tool's own nature, and the description never says under what circumstances to reach for it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_analysis_reportFull entity inventory reportBRead-only
自动生成结构化分析报告(函数/全局/字符串/入口点全量清单)。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| globals | Yes | |
| strings | Yes | |
| functions | Yes | |
| entry_points | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, so the bar is lower. The description adds that the output is a full/unfiltered inventory spanning multiple entity classes, which is useful, but says nothing about cost or scope of the scan (a whole-database aggregation could be expensive) or whether the report is persisted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with the parenthetical content list doing real work; nothing is padded. It is close to a restatement of the title, but it earns its place by naming what the report contains.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the schema fully covers the lone parameter. What is missing is the decision context: with ~50 siblings including generate_analysis_report_md and numerous list tools, an agent cannot tell from this description when this report is the right call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single optional instance_id is fully documented in the schema (including the 'use the current target' default behavior). The description adds no parameter-level meaning beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (generate) and resource (structured analysis report) and enumerates the contents: functions, globals, strings, entry points as a full inventory. However, it does not differentiate itself from the near-identical sibling generate_analysis_report_md, which leaves an agent guessing which report tool to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no routing advice relative to siblings like generate_analysis_report_md, survey_binary, or the many list_* / entity_query tools that also enumerate functions and globals. The agent must infer the choice entirely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_bytesRead raw bytes from memoryCRead-only
Read bytes from memory addresses
| Name | Required | Description | Default |
|---|---|---|---|
| regions | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, and the description adds nothing beyond that — no note on behavior for invalid/unmapped addresses, size limits, or what happens with large reads. It repeats the safety signal rather than extending it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single four-word sentence with no padding and the core action front-loaded. It is concise but arguably under-specified for a batched memory-read tool, so it earns only a middling score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need no explanation, but the empty description on the required 'regions' parameter and the absence of any usage or failure-mode context leave the definition too thin for a tool that reads arbitrary memory.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The required 'regions' parameter has an empty schema description, and the tool description does not compensate by explaining that it accepts either a single {addr,size} object or an array of them. Only the nested addr/size and instance_id fields are documented, leaving the most important parameter semantics to inference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (bytes from memory addresses), which separates it from siblings like get_string, get_int, and find_bytes. It is clear but minimal, with no explicit differentiation or scoping detail.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus get_int, get_string, or find_bytes, nor any mention of prerequisites such as a loaded database or valid address range. The agent must infer usage entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dynamic_string_mapStatic + recorded dynamic stringsCRead-only
动态字符串解密映射(静态字符串 + 运行期记录的动态字符串)。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so safety is covered. The description adds useful content context – that the map combines static strings with runtime-recorded dynamic strings – but says nothing about whether a tracing session must have run, how the mapping is keyed, or what happens when no dynamic strings were recorded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with no waste, and the content scope (static + recorded dynamic) is front-loaded. It is efficient, though arguably too terse to be maximally informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the one parameter is fully documented in the schema. However, for a tool whose value depends on runtime recording state, the description omits the precondition and usage context, leaving it only minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single optional instance_id parameter and schema description coverage is 100%, so the schema already explains its meaning and default behavior. The description adds no parameter-level detail, which is the expected baseline when the schema carries the burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is a noun phrase naming the resource (a decryption mapping of dynamic strings) without an explicit verb, though the tool name get_dynamic_string_map supplies the action. It does distinguish content scope from siblings like get_string by noting it merges static strings with runtime-recorded dynamic strings, but the phrasing is vague about what is actually returned or produced.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this instead of get_string, get_global_value, or search_text. No prerequisites, no exclusions, and no indication of what state the target must be in (e.g., after a trace run) for runtime-recorded strings to be present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_function_constraintsExtract flag/check constraintsBRead-only
从反编译伪代码中启发式提取 flag/校验约束线索(长度比较、常量 == 等)。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| function_address | Yes | 函数地址 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, covering the safety profile. The description adds 'heuristic', signaling approximate/non-exhaustive results, and lists example patterns, which is useful context beyond annotations, but it omits accuracy caveats or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with the core action and examples. No redundant words, though it could be slightly more structured with prerequisites or output hints.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 100% schema coverage and a readOnly annotation, parameters and safety are covered. However, with no output schema, the description should ideally describe the return format or prerequisites (e.g., requires decompiled function); it leaves these gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters (instance_id and function_address), so the schema already documents them fully. The description adds no parameter-level meaning, making 3 the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (extract flag/check constraint clues) and resource (decompiled pseudocode), with concrete examples (length comparisons, constant ==). Does not distinguish itself from sibling analysis tools like analyze_function or trace_data_flow, so a 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no explicit when-to-use guidance, no prerequisites (e.g., must decompile first), and no alternatives among the many sibling tools. The implied usage from 'decompiled pseudocode' is minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_global_valueRead global variable valuesCRead-only
Read global variable values by address or symbol name.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Global variable addresses or names to read values from | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds no behavioral context beyond that: it does not mention that multiple queries may be batched in one call, how missing symbols or invalid addresses are handled, or that instance_id retargets a different database.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It is efficient, though it is arguably too terse to earn a 5 given the tool-specific nuances left unstated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the two params are fully covered by the schema. What is missing is routing context against the many overlapping sibling read tools, which leaves the definition only minimally viable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented in the schema, and the description's 'address or symbol name' wording merely echoes the queries param. Baseline 3 is appropriate since the schema carries this dimension.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (global variable values), and the 'by address or symbol name' clause clarifies the lookup mode. It does not, however, distinguish itself from the sibling list_globals tool, so an agent must infer that this reads values whereas list_globals enumerates them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no mention of alternatives. With siblings like list_globals, get_int, get_string, and get_bytes all plausibly overlapping in purpose, the description never says when to prefer this tool over them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_intRead integers from memoryCRead-only
Read integer values from memory addresses
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Integer read requests (ty, addr). ty: i8/u64/i16le/i16be/etc | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, so the description's 'Read...' clause is largely redundant with the annotation. It adds nothing about batch behavior (queries accepts an array of read requests), target/instance resolution, or failure modes for invalid addresses.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero padding. It is efficient, though it errs toward under-specification rather than wasteful verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the schema fully documents both parameters. What is missing is any mention that multiple reads can be batched in one call and any routing against sibling read tools, leaving the definition minimally viable for a simple read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% – ty, addr, and instance_id all carry descriptions, and the queries array/object union is documented. The description adds no format, encoding, or addressing detail beyond what the schema already provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Read integer values from memory addresses.' That clearly identifies the operation and distinguishes it from a bare 'get' tautology. However, it does not differentiate from closely related siblings like get_bytes, get_string, get_global_value, or int_convert, which an agent would need to choose between.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no prerequisites, and names no alternative. With siblings such as get_bytes, get_string, get_global_value, and int_convert, an agent has no stated basis for picking get_int over those tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_patch_pointsLocate patchable branch sitesBRead-only
自动定位可 patch 位置(条件跳转、call、反调试 int 0x2d 等)。
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| function_address | Yes | 要定位patch点的函数地址 |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already declares this is a safe read, lowering the bar. The description adds value by disclosing the kinds of sites returned (conditional jumps, calls, anti-debug int 0x2d), but it says nothing about scanning scope, cost, or how the function address maps to results beyond what the schema implies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that gets straight to what is located and gives representative examples. Efficient with no padding, though it is quite terse given the tool's analysis role.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, and the readOnly annotation covers safety. However, the description omits any workflow context (that this precedes patch/patch_asm), leaving a gap for an analysis tool operating among many sibling scanners.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (instance_id, function_address) are already documented in the schema. The description adds no parameter-level meaning beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: automatically locating patchable positions, and enumerates concrete categories (conditional jumps, calls, anti-debug int 0x2d). This distinguishes it from siblings like patch/patch_asm (which apply patches) and disasm, though it doesn't name those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no mention of prerequisites, and no named alternative such as basic_blocks or disasm. Usage is only vaguely implied by the tool's purpose (find sites before patching), which leaves the agent to infer the workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_stringRead strings from memoryCRead-only
Read strings from memory addresses
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Addresses to read strings from | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint=true already declaring the safety profile, the description adds nothing behavioral: it does not say what encoding/null-termination is assumed, how invalid or unmapped addresses are handled, or whether multiple addrs produce per-address results. It merely restates the annotation-backed read semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short, front-loaded phrase with no filler, which is structurally fine. The terse phrasing, however, leaves key semantics unspecified rather than being economically complete, so it only meets the minimum bar.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value shape need not be described, and the annotations cover safety. What remains missing is the string-reading semantics a reverse-engineering agent needs (encoding, terminators, failure behavior), which is material for a tool whose whole purpose is decoding strings from raw addresses.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both addrs and instance_id are already documented in the schema, giving a baseline of 3. The description adds no syntax, format, or batching detail beyond 'memory addresses', so it does not exceed the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a verb and resource (read strings) and the source (memory addresses), so the basic action is unambiguous. However, it is essentially a restatement of the title 'Read strings from memory' and offers no differentiation from close siblings like get_bytes, get_int, get_global_value, or get_dynamic_string_map. An agent cannot tell from the text why it would pick this over those.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no statement of prerequisites, and no mention of alternatives among the many memory-reading siblings. The agent must infer entirely from the name that this is the string-specific counterpart to get_bytes/get_int.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
idb_saveSave the IDB databaseA
Save active IDB to disk, optionally to a provided path.
