ghidralens
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ghidralensdecompile the function that handles license validation"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
GhidraLens
Ghidra, rendered inside your AI client. Click a symbol to rename it. Click a call to follow it.

Every Ghidra MCP server so far returns text. The model can read it; you cannot
navigate it. GhidraLens returns the same analysis as an interactive view —
built on MCP Apps
(io.modelcontextprotocol/ui), the extension that lets a server ship real HTML
into the conversation.
You and the model are looking at the same live program. Rename a variable by clicking it and the model's next decompile sees the new name.
That is a real screenshot: where.exe, decompiled by Ghidra, every identifier
carrying the address it came from.
What you get
View | What it does |
Decompiler | Ghidra's C output as a live token stream — every identifier carries its address and its kind. Click a local to rename it, click a call to follow it. Callers, callees and variables in a sidebar. |
Function browser | Every function in the binary, filterable and sortable by address, name, size or caller count. Click a row to decompile it. |
Call graph | Callers to the left, callees to the right, the function you asked about in the middle. Click any node to recenter. |
Function browser

Call graph

Ten tools total. Three open views; the rest are lookups and writes, including two the model never sees — they exist only so a click in a view can fire them.
Related MCP server: GhidraMCP
How it fits together
MCP client ──stdio──▶ server/ ──HTTP──▶ bridge/ ──JPype──▶ Ghidra (JVM)
(Claude, TypeScript PyGhidra program stays
Cursor, …) MCP server session resident
▲
│ ui:// HTML in a sandboxed iframe
└── ui/ three self-contained viewsThe bridge is a separate long-lived process on purpose. Ghidra's auto-analysis is the expensive step, and it happens once. Measured on a 64 KB Windows system utility (198 functions):
First open, with analysis | 25 s |
Re-open the same binary | 0.3 s |
Decompile one 2 KB function | 0.4 s |
87-node call graph | < 0.1 s |
Restart the MCP server or the client and the analysed program is still there.
Setup
Prerequisites: Ghidra 11.3+, a JDK 21+, Python 3.9–3.13 (not 3.14 —
JPype has no wheel for it yet), Node 20+. See
bridge/setup.py.md — the Python side is fussy and that file
covers every way it goes wrong. GhidraLens finds a JDK for you if JAVA_HOME is
unset, which covers the usual "installed Java, shell has not restarted" case.
git clone https://github.com/hellosverre/ghidralens
cd ghidralens
npm install
npm run buildThen start the bridge on the binary you want to look at:
python bridge/serve.py --binary /path/to/target.exeIt prints a token. Put that, and the path to the built server, into your MCP client config:
{
"mcpServers": {
"ghidralens": {
"command": "npx",
"args": ["-y", "ghidralens"],
"env": {
"GHIDRALENS_BRIDGE_URL": "http://127.0.0.1:8799",
"GHIDRALENS_TOKEN": "paste-the-printed-token-here"
}
}
}
}Running from a clone instead? Point command at node and args at
/absolute/path/to/ghidralens/server/dist/index.js.
Then ask your client: "decompile the function that handles license validation".
Also listed in the official MCP Registry as io.github.hellosverre/ghidralens.
Editing the config by hand? Quit the client first — properly, including any system-tray icon. Claude Desktop keeps its own copy of
claude_desktop_config.jsonin memory and writes it back over yours when it exits, so an edit made while it is running silently disappears on the next restart. Editing through Settings → Developer → Edit Config avoids the race entirely.
Tools
Tool | Visible to | Renders |
| model | — |
| model | — |
| model + view | Decompiler |
| model + view | Function browser |
| model + view | Call graph |
| model | — |
| model + view | — |
| model + view | — |
| view only | — |
| model | — |
add_comment is hidden from the model deliberately. Visibility is how MCP Apps
separates "the agent may do this" from "a click may do this"; keeping write
tools out of the model's list keeps it short and stops the model from renaming
things on its own initiative.
Renames and comments live in memory until save_program writes them into the
Ghidra project — after which they show up in the Ghidra GUI like any other edit.
Developing the views without Ghidra
npm run dev:ui
# open http://localhost:5173/dev/harness.htmlui/dev/harness.ts is a real MCP Apps host — it runs the SDK's AppBridge
against the view in an iframe, so the ui/initialize handshake, the opening
ui/notifications/tool-result, and every tools/call a click fires all go over
real postMessage JSON-RPC. There is a message trace down the right-hand side and
a host-theme switch, because the views have to look right in both.
Two data sources, switchable in the toolbar:
fixtures — no Ghidra needed, nothing to install
live bridge — proxies to a running bridge, so you develop against a real analysed program
Use live before you trust anything. Fixtures are tidy; real output is a 400-line function with 56 locals and an 87-node call graph, and that is where layout actually breaks.