The open database is backed by loose working files (.id0/.id1/.id2/.nam/.til) that IDA actively manages, headless included. Killing them out from under the open database corrupts it (issues #446, #498), so DBFL_KILL is never used here: an in-place save uses IDA's native save (Ctrl+W), and an explicit different destination gets a compressed copy while the working files stay.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Optional destination path (default: current IDB path) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| path | Yes | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it discloses the loose working-file backing, the corruption risk from killing files (issues #446/#498), the deliberate refusal to use DBFL_KILL, and the differing behavior of in-place vs. new-destination saves. It still omits permission/auth requirements and any note about locking or reopen behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core action is front-loaded in one short sentence, and the behavioral detail follows. The second sentence is long and leans on parenthetical issue numbers, but every clause conveys actionable behavior rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be described, and both parameters plus the save semantics are covered. The one real gap is disambiguation from the sibling save_database, which leaves an agent's tool-selection decision under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description earns above baseline by attaching mode semantics to 'path': empty means an in-place native save, a non-default value yields a compressed copy while working files are retained. The 'instance_id' parameter is left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb and resource ('Save active IDB to disk, optionally to a provided path'), so the agent knows exactly what the tool does. However, it never acknowledges the near-identical sibling 'save_database', so an agent cannot distinguish the two from this definition alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the description explains what happens with an in-place save versus an explicit destination, which helps the agent choose a parameter value, but it gives no guidance on when to prefer this tool over save_database, close_database, or open_database, and states no prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
importsList importsBRead-only
List imports with module names using offset/count pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| count | Yes | Maximum rows (0 returns all imports) | |
| offset | Yes | Starting pagination index (default: 0) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, so the description only needs to add behavioral context. It mentions offset/count pagination, but that is already spelled out in the schema, and it discloses nothing about ordering, result size, or instance scoping.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. Everything stated is relevant to invoking the tool, and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover the safety profile. Still, for a tool with a near-identical sibling (imports_query), the description omits the one piece of context an agent most needs: how it differs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents offset, count (including the '0 returns all' semantics), and the optional instance_id. The description repeats the pagination framing without adding syntax or defaults, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List imports') plus the distinguishing payload detail 'with module names'. However, it never differentiates itself from the sibling imports_query, leaving the agent to guess which listing tool to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of alternatives such as imports_query. The agent gets no help deciding between the two import-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
imports_queryQuery imports with filtersBRead-only
Query imports with richer filtering than imports(offset,count).
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Import query with import/module filters and pagination | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes this is a safe read, so the description must add its own behavioral value. It adds none: nothing about batch/multi-query semantics, glob-vs-regex interpretation, or that count=0 returns everything. Effectively it paraphrases the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler and the key differentiator (richer filtering) placed early. It is arguably too terse for a nested batch-query schema, but on conciseness alone it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described. However, the notable structural feature — queries being an array/object of multiple import queries — is left entirely to the schema, leaving the description thin for this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (filter, module, offset, count, instance_id) is documented in structured data. The description's phrase "richer filtering" gestures at filter/module but adds no meaning beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Query imports") and explicitly compares its scope to the sibling tool imports(offset,count). The differentiator "richer filtering" is vague about which filters are richer, but an agent can still tell it apart from the plain imports listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the alternative (imports(offset,count)) and the condition that selects this one over it, so routing is clear. It stops short of saying when neither tool is appropriate or noting prerequisites such as an open database.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
infer_typesInfer types at addressesCRead-only
Infer and apply likely types at target addresses.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Addresses to infer types for | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description says 'apply likely types', which implies a mutating operation that changes the database's type information. However, the annotations declare readOnlyHint=true, creating a direct contradiction about whether side effects occur. The description does not clarify the discrepancy or describe what is modified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. It is compact but under-specified, which is reflected in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that appears to apply type changes, the description omits critical context: what inferred types look like, whether existing types are overwritten, and why a readOnly annotation coexists with 'apply'. Although an output schema exists, the mutation-vs-readOnly ambiguity leaves the agent without enough behavioral information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are documented in the schema. The description only restates 'target addresses' for addrs and says nothing about instance_id; with full schema coverage, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-resource pair: 'Infer and apply likely types at target addresses.' It is clear what the tool does at a high level, but it does not differentiate itself from close siblings such as set_type, type_apply_batch, or declare_type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives that also set or query types. It also omits prerequisites or conditions such as whether addresses must belong to a function or stack frame.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
insn_queryInstruction query by mnemonic/operandCRead-only
Query instructions with mnemonic/operand filters and scoped scans.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Instruction query with mnemonic/operand filters and scoped scan | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds almost nothing beyond that: it does not disclose that scopeless scans require allow_broad, that scanning is bounded by max_scan_insns, or that results are capped at 5000 — all behaviors that materially affect how the tool is invoked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-formed sentence with no filler and the core capability front-loaded. It is efficiently sized, though the brevity tips into under-specification rather than tight conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only query tool whose schema is fully documented and which has an output schema covering return values, the minimum an agent needs is present. However, the interaction between allow_broad, max_scan_insns, and the count/offset pagination window is left entirely to the schema, which is a meaningful gap for a nested-query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with every one of the 15 nested query fields documented inline (mnem, op0-op2, op_any, start/end/func/segment, count, offset, include_disasm, include_fn, allow_broad, max_scan_insns). The description only restates 'mnemonic/operand filters and scoped scans,' adding no meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Query') and resource ('instructions') and names the filter axes (mnemonic/operand) plus scope. It is clear what the tool does, but it never distinguishes itself from the many sibling query tools (func_query, entity_query, xref_query, imports_query), so an agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of alternatives, and no stated prerequisites. The phrase 'scoped scans' hints that scoping matters but never says when a scopeless scan is appropriate or that allow_broad gates it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
int_convertConvert numbers between formatsCRead-only
Convert numbers to different formats
| Name | Required | Description | Default |
|---|---|---|---|
| inputs | Yes | Convert numbers to various formats (hex, decimal, binary, ascii) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read-only operation, and the description adds nothing on top — no note on accepted input syntax (e.g., prefixes like 0x), how size/auto-detection resolves, or whether conversion is lossless. With annotations covering the safety profile, the description carries little additional behavioral signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence is front-loaded and wastes no words, but its brevity comes at the cost of substance rather than from trimming redundancy — it largely restates the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, and 100% schema coverage documents the parameters. Given the low complexity of a pure conversion tool, the definition is workable, though it leaves the agent inferring the tool's intent and scope entirely from structured fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both the inputs object (with text/size) and instance_id are already documented, including the format list. The description adds no syntax or format semantics beyond the schema, which is the expected baseline-3 outcome when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a verb ("Convert") and a resource ("numbers") but "different formats" is vague — the actual format set (hex, decimal, binary, ascii) lives only in the schema. It does not distinguish itself from near-siblings like get_int or put_int, which also manipulate numeric values.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no conditions, no named alternatives. Nothing tells the agent whether this is for display formatting versus database value mutation, or how it relates to get_int/put_int.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesShow open IDA databasesARead-only
Show the IDA databases (analyzed binaries, .i64/.idb) currently open in the IDA GUI or in headless idalib workers, with their instance ids.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | No | |
| instances | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes that this is a safe read operation. The description adds useful behavioral context by clarifying that it covers both GUI-opened databases and headless idalib workers, and that instance ids are returned, which is more than the annotation alone provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It communicates the resource, scope, and distinguishing context efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters, a read-only annotation, and an output schema present, the description is complete enough for correct invocation. It explains what is listed and where the databases come from, leaving return-value details to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline is 4. The description does not need to explain parameter semantics, and the schema description coverage is 100%, so the description's role here is appropriately minimal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: showing IDA databases currently open in the GUI or headless idalib workers. It also names the concrete artifacts (.i64/.idb) and mentions instance ids, which clearly distinguishes it from open_database and close_database.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'currently open' implies the tool's usage context, and sibling names like open_database and close_database make the broader workflow inferable. However, the description does not explicitly say when to use this versus alternatives or state any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_funcsList functions with filters and paginationBRead-only
List functions with optional filtering and offset/count pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | List functions with optional filtering and pagination | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, and the description adds nothing beyond that — it merely restates that filtering and offset/count pagination exist, which the schema already documents. No mention of result volume, default ordering, or behavior when filters match nothing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single lean sentence with no filler and the core action front-loaded. Efficient, though it is nearly a verbatim restatement of the title rather than adding new substance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with 100% schema coverage and an output schema, the description covers what is needed to call it. Nothing critical is missing, though it provides no extra orientation against the many sibling query tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the individual fields (filter, offset, count, instance_id) are already fully explained in the schema. The description only echoes pagination/filtering at a high level and adds no syntax or format detail beyond the structured data, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (functions) with a note on filtering/pagination scope. However it does not distinguish itself from siblings like lookup_funcs, func_query, or export_funcs, which an agent could easily confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of the sibling tools that also query functions. The agent is left to infer that this is the unfiltered-list option versus lookup_funcs or func_query.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_globalsList globals with filters and paginationBRead-only
List globals with optional filtering and offset/count pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | List global variables with optional filtering and pagination | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safe read profile is covered. The description adds that filtering and offset/count pagination are supported, which is useful behavioral context, but it omits auth needs, rate limits, or other operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single front-loaded sentence with no wasted words. It conveys the core purpose and the filtering/pagination capability immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and parameter descriptions are complete, so the description need not explain return values or parameter details. It is adequate for a simple read-only listing tool, though usage guidance is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters including count, filter, offset, and instance_id. The description mentions filtering and pagination but adds no syntax or format meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('globals'), and notes filtering and pagination. It is clearly distinguishable from siblings like list_funcs and list_databases by resource, but it does not explicitly contrast itself with those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use guidance, prerequisites, or alternatives. It only describes what the tool returns, not when an agent should choose it over get_global_value or other listing tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_funcsLook up functions by address or nameBRead-only
Get functions by address or name (auto-detects)
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Address(es) or name(s) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, and an output schema exists so return-shape detail is unnecessary. The description's one contribution is that address-vs-name detection is automatic, which is modest added context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It is arguably too terse for the crowded sibling namespace, but every word present earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read lookup with full schema coverage, an output schema, and a readOnly annotation, the basics are covered. The notable gap is that with 40+ siblings containing func_query, list_funcs, and entity_query, the description never clarifies the boundary, which is the main thing an agent needs here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (queries, instance_id) are already documented in the schema, including the anyOf array-or-string shape and the instance fallback behavior. The description's 'address or name' phrasing merely echoes the queries param, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get functions') plus the two accepted key types (address or name), which is clear. However, it does not distinguish this tool from near-neighbors like func_query, list_funcs, or entity_query, leaving the agent to guess which lookup surface applies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no exclusion of alternatives, and no statement of when func_query or list_funcs would be preferable. The parenthetical 'auto-detects' hints at input handling but not at tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_dataCreate typed data symbolsA
Create a typed data symbol at an address, replacing any prior items.
Use this to harden a symbol boundary that the decompiler is currently
expressing through a neighboring global plus offset. set_type alone
leaves the underlying byte items unchanged; this tool deletes them
first, then re-creates them at the right size with the right type, then
optionally renames.
The type field is a full C declaration with a placeholder name, e.g.
"ISP_SNS_STATE_S * g_pastImx290[4]" — IDA parses it via SetType.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Data-creation ops. Each {addr, type, name?} replaces existing data items at addr with a fresh symbol of the given type. | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does disclose the key destructive behavior: it replaces prior items and deletes the underlying byte items before recreating them. It also explains the optional rename step and type format. It omits any permission/auth requirements, minor gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short paragraphs, front-loaded with the core action and the sibling comparison. Every sentence adds information (destruction semantics, alternative, type format), though it is slightly longer than strictly necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, and the description covers the destructive write behavior, the type format, and the sibling relationship. Missing only invocation prerequisites, which are minor given the rich structural data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema for the `type` field: a full C declaration with a placeholder name, illustrated with a concrete example and the IDA SetType mechanism. Other fields (addr, name, delete_existing) are left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a typed data symbol at an address') and immediately distinguishes it from the sibling set_type by noting that set_type leaves byte items unchanged while this deletes then recreates them. An agent can tell it apart from related type tools without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative (set_type) and the condition that selects this tool ('harden a symbol boundary that the decompiler is currently expressing through a neighboring global plus offset'). This is a clear when-to-use with sibling differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_signatureUnique signature at an addressARead-only
Create unique byte signatures for addresses. Generates the shortest unique signature starting at each address by walking instructions and wildcarding operands. Useful for finding stable patterns that survive recompilation.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Address(es) or name(s) to create unique signatures for (e.g. '0x401000', 'main', or ['0x401000', 'sub_402000']) | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| max_length | No | Maximum signature length in bytes before giving up (default: 1000) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| wildcard_operands | No | Wildcard instruction operands for relocatable signatures (default: true) |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true, so the description carries most of the behavioral burden and does add real value: it explains the generation strategy (walk instructions, wildcard operands) and the goal (shortest unique signature), which tells the agent the output can vary in length and depends on uniqueness failing/succeeding. It still does not say what happens when no unique signature is found, but the added algorithm context is substantive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with the core action front-loaded and no filler; the algorithm detail and the recompilation rationale each earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be described, and readOnlyHint covers the safety profile, so the description is nearly complete for a read-only analysis tool. The remaining hole is sibling differentiation against make_signature_for_function and make_signature_for_range, which an agent selecting among them would need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters including defaults and format options are already documented in the schema. The description only echoes the 'starting at each address' notion for addrs and adds no syntax, format, or instance_id guidance beyond the schema — baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: creating unique byte signatures for addresses, plus how they are produced (walking instructions, wildcarding operands). It is clear on its own, but it never distinguishes itself from the three closely named siblings make_signature_for_function and make_signature_for_range, leaving an agent to infer the scope difference between 'addresses' and 'function'/'range'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Useful for finding stable patterns that survive recompilation" implies the use case but states no explicit when-to-use, prerequisites, or exclusions. With siblings make_signature_for_function and make_signature_for_range in the same namespace, silence on which to pick is a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_signature_for_functionSignature at a function entryBRead-only
Create unique byte signatures for function entry points. Resolves each name/address to a function, then generates the shortest unique signature starting at the function start.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Function address(es) or name(s) to create signatures for (e.g. 'main', '0x401000', or ['main', 'sub_402000']) | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| max_length | No | Maximum signature length in bytes before giving up (default: 1000) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| wildcard_operands | No | Wildcard instruction operands for relocatable signatures (default: true) |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds useful process detail (it resolves name/address to a function, then searches for the shortest unique signature), but omits notable behavioral facts such as what happens when no unique signature is found or when max_length is exceeded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero waste, front-loading the operation before the resolution/generation detail. Nothing extraneous.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, and 100% schema coverage carries the parameters. The description covers the core mechanism adequately, though the absence of any routing guidance relative to the other signature tools leaves a minor completeness gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description only restates the addrs resolution behavior ('resolves each name/address to a function') already covered by the schema, and says nothing about format, max_length, wildcard_operands, or instance_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create unique byte signatures') with a clear scope ('for function entry points'), and the phrase 'starting at the function start' implicitly distinguishes it from range-based siblings. It does not explicitly name make_signature or make_signature_for_range, so differentiation is inferable rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no alternatives named, despite several closely related siblings (make_signature, make_signature_for_range, find_xref_signatures, get_algorithm_signature). The agent must guess which signature tool applies from the scope wording alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_signature_for_rangeSignature for a byte rangeARead-only