Running it on a local model
Reverse engineering is exactly the work people would rather not send to a hosted
model, so agent/ollama-agent.mjs is a small MCP host that puts GhidraLens
behind Ollama instead. No API key, nothing leaves the
machine.
OLLAMA_MODEL=qwen3:14b node agent/ollama-agent.mjs "what does this binary do?"It respects _meta.ui.visibility, so the app-only tools stay hidden from the
model — the same separation a graphical client enforces. A ~9B model is enough to
orient itself with find_strings and list_functions; a 14B is noticeably
better at reading decompiled C.
Tests
Suite | Needs Ghidra | Covers |
| no | MCP surface: tools, |
| no | Bridge auth, CSRF rejection, routing, input validation |
| yes | Every Ghidra call: analysis, caching, decompiler tokens, imports, renames, writes |
| yes (bridge running) | The whole chain, and that every payload matches the shape the views index into |
The first two are what CI can run. test_session.py is the one that matters
after touching bridge/session.py — it is the only thing that proves the Ghidra
API calls are right, and it caught three real bugs the day it was written.
Containerising it
The Dockerfile builds the server and views for clients or registries that want
to start it themselves. One thing to get right:
CMD ["node", "server/dist/index.js"] # correct
CMD ["npm", "run", "start"] # breaks the protocolA stdio MCP server speaks JSON-RPC on stdout, and npm run / pnpm run print
the script banner there first:
> ghidralens@0.1.1 start
> node server/dist/index.jsThose lines land in the stream ahead of the handshake and the client gives up mid-initialize. The symptom is unhelpful - the container builds, starts, exits cleanly, and the client just reports no tools - so it is worth not stepping on. Invoke node directly.
Real analysis still needs the bridge on the host: 127.0.0.1 inside a container
is the container, so point GHIDRALENS_BRIDGE_URL at host.docker.internal or
a real address.
Security
The bridge binds 127.0.0.1 only, requires a per-run token in
X-GhidraLens-Token, and rejects any request carrying an Origin or Referer
header — so a page open in your browser cannot reach your decompiler. It has no
multi-user model and is not meant to be exposed; --host refuses anything but
loopback.
Analysing a binary does not execute it, but Ghidra will happily open malware. Use the same isolation you would use for any other RE work.
Licence
MIT.
Available Tools
10 toolsadd_commentAdd commentA
Attach a plate comment at an address. Persists into the Ghidra project, so notes made here show up in the Ghidra GUI.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| address | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is not read-only, and the description adds meaningful context by stating the comment persists into the Ghidra project and appears in the GUI. This goes beyond the annotation signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no filler. The core action is front-loaded, and the second sentence adds relevant persistence behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but the description omits important invocation details like address format and whether an existing comment is replaced or supplemented. It covers persistence well enough but is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only generically references 'an address.' It does not explain the expected format of address (e.g., hex, symbol) or the semantics of text, leaving the agent without guidance on how to fill the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Attach a plate comment at an address.' This clearly identifies the operation and distinguishes it from sibling tools like decompile or rename_symbol.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. The sentence about persistence provides motivation but not selection criteria or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
call_graphCall graphARead-only
Draw the callers and callees around one function as a navigable graph. Depth is capped at 3 because call graphs fan out exponentially.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| depth | No | ||
| address | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description complements this by disclosing the depth cap of 3 and the reason behind it (exponential fan-out). It also describes the output modality as a navigable graph, adding useful behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The main action is front-loaded, and the depth-cap rationale is a useful, concise addition that earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no required parameters, and zero parameter descriptions, the description leaves important gaps: what 'name' vs 'address' mean, whether either is sufficient, and what the navigable graph output actually contains. For a tool with this much structural ambiguity, the description is not complete enough for an agent to invoke it reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the parameters, but it does not. 'name' and 'address' are both undocumented and their relationship is unclear, and 'depth' is only implicitly referenced by the cap statement, not explained as a user-controllable parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Draw') and clearly identifies the resource: callers and callees around one function. It also distinguishes this tool by emphasizing the navigable graph output, which separates it from list-oriented siblings like xrefs_to or list_functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context for use is implied: call_graph is for exploring the caller/callee relationships of a single function as a graph. However, it never explicitly states when to prefer this over xrefs_to or other sibling tools, nor does it mention any exclusions or alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decompileDecompile functionARead-only
Decompile one function to C and show it in an interactive view. Identify the function by address (hex) or by name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Function name, e.g. main | |
| address | No | Entry point, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the tool is known to be a safe read operation. The description adds that the result appears in an interactive C view and that the function can be identified by address or name, which is useful but does not address edge behavior such as missing symbols or invalid addresses. Given the read-only annotation, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The core action and output are front-loaded in the first sentence, and the identification criteria complete the second sentence efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only decompile tool with two self-describing optional parameters, the description covers the main usage: decompile one function, see C in an interactive view, and identify the function by name or address. It does not describe failure behavior or state that at least one identifier is required, but that gap is minor given the clarity of the rest of the definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter described and exemplified in the input schema. The description adds the relationship that identification can be done 'by address (hex) or by name,' but it does not clarify whether exactly one must always be provided or what happens if both are supplied. Overall, the description adds only marginal value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Decompile one function to C and show it in an interactive view.' This clearly conveys what the tool does and is easy to distinguish from siblings such as list_functions or call_graph, which target listing or relationships rather than C pseudocode for a single function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when a single function needs to be decompiled) and says how to identify the function 'by address (hex) or by name,' but it does not explicitly state when not to use it or name an alternative. The context is clear enough to infer basic usage, but there is no direct routing guidance versus sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_stringsFind stringsARead-only