Create a byte signature for a specific address range (e.g. a selected region). Unlike make_signature, this does NOT guarantee uniqueness — it simply encodes the bytes in the range with optional operand wildcarding.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | End address or name (exclusive, e.g. '0x401020') | |
| start | Yes | Start address or name (e.g. '0x401000') | |
| format | No | Output format: 'ida' (default), 'x64dbg', 'mask', or 'bitmask' | ida |
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| wildcard_operands | No | Wildcard instruction operands for relocatable signatures (default: true) |
Output Schema
| Name | Required | Description |
|---|---|---|
| addr | Yes | |
| error | No | |
| query | Yes | |
| format | Yes | |
| unique | No | |
| signature | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint is already declared by annotations, so safety is covered; the description adds the crucial behavioral caveat that this does NOT guarantee uniqueness, unlike make_signature, plus that operands are optionally wildcarded. That is genuine behavioral context beyond the structured fields, though nothing is said about output content or wildcard effects on matching reliability.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste: the action and its scope come first, the key differentiator immediately after. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only signature generator with a full output schema and 100% schema coverage, the description covers purpose, the uniqueness caveat, and the sibling relationship. It is essentially complete; only minor questions (what the signature output looks like, whether wildcarding affects uniqueness) remain, and the output schema covers returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters including wildcard_operands and format defaults. The description only gestures at 'optional operand wildcarding', which maps loosely to wildcard_operands but adds no syntax or format detail. Baseline 3 is correct when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a byte signature') scoped to an address range, and explicitly distinguishes itself from the sibling make_signature by naming it and contrasting their behavior. An agent can tell this apart from make_signature without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete use context ('a selected region', i.e. an arbitrary byte range) and names the alternative make_signature with the condition distinguishing them (uniqueness guarantee). It does not address make_signature_for_function, the other close sibling, but the range-vs-function split is implied clearly enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_databaseOpen binary in IDAA
Open (load) a binary executable, shared library, firmware image, or an existing .i64/.idb IDA database in IDA Pro for reverse engineering. Runs IDA auto-analysis (functions, disassembly, cross references, strings) in a headless idalib worker, or attaches to the file already open in the IDA GUI. Call this first, then use execute_python to decompile, disassemble and query the binary. load_options apply only when a new headless worker is spawned; they do not change an already-open IDA GUI database or a reused worker.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to a local executable or IDB. A GUI instance is used when available. | |
| set_current | No | Whether this database should become the default target for execute_python(). | |
| load_options | No | IDA import options for a newly spawned worker, such as loading a raw blob. |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | Yes | |
| mcp_id | Yes | |
| status | Yes | Attachment state: attached or current. |
| backend | Yes | Instance backend: gui or idalib. |
| log_path | Yes | |
| recovery | Yes | Crash recovery performed while opening: none, repaired, or restored. |
| instance_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that auto-analysis runs (functions, disassembly, xrefs, strings), that it may attach to an already-open GUI instance, and that load_options are ignored for GUI databases and reused workers. It omits analysis duration/cost and error behavior for an invalid path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and formats accepted, followed by operational behavior and the load_options caveat. Dense but every sentence carries information; the closing caveat is slightly long-winded but earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values need not be explained. For a stateful load/attach tool with no annotations, the description covers the important behavioral surface a caller needs (modes, sequencing, option scope), falling just short on failure modes and cost.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real semantic constraint beyond the schema: load_options only take effect on a newly spawned headless worker and do not alter an already-open GUI database or a reused worker. It also clarifies that path may resolve to an already-open GUI instance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource (open/load a binary, shared library, firmware image, or .i64/.idb) and scopes it to IDA Pro for reverse engineering. It is immediately distinguishable from siblings like close_database, save_database, and list_databases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit sequencing rule ('Call this first, then use execute_python') and explains the headless-worker vs GUI-attach modes, which tells the agent what state it will be operating in. It does not state failure conditions or when to prefer close_database/re-open instead, but the core routing guidance is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patchPatch IDB bytesBDestructive
Patch bytes at memory addresses with hex data
| Name | Required | Description | Default |
|---|---|---|---|
| patches | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The destructiveHint annotation already flags that this is a mutating operation, so the description does not need to carry that burden. The description adds that it writes hex data to memory addresses, but it does not disclose whether changes are reversible, whether they persist in the IDB, or any permission requirements beyond what annotations already imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. It immediately conveys the core action and data format.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema and a destructiveHint annotation, the description need not explain return values or the general mutation risk. However, it omits relevant context such as how multiple patches are supplied and how this differs from patch_asm, leaving the agent to rely on schema inference for a destructive operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: the nested addr and data fields are well described in the schema, while the top-level patches parameter has an empty description. The description adds some meaning by mentioning "hex data" and "memory addresses," but it does not compensate fully for the undocumented patches structure or the optional instance_id default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ("Patch") and resource ("bytes at memory addresses") with the required data format ("hex data"). It is clear what the tool does, but it does not explicitly distinguish raw-byte patching from the sibling tool patch_asm, which likely patches assembly instructions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no indication of when to use this tool versus alternatives such as patch_asm or put_int, nor does it state prerequisites or exclusions. At best the verb "Patch" implies a use case, but no real guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_asmAssemble and patch instructionsC
Patch assembly instructions at addresses
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It conveys that this is a mutation ('Patch') but says nothing about whether changes persist, whether the database must be saved, whether existing analysis is invalidated (e.g., force_recompile), or whether operations are reversible. For a mutation tool with zero annotation coverage this is a notable gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though the extreme brevity borders on under-specification rather than showing restraint with genuinely necessary content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but for a mutation tool with no annotations and half-documented parameters the description is far too thin. It omits prerequisites, persistence behavior, and how the multi-item patch list is applied.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%, so the description should compensate but adds nothing about parameters. In particular, the anyOf shape of 'items' (single object or array of objects) and the current-target semantics of instance_id are not clarified beyond the schema's terse notes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Patch assembly instructions at addresses'. An agent can understand what the tool does, but the description offers no differentiation from the sibling 'patch' tool, which is presumably the byte-level equivalent. The title 'Assemble and patch instructions' adds the assemble step, but the body text does not carry that distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus the sibling 'patch', nor any mention of prerequisites such as an open database or the role of instance_id. The agent must infer usage entirely from the name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
put_intWrite integers to memoryCDestructive
Write integer values to memory addresses
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Integer write requests (ty, addr, value). value is a string; supports 0x.. and negatives | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, but the description adds nothing beyond that: it does not say memory is overwritten, whether the write is reversible/undoable, that it requires a loaded database, or how failures are reported. For a destructive mutation tool the description contributes no behavioral context of its own.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, appropriate for a simple write tool. It is efficient, though its brevity is partly under-specification rather than tight curation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, and the schema fully documents parameters. However, for a destructive batch-write tool the description omits the batch nature of items and the instance_id target semantics, leaving moderate gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the nested items schema fully documents ty, addr, and value including hex/negative syntax, so the schema carries the parameter burden. The description restates 'integer values to memory addresses' without adding format or batch semantics beyond what is already structured.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Write) and resource (integer values to memory addresses), so the agent can tell it performs a memory mutation. It does not explicitly distinguish itself from the read counterpart get_int or from patch/get_bytes, leaving sibling differentiation to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus get_int, patch, get_bytes, or get_string, and no mention of prerequisites or context. The agent must infer the write use case purely from the verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
py_evalEvaluate Python in the worker (REPL)A
Execute Python in IDA context and return result/stdout/stderr.
Locals persistence (Jupyter-style): the locals namespace persists across calls by default, so variables, imports, and definitions from previous calls stay visible. Pass new_locals=True to reset the stored namespace and start fresh.
Note: the globals namespace (IDA modules and helpers) is always rebuilt per call; only locals persist. Jupyter-style last-expression return: if the code ends with an expression, its value is returned in "result".
Timeouts for long snippets: this tool runs with a 300s ceiling, and the helpers mcp_time_left() / mcp_deadline_exceeded() are injected into the snippet namespace. Poll them inside long loops so the main thread bails out cleanly instead of freezing every other MCP call (including server_health) behind a non-polling C++ call.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Python code | |
| new_locals | No | False (default): reuse the locals namespace from previous py_eval calls, so variables assigned earlier remain visible (Jupyter-like persistence). True: reset and start with a fresh locals namespace. | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes | |
| stderr | Yes | |
| stdout | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so capably: it discloses the Jupyter-style locals persistence, that globals are rebuilt per call, the 300s ceiling, the injected mcp_time_left()/mcp_deadline_exceeded() helpers, and the concrete consequence of not polling (freezing other MCP calls including server_health). This is genuinely useful context beyond the schema. It stops short of describing error/exception behavior and any safety or permission implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then cleanly sectioned into persistence, return-value, and timeout guidance with labeled paragraphs. Every section earns its place, though the prose is slightly padded (e.g., restating the locals rule twice).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return format need not be explained, and the description covers the two things an agent most needs to know: namespace persistence and timeout/polling behavior. Completeness would be higher if it routed against the sibling Python tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description's explanation of new_locals duplicates the schema's own description almost verbatim rather than adding new meaning, and instance_id is not addressed in prose at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Execute Python in IDA context and return result/stdout/stderr.' The title reinforces this as a REPL-style evaluator. However, it does not distinguish itself from the two near-identical siblings execute_python and py_exec_file, leaving the agent to guess which of the three to call.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives strong operating context (persistence model, timeout/polling guidance for long loops) which implies usage, but it never states when to choose py_eval over execute_python or py_exec_file. With three overlapping Python-execution siblings, routing guidance is the key missing piece.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
py_exec_fileExecute a Python file in the workerA
Execute a Python script file in IDA context and return stdout/stderr.
Unlike py_eval, this runs the entire file with exec() using a single shared globals dict (no locals split), so top-level definitions are visible to all code in the script. Handles large scripts that would be unwieldy as inline code.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Absolute path to a Python script to execute | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes | |
| stderr | Yes | |
| stdout | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses exec() semantics with a single shared globals dict (top-level definitions visible to all code) and the stdout/stderr return channel, but says nothing about side effects, permissions, or the fact that arbitrary Python in an IDA context can mutate the open database.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the action and return value, then the differentiation and the practical rationale. No filler, though the middle sentence is slightly dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return format needn't be restated, and the description covers purpose and execution semantics. However, for a tool that runs arbitrary Python against a database with no annotations, it omits any caution about mutation or environmental side effects, leaving a meaningful gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so file_path (absolute path) and instance_id (optional target instance) are fully documented in the schema. The description adds no parameter-level detail beyond that, which is the expected baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Execute a Python script file in IDA context') and explicitly distinguishes itself from the py_eval sibling by contrasting execution semantics. It does not address the other close-looking sibling execute_python, so differentiation is strong but not exhaustive.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear selection rule ('Handles large scripts that would be unwieldy as inline code') and names py_eval as the alternative for the opposite case. It stops short of explaining when-not-to-use or how to choose against execute_python, which also appears in the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_structRead struct fields at an addressBRead-only
Read struct fields from memory at address; auto-detect type when possible.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safe-read profile is covered. The description adds the auto-detection behavior, which is genuinely useful context for the struct field, but says nothing about failure modes when a type cannot be detected or how addresses are resolved. With annotations carrying the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded clause with zero waste. It is arguably too terse for a required parameter whose structure is undocumented, but nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and the read-safety profile is covered by annotations. The remaining gap is the undocumented 'queries' parameter (required, anyOf array-or-object), which the description does not address at all.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, and the required 'queries' parameter has an empty schema description despite an anyOf accepting either an array of {addr, struct} objects or a single object. The description implies the addr and optional struct semantics ('auto-detect type when possible') but does not explain the batch/single duality, so it only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read struct fields from memory at address') and distinguishes itself from primitive readers like get_int/get_string through the 'struct' framing. However, it never explicitly contrasts itself with the many sibling read tools (get_bytes, get_global_value, type_inspect), so differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage signal is 'auto-detect type when possible', which addresses the optional struct name but not when to choose this tool over get_bytes, get_int, or type_inspect. No prerequisites, exclusions, or alternative routing are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
referenceSearch IDA API referenceARead-only
Look up the IDA Pro ida-domain Python API by task or name, e.g. "decompile function", "xrefs to address", "list strings", "rename local variable", "struct type". Returns API signatures and usage examples for IDA analysis via execute_python.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Class, method, or reverse-engineering concept to look up in the IDA reference. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds valuable behavioral context beyond the annotations: it discloses what the tool returns (API signatures and usage examples) and its intended downstream purpose. For a lookup tool with no output schema, this is meaningful disclosure, though it stops short of describing result breadth or limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the verb and resource, followed by illustrative examples. Only minor redundancy in "IDA Pro ida-domain Python API." Every element serves the reader, and the most important information leads.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, read-only lookup tool with no output schema, the description adequately covers what the tool does, the query style, and what is returned. The gap is the absence of explicit guidance on using it before execute_python, but otherwise the definition is complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the query parameter is already documented, establishing a baseline of 3. The description goes beyond the schema by illustrating the expected query content with five concrete examples spanning both task descriptions and API names, which clarifies how vague or specific the input should be.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ("look up") and resource (the IDA Pro ida-domain Python API), and the examples ("decompile function", "xrefs to address", "list strings") make clear this is a reference/documentation tool, not an analysis tool. An agent can distinguish it from analysis siblings like decompile or execute_python without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The "by task or name" phrasing plus concrete example queries conveys how to phrase a lookup, and the closing clause ties it to "IDA analysis via execute_python," implying this is the discovery step before writing Python. However, there is no explicit when-to-use/when-not guidance or named alternative, so usage is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
renameBatch rename funcs/globals/locals/stackC
Batch-rename funcs/globals/locals/stack vars with dry-run options.
| Name | Required | Description | Default |
|---|---|---|---|
| batch | Yes | Rename batch with func/data/local/stack fields (at least one required) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| func | No | |
| local | No | |
| stack | No | |
| summary | No | |
| global_alias | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden. It is a mutation tool, yet the description omits whether changes persist immediately or require saving, how conflicts are resolved, or what happens to existing names. The dry-run mention is merely restated by the schema's dry_run parameter and adds little beyond it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that wastes no words. It is appropriately sized, though its brevity stems partly from under-specification rather than maximally informative economy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a persistent mutation with a complex nested batch schema and no annotations. An output schema exists so return values need not be explained, but the description still leaves critical gaps: state requirements, persistence/save behavior, and overwrite/conflict semantics that an agent needs before calling it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every nested field (func/data/local/stack, dry_run, stop_on_error, allow_overwrite, instance_id) is documented in the schema itself. The description adds no parameter meaning beyond what the structured fields already convey, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (batch-rename) and enumerates the four resources it operates on (funcs, globals, locals, stack vars), which matches the title. It is clear enough to distinguish from other mutating siblings in a RE/decompiler context, though it does not explicitly name an alternative tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage-relevant hint is 'with dry-run options', which signals a preview-then-apply workflow but never states when to choose this tool, prerequisites (e.g., an open database), or alternatives to renaming in bulk.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_databaseSave IDA databaseA
Save the IDA database (.i64) to disk so renames, comments, types and patches made during reverse engineering persist.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, save the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden and does state the core mutation: writing the .i64 database to disk and persisting changes. It still omits details such as overwrite behavior, permissions, and whether saving is guaranteed to target the current file, so it is only minimally adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single well-formed sentence, front-loads the action, and gives the persistence rationale without wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple save operation with a fully documented optional parameter and an output schema, the description provides enough context to call the tool correctly. Missing sibling differentiation and some mutation edge cases keep it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single optional instance_id parameter is fully documented in the schema, including the default behavior when omitted. The description adds no parameter-specific detail, which is acceptable given 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: saving the IDA database (.i64) to disk. It also clarifies the effect—persisting renames, comments, types, and patches—but does not differentiate from the sibling idb_save, which likely overlaps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies the tool should be used after making reverse-engineering changes so those changes persist. However, it gives no explicit when-to-use guidance versus idb_save or close_database, and no prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_structsSearch local structs/unionsBRead-only
Search local structs/unions by name pattern.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | Yes | Case-insensitive substring to search for in structure names | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already signals a safe read operation. The description adds only scoping ('local') and matching ('name pattern'), both of which are largely covered by the schema; no additional behavioral context is provided, but there is no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It states the action, scope, and matching method immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only search tool with full schema coverage, an output schema, and safety annotations, the description is nearly complete. It does not mention the return format or pagination, but the output schema should cover those details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are fully documented in the schema. The description's 'by name pattern' adds marginal meaning beyond the existing 'case-insensitive substring' description, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search local structs/unions') plus the matching criterion ('by name pattern'). This clearly separates it from sibling tools like list_funcs or type_query, though it does not explicitly name an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool instead of type_query, read_struct, or other type-related siblings. Usage is only implied by the purpose statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_textSearch the rendered listingARead-only
Search the rendered listing for pattern over [start, end).