Search defined string data. Usually the fastest way into an unknown binary - find the message, then look at what references it.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, covering the safety profile, and the description aligns with that by describing a search operation. The description adds a speed/strategy heuristic beyond the annotations, but it does not disclose behavioral details such as case sensitivity, substring vs. exact matching, or how the limit parameter affects results. This is acceptable given the read-only annotation but not richly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences deliver a precise definition and a useful workflow heuristic. Every word earns its place, and the core action is front-loaded. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only search tool, the description provides enough to understand purpose and workflow. However, since there is no output schema and parameter descriptions are absent, an agent must infer query matching behavior, result shape, and the practical meaning of the limit parameter. Slightly more detail would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden of explaining parameters. It does not compensate: there is no mention of what query means (substring, regex, case sensitivity) or how limit behaves beyond the schema's min/max. The parameter names are somewhat self-explanatory, but the description adds no semantic value for them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action and resource: 'Search defined string data.' It also distinguishes itself from function-oriented siblings like decompile, list_functions, and call_graph by emphasizing string discovery. The added heuristic about finding a message and looking at references makes the purpose concrete and memorable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit context: it is 'usually the fastest way into an unknown binary' and suggests a follow-up step ('find the message, then look at what references it'). It does not explicitly name the sibling tool xrefs_to or state when not to use it, but the intended workflow is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_functionsList functionsARead-only
Browse the program's functions in a sortable table. Filter by substring; sort by address, name, size or caller count.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | ||
| limit | No | ||
| query | No | Case-insensitive name filter | |
| offset | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful details about filter and sort behavior, but it does not disclose output shape, pagination semantics, or any limits beyond the schema. This is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences pack in the resource, action, filtering capability, and sortable columns. There is no filler, and the most useful information is front-loaded in the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with no required parameters, the description covers the core purpose and key behaviors well. The main gaps are lack of explicit return shape and default/pagination behavior, but the sortable-table framing plus the schema's limit/offset fields make this largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low at 25%, so the description must compensate. It adds meaning for the query parameter ('substring') and repeats sort fields, matching the sort enum. However, limit and offset are not explained in the description, leaving pagination semantics to be inferred from their names and schema constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly names the resource ('the program's functions') and the action ('browse'), with concrete capabilities like substring filtering and sorting. It does not explicitly distinguish itself from siblings such as call_graph or program_info, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when you need a sortable, filterable table of functions. However, it gives no explicit guidance about when to prefer list_functions over sibling tools, nor any exclusions or when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_binaryOpen binaryA
Load an executable into the Ghidra session and run auto-analysis. Slow the first time for a given file (seconds to minutes); cached in the Ghidra project afterwards. Must be called before anything else.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the executable | |
| analyze | No | Run auto-analysis. Only set false if already analysed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description meaningfully adds context beyond the annotations: it warns about slow first-time execution, notes caching behavior in the Ghidra project, and declares a prerequisite relationship with all other tools. It does not contradict the readOnlyHint=false / openWorldHint=false annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with no filler. The core behavior is front-loaded, followed by performance expectations and the essential ordering rule.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only two parameters and no output schema, the description covers the necessary operational context: what it does, how long it might take, that results are cached, and that it must run first. A small gap is that it does not explicitly mention error conditions or what happens if the path is invalid, but this is not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to compensate. The description reinforces that auto-analysis happens, which aligns with the 'analyze' parameter, but it does not add new parameter-level meaning beyond what the schema already explains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific action: load an executable into the Ghidra session and run auto-analysis. This clearly differentiates it from sibling analytical tools like decompile, list_functions, or call_graph, which operate on an already-loaded program.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'Must be called before anything else,' giving the agent a clear ordering constraint. It also provides practical timing guidance (slow first load, cached afterwards) that helps the agent decide when this tool is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
program_infoProgram infoARead-only
What is currently open: format, architecture, function count.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already communicates that this is a safe read operation, so the description does not need to restate that. It adds some value by enumerating exactly what information is available, but it does not describe the return shape or behavior when no program is currently open.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler. It front-loads the scope ('currently open') and then lists the exact informational payload, so every word contributes