Iterates idautils.Heads() in pure Python and renders each via
ida_lines.generate_disassembly(). Per-head iteration is cheap and
yields between heads, so the per-tool deadline (sync_wrapper) and the
UI Cancel button both interrupt the walk reliably — unlike the C-level
ida_search.find_text() it replaced, which on huge .text segments
could run for minutes without polling user_cancelled().
Use start/end to scope the work for predictable performance on
large binaries; without them the scan covers the whole image.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | Upper bound (hex or symbol, exclusive). Empty = last segment. | |
| limit | No | Max hits per page (default: 30, max: 500) | |
| regex | No | Treat pattern as a Python regex | |
| start | No | Lower bound (hex or symbol). Empty = first segment. | |
| include | No | 'disasm' | 'comments' | 'all' (default: all) | all |
| pattern | Yes | Text to search for in the rendered listing (literal substring by default) | |
| code_only | No | Restrict search to executable segments (default: true) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| case_sensitive | No | Case-sensitive match (default: false) |
Output Schema
| Name | Required | Description |
|---|---|---|
| n | No | |
| hits | No | |
| error | No | |
| cursor | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, so safety is covered, and the description adds real behavioral context: the walk is pure-Python, interruptible by the sync deadline and UI Cancel, unlike the C-level find_text it replaced. This is genuinely useful for predicting responsiveness on large .text segments, though return/pagination behavior is not discussed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence is well front-loaded. The second paragraph is largely implementation backstory about Python iteration vs the C-level replacement, which explains interruption behavior but is longer than needed for a tool-selection description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be described, and schema coverage is complete. The description supplies the performance and interruption context an agent needs for a large-binary scan; it is close to complete, missing only explicit sibling routing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; the schema already documents pattern, start, end, limit, regex, include, code_only, instance_id, and case_sensitive. The description reinforces start/end scoping intent but adds no format or syntax detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search the rendered listing for pattern over [start, end)') and clarifies the search space is the rendered text, not raw bytes. It does not explicitly distinguish itself from siblings like find_regex or find_bytes, which a caller would need to choose between.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear condition for scoping work ('Use start/end ... without them the scan covers the whole image'), which is useful for large binaries. However it offers no guidance on when to prefer this tool over find_regex, find, or find_bytes, so the alternative-selection problem is left implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_healthPro runtime health and IDB statsARead-only
Health/ready probe for MCP server and current IDB state.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| module | No | |
| status | No | |
| busy_sec | No | |
| idb_path | No | |
| busy_tool | No | |
| imagebase | No | |
| input_path | No | |
| uptime_sec | No | |
| queued_calls | No | |
| hexrays_ready | No | |
| strings_cache_size | No | |
| auto_analysis_ready | No | |
| strings_cache_ready | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe, non-mutating call, so the description's main added value is scope: it reports both server liveness and current IDB state. It does not disclose whether the probe touches/initializes the database, what 'ready' means, or how instance scoping affects results — modest but real added context over the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with no filler, front-loading the purpose. Nothing could be trimmed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, and the tool is simple (zero required params). The description covers both facets of the probe adequately; only the interaction with instance_id and the meaning of 'ready' remain unstated, which are minor for a health check.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single instance_id parameter is fully documented in the schema (optional, defaults to the current target). The description never mentions instance selection, so it adds nothing beyond the schema — the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('MCP server' plus 'IDB state') and a clear verb ('Health/ready probe'), so an agent can tell this apart from the analysis-oriented siblings at a glance. It is clear, though it does not explicitly state that no sibling overlaps this function — which is obvious only from the sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Calling this as a health/readiness probe is strongly implied by the phrasing, but the description gives no explicit 'use this before X' or 'do not use this for Y' guidance. It also does not mention the alternative of list_databases, which also reports IDB information, so the agent must infer the division of labor.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_commentsSet comments at addressesC
Set comments at addresses (both disassembly and decompiler views)
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully notes that comments affect both disassembly and decompiler views, but it does not disclose whether existing comments are overwritten, whether the operation is persistent, what permissions are required, or any other side effects of this mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. It is efficient, though its extreme brevity contributes to the gaps noted in other dimensions rather than being a structural flaw.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, for a mutation tool with no annotations, the description omits critical context: whether setting a comment replaces an existing one, how it relates to append_comments, and what happens if the address already has a comment. These omissions leave the tool's core semantics ambiguous.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: instance_id is described, but the items parameter has an empty description. The description's phrase 'at addresses' hints at multiple addresses but does not clarify that items accepts either a single object or an array, nor does it add meaning beyond the addr/comment subfield descriptions already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: setting comments at addresses, with the added scope that both disassembly and decompiler views are affected. It does not explicitly differentiate itself from the sibling tool append_comments, leaving the agent to infer the distinction between setting and appending comments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as append_comments, nor are any prerequisites stated (e.g., requiring an open database). The description only states what the tool does, not the context in which it should be chosen.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_op_typeSet an instruction operand typeA
Set the type of an instruction operand. GUI 'Y' / 'O' / '#' equivalent.
Tags an operand at a specific instruction with a desired interpretation. Useful when the decompiler picks an awkward expression form (e.g., the "earlier-named-symbol + offset" form for contiguous globals).
kind values:
"stroff": struct-offset reference. Requiresstruct, optionaldelta."offset": absolute offset / pointer. Optionaltarget_addr."hex" | "dec" | "char" | "binary" | "octal": numeric format."stkvar": stack-variable reference (function-local).
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Operand-typing ops. Equivalent to GUI 'Y' (struct offset) or 'O' (offset) operations. | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the mutation semantics ('Tags an operand') and the per-kind interpretation, but says nothing about permissions, reversibility, or how the change interacts with existing analysis/undo.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single-line purpose is front-loaded, followed by a useful usage note and a scannable bullet list of kind semantics. Slightly long but every part earns its place; no redundant restatement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return details are not needed, and the kind/field mapping plus GUI equivalence covers the core decision. The batch-vs-single nature of the `items` parameter and failure behavior are only implicitly covered via the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3), but the description adds genuine meaning by enumerating the `kind` values and mapping which auxiliary fields each consumes ('stroff' requires struct, optional delta; 'offset' optional target_addr; numeric formats; 'stkvar'). This is more than the schema's bare string field conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Set the type of an instruction operand') and grounds it in the GUI equivalents ('Y' / 'O' / '#'). It clearly targets operand-level typing, distinct from general type tools, though it does not explicitly name sibling set_type/declare_type to sharpen the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a when-to-use cue ('Useful when the decompiler picks an awkward expression form... for contiguous globals'), which is real guidance. However it offers no explicit alternatives or when-not-to-use conditions, so routing among the many type-related siblings is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_typeApply a C type to an entityC
Apply types (function/global/local/stack)
| Name | Required | Description | Default |
|---|---|---|---|
| edits | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, yet it says nothing about mutation semantics, whether applied types overwrite existing ones, required database state, or reversibility. For a write operation of this kind, that is a substantial gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence with no wasted words, which is good, but the brevity stems from under-specification rather than disciplined conciseness. Nothing is front-loaded beyond the bare action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required, but for a mutation tool with zero annotations and a half-documented parameter set, the description is too thin to let an agent call it correctly and safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: the nested fields (ty, addr, kind, name, variable, signature) are documented in the schema, but the top-level "edits" parameter has an empty description and there is no explanation of the single-object vs array shape. The description's mention of entity kinds marginally reinforces the addr/kind semantics but adds little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a verb ("Apply") and a resource ("types") and lists the entity classes it targets (function/global/local/stack), so the basic action is inferable. However, it does not distinguish this tool from close siblings like type_apply_batch, declare_type, or infer_types, leaving the agent to guess which one is appropriate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus type_apply_batch, declare_type, or infer_types, and no prerequisites such as needing an open database or a resolved address. The parenthetical entity list hints at scope but does not constitute usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stack_frameList function stack variablesCRead-only
Return stack variables for function address(es).
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Address(es) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so safety is covered, but the description adds essentially nothing beyond that: no mention of how multiple addresses are handled in the result, whether all variables or only declared ones are returned, or anything about the instance_id default behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is efficient, though it earns its brevity partly by omitting information rather than by maximal information density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with a full-coverage schema and an output schema, the description is minimally adequate. It doesn't explain the address scope (current database vs. instance_id) or the shape of the resulting variable list, but the structured fields carry most of the burden.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both addrs and instance_id are already documented in the schema. The description's "for function address(es)" only echoes the addrs parameter and adds no syntax or format detail, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ("Return") and resource ("stack variables") with the scoping input ("for function address(es)"). It is distinct from list_globals or declare_stack, though it does not explicitly name the siblings it differs from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to use this tool versus alternatives (e.g., declare_stack, delete_stack, list_globals), and no prerequisites or context about the current target database. The agent must infer the deployment context entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
survey_binaryOne-call binary surveyARead-only
Get a compact overview of the binary in one call. Returns file metadata, segment layout, entry points, statistics, top 15 strings and functions ranked by xref count (functions include classification: thunk/wrapper/leaf/dispatcher/ complex), imports by category, and call graph summary. Use this as your FIRST tool call when starting analysis. Do not call list_funcs, imports, or find_regex separately for triage — this returns all of that. Use detail_level='minimal' for binaries with >10k functions.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, use the current target. | |
| detail_level | No | Detail level: 'standard' or 'minimal' | standard |
Output Schema
| Name | Required | Description |
|---|---|---|
| _note | No | |
| metadata | No | |
| segments | No | |
| statistics | No | |
| entrypoints | No | |
| call_graph_summary | No | |
| imports_by_category | No | |
| interesting_strings | No | |
| interesting_functions | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes safety, but the description adds substantial behavioral context: it describes the bundled outputs, ranking of strings/functions, function classifications, and call graph summary. It does not fully explain how detail_level='minimal' changes the result, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main purpose, then lists returned data, then gives usage instructions and the large-binary guidance. Every sentence contributes actionable information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists, annotations mark it read-only, and the schema documents both parameters, the description is complete for correct invocation. It covers what is returned, when to use it first, which siblings to avoid for triage, and when to switch detail levels.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented. The description adds practical meaning for detail_level by recommending 'minimal' for binaries with more than 10k functions, going beyond the schema's bare enum description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Get a compact overview of the binary in one call.' It then enumerates what is returned, making the tool's scope concrete and clearly distinguishing it from siblings like list_funcs, imports, and find_regex.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use this as the FIRST tool call when starting analysis and instructs not to call list_funcs, imports, or find_regex separately for triage. It also gives a concrete condition for using detail_level='minimal' on binaries with over 10k functions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trace_data_flowFollow xrefs across multiple hopsARead-only
Follow cross-references from or to an address, automatically traversing multiple hops. Use 'forward' to see where data flows TO (xrefs-from), or 'backward' to see where data flows FROM (xrefs-to). At each node in the traversal, returns the function name, instruction, and whether it's code or data. Use this when you find an interesting string, constant, or global and want to understand every code path that touches it without manually chaining xrefs_to calls. Do not use for call graph traversal — use callgraph for that. max_depth controls how many hops to follow (default 5, max 20).
| Name | Required | Description | Default |
|---|---|---|---|
| addr | Yes | Starting address | |
| direction | No | 'forward' (xrefs from) or 'backward' (xrefs to) | forward |
| max_depth | No | Maximum traversal depth | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| edges | No | |
| error | No | |
| nodes | No | |
| start | No | |
| direction | No | |
| depth_reached | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true, but the description adds real behavioral context: the semantics of 'forward' vs 'backward', the per-node return contents (function name, instruction, code-vs-data), and the depth bound (default 5, max 20). It doesn't discuss auth, rate limits, or truncation on deep traversals, so it stops short of the top score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tight, front-loaded sentences: purpose first, then direction semantics, then the use case, then the exclusion, then the depth constraint. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema and read-only annotation already present, the description supplies exactly the missing pieces — traversal direction meaning, use-case framing, and the callgraph exclusion — leaving nothing an agent needs in order to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds interpretation beyond the raw schema — explaining what 'forward'/'backward' mean in terms of data-flow direction and surfacing the max_depth ceiling of 20 that the schema's description omits.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('follow cross-references from or to an address, automatically traversing multiple hops') and explicitly distinguishes itself from callgraph. An agent can tell what it does and how it differs from xrefs_to/callgraph without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when-to-use ('when you find an interesting string, constant, or global and want to understand every code path that touches it') and an explicit when-not ('Do not use for call graph traversal — use callgraph for that'), naming the alternative sibling directly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_apply_batchApply multiple type editsC
Apply multiple type edits and return aggregate status.
| Name | Required | Description | Default |
|---|---|---|---|
| batch | Yes | Batch type edits with optional stop_on_error behavior | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| failed | Yes | |
| applied | Yes | |
| results | Yes | |
| stopped | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden for a mutation tool, and it discloses almost nothing: whether edits are atomic, what happens on partial failure, whether stop_on_error affects already-applied edits, or whether the target database must be open. 'Return aggregate status' is the only behavioral hint, and the output schema already covers the return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no waste, which is structurally fine. However, the brevity here reads as under-specification rather than disciplined conciseness for a nested batch-mutation tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be restated, but the description omits the semantics unique to batching: ordering of edits, error behavior interplay with stop_on_error, and the relationship between the nested edits array and the aggregate status returned. For a nested-object mutation tool with no annotations, this leaves significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents batch.edits, stop_on_error, and instance_id precisely. The description adds no syntax, format, or constraint detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Apply multiple type edits') and the batch scope is clear from the name and description. It does not name or contrast with the obvious siblings (set_type, declare_type, infer_types), so an agent must infer when the batch variant is preferred.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus the single-edit tools in the same family (set_type, declare_type). Nothing states whether this is preferable for bulk edits, what prerequisites exist, or in what situations the agent should avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_inspectInspect a named typeBRead-only
Inspect named types (size/kind/declaration/members).
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Inspect named types and optionally include member layout | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint=true annotation already establishes that this is a safe read operation, so the description doesn't need to re-state that. It adds the inspection dimensions (size/kind/declaration/members) beyond the annotation, but says nothing about the optional instance_id target scoping or results limits. Adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the parenthetical efficiently lists the output facets. It is arguably too terse for a tool that accepts either a single object or an array of query objects, but there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the annotation covers the safety profile. However, for a tool sitting among type_query, read_struct, search_structs, and infer_types, the description never states when to pick it over those, leaving a real gap in routing guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents 'name', 'max_members', 'include_members', and 'instance_id'. The description only indirectly signals member inclusion via the parenthetical 'members' and adds nothing about the batch-array form of queries or the target-instance default. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Inspect') plus resource ('named types') and enumerates the returned facets (size/kind/declaration/members), so the agent knows exactly what it gets. It does not distinguish itself from close siblings such as type_query, read_struct, or search_structs, which is the only thing keeping it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisite notes, and no pointer to alternatives like type_query for querying or read_struct for reading a struct layout. The agent must infer usage purely from the name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_queryQuery local types with filtersBRead-only
Query local types with structured filters/projection-friendly output.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Type catalog query with filtering, pagination, and optional relationships | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds a modest amount of behavioral context ('structured filters', 'projection-friendly output') that hints at read-only, filterable, projection-style queries, but says nothing about pagination limits, how the array form batches multiple queries, or the effect of omitting instance_id.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler or repetition. It is efficient, though for a tool with an anyOf array-or-object schema and a claimed filter/projection model it is arguably under-specified rather than truly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and readOnlyHint covers safety. However, for a tool whose schema accepts either a single query object or an array of them, the description never mentions batch-query capability or the instance_id default, and offers no routing among the many sibling query tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents kind, filter, count, offset, sort_by, include_decl, include_members, and include_relationships. The description's 'structured filters/projection-friendly output' merely alludes to those concepts without adding syntax, defaults, or semantics beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Query local types') and adds that it works over structured filters, so an agent knows it targets the type catalog rather than functions or xrefs. It does not explicitly distinguish itself from nearby siblings like type_inspect, search_structs, enum_upsert, or entity_query, which prevents a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no named alternatives. With ~80 sibling tools including several type-related ones (type_inspect, search_structs, read_struct, enum_upsert), the description gives no basis for choosing this one over them, and no preconditions or exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
undefineUndefine items to raw bytesC
Undefine item(s) at address(es), converting back to raw bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It says the tool converts items back to raw bytes, which implies mutation, but does not state whether the operation is destructive, reversible, requires saving, affects existing names/comments, or what side effects occur. For a mutation tool with zero annotation coverage, this is a significant omission.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every word contributes to stating the action and its result, making it appropriately sized for a brief tool definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and 50% schema coverage, the description is too thin. It does not mention the optional instance_id, whether a save is required, or what happens to existing definitions, leaving key behavioral and operational context absent despite the presence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%, and the description adds no parameter details beyond repeating 'address(es)'. It does not explain the relationship between addr, size, and end, nor how the items array or object is interpreted, leaving the schema to carry the remaining burden without compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (undefine) and resource (item(s) at address(es)) and clarifies the outcome (converting back to raw bytes). It is clear what the tool does, though it does not explicitly differentiate itself from related siblings like define_code or make_data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. The agent can only infer usage from the action verb itself; the description does not say to use this to revert defined items, or warn against using it on already-raw bytes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xref_queryGeneric xref queryCRead-only
Query xrefs with direction/type filters and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | Generic xref query with direction/type filters and pagination | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, and the description's 'Query' is consistent with that, so no contradiction. But everything the description mentions (direction/type filters, pagination) is already present in the schema field descriptions, so it adds no behavioral context beyond structured data. With annotations acting as a lower bar, this still contributes essentially nothing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. It is appropriately sized, though its brevity reflects under-specification rather than efficient density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the rich schema covers the nested query object. What is missing is sibling disambiguation for a crowded xref/query tool family, which the schema cannot supply. Adequate but with a clear gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each nested field (addr, count, offset, direction, xref_type, etc.) documented in the schema, so the baseline is 3. The description restates 'direction/type filters and pagination' without adding syntax, defaults, or semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a verb (query) and resource (xrefs), which is clear enough on its own. However, it is a 'generic' xref query sitting alongside several sibling xref tools (xrefs_to, xrefs_to_field, callgraph, insn_query), and the description makes no attempt to distinguish itself from them. An agent cannot tell which xref tool to reach for from the text alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use / when-not-to-use guidance and no named alternative. For a tool whose siblings include xrefs_to and xrefs_to_field, the absence of any routing hint is a meaningful gap. Usage is only implied by the resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xrefs_toCross references to an addressARead-only
Return xrefs to address(es) or named symbols, capped per target with truncation flag.
| Name | Required | Description | Default |
|---|---|---|---|
| addrs | Yes | Addresses or function names to find cross-references to (e.g. '0x11a9', 'check_pw', 'main') | |
| limit | No | Max xrefs per address (default: 100, max: 1000) | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description adds useful behavior beyond that: results are capped per target and a truncation flag signals when output was clipped. That cap-and-flag behavior is exactly the kind of detail an agent needs to interpret partial results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence that front-loads the core action and adds the truncation caveat without filler. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and annotations covering safety, the description only needs to convey scope and the truncation caveat, which it does. It could note the 'to' vs 'from' distinction versus siblings, but otherwise it is adequate for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are documented in the schema (including the default/max on limit and the instance_id fallback). The description's mention of capping aligns with limit but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Return xrefs to address(es) or named symbols'), making it clear this is a reverse-reference lookup keyed on targets. It doesn't explicitly contrast with siblings like xref_query or xrefs_to_field, but the 'to' direction is distinguishable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the name and description rather than spelled out; there is no explicit 'use this when' or guidance on choosing between this and xref_query/xrefs_to_field. An agent must infer from naming which direction of reference it wants.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xrefs_to_fieldXrefs to a structure fieldCRead-only
Get cross-references to structure fields
| Name | Required | Description | Default |
|---|---|---|---|
| queries | Yes | ||
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read operation, so the safety profile is covered. The description adds nothing beyond that: no note on result scope, whether references are limited to the current database, or how instance_id affects targeting. It does not contradict the annotations, but it contributes no behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with zero padding, but its brevity comes from under-specification rather than tight writing. It is concise yet leaves the caller without the information needed to build a correct request.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. Still, for a tool whose only required parameter accepts a nested struct/field structure, the description omits the query shape, the multi-query capability, and any relation to its xref siblings, leaving the definition incomplete for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% and the key parameter 'queries' has an empty description despite accepting either a single struct/field object or an array of them. The description never explains this struct+field pairing or the polymorphic shape, so the schema's critical parameter is left undocumented by both structured data and prose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: retrieving cross-references to structure fields, which is distinct from the sibling xrefs_to (general address xrefs). However, it never explicitly contrasts itself with xrefs_to or xref_query, so an agent must infer the difference from the name alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of alternatives such as xrefs_to or xref_query. The agent is left to guess when a field-level xref query is appropriate versus a general xref lookup.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
79 tool updates
v20261008.0.1- First observed
add_bookmark - First observed
analyze_batch - First observed
analyze_component - First observed
analyze_function - First observed
append_comments - First observed
basic_blocks - First observed
callees - First observed
callgraph - First observed
close_database - First observed
declare_stack - First observed
declare_type - First observed
decompile - First observed
define_code - First observed
define_func - First observed
delete_stack - First observed
detect_obfuscation - First observed
diff_before_after - First observed
disasm - First observed
entity_query - First observed
enum_upsert - First observed
execute_python - First observed
export_funcs - First observed
find - First observed
find_bytes - First observed
find_regex - First observed
find_xref_signatures - First observed
force_recompile - First observed
func_profile - First observed
func_query - First observed
generate_analysis_report_md - First observed
get_algorithm_signature - First observed
get_analysis_report - First observed
get_bytes - First observed
get_dynamic_string_map - First observed
get_function_constraints - First observed
get_global_value - First observed
get_int - First observed
get_patch_points - First observed
get_string - First observed
idb_save - First observed
imports - First observed
imports_query - First observed
infer_types - First observed
insn_query - First observed
int_convert - First observed
list_databases - First observed
list_funcs - First observed
list_globals - First observed
lookup_funcs - First observed
make_data - First observed
make_signature - First observed
make_signature_for_function - First observed
make_signature_for_range - First observed
open_database - First observed
patch - First observed
patch_asm - First observed
put_int - First observed
py_eval - First observed
py_exec_file - First observed
read_struct - First observed
reference - First observed
rename - First observed
save_database - First observed
search_structs - First observed
search_text - First observed
server_health - First observed
set_comments - First observed
set_op_type - First observed
set_type - First observed
stack_frame - First observed
survey_binary - First observed
trace_data_flow - First observed
type_apply_batch - First observed
type_inspect - First observed
type_query - First observed
undefine - First observed
xref_query - First observed
xrefs_to - First observed
xrefs_to_field
TDQS
Scored across 79 tools
Many tools overlap heavily: list_funcs vs func_query vs entity_query vs lookup_funcs, imports vs imports_query, xrefs_to vs xref_query vs trace_data_flow, find vs find_regex vs search_text vs find_bytes, and execute_python vs py_eval vs py_exec_file. Some descriptions clarify intended distinctions, but the boundaries remain fuzzy across dozens of near-duplicate query and analysis variants.
Most names are snake_case, but conventions mix bare verbs (decompile, patch, rename), verb_noun (list_funcs, get_bytes, set_comments), and bare nouns (imports, callgraph, stack_frame, basic_blocks). The repeated suffix variants (_query, _batch, _profile) add some predictability, but the overall pattern is not consistent enough for a 4 or 5.
79 tools is extreme even for a deep reverse-engineering domain, and many are redundant variants that could be consolidated into broader query/analysis tools. The sheer count makes navigation and tool selection burdensome.
The surface covers database lifecycle, decompilation, disassembly, cross-references, types, editing, signatures, reporting, and arbitrary IDAPython execution via py_eval/py_exec_file. Minor gaps exist (e.g., undo, bookmark/comment deletion, debugger control), but the Python escape hatch mitigates most dead ends.
Maintenance
Related MCP Connectors
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Code intelligence for coding agents: semantic, AST, graph, and full-text search. 279+ languages.
Related MCP Servers
- AlicenseAqualityAmaintenanceEnables AI agents to interact with IDA Pro databases and GUI, supporting reverse engineering tasks such as analyzing binaries and querying open files via natural language.629 npm4,219 PyPI1,220MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to inspect, reverse engineer, decompile, and operate on binaries through IDA Pro, including headless and GUI sessions, over stdio or Streamable HTTP.29 npmMIT
- FlicenseNot gradedqualityAmaintenanceEnables AI assistants to drive IDA Pro for reverse engineering and binary analysis, including running Python scripts inside the disassembler, extracting strings, imports, exports and functions, searching for immediate values, text and byte sequences, and retrieving disassembly for address ranges.-
- FlicenseNot gradedqualityAmaintenanceEnables AI assistants to interact with IDA Pro for reverse engineering and binary analysis tasks. Supports executing Python scripts, retrieving binary strings, imports, exports, and functions, and searching immediate values, text, and byte sequences, plus disassembly.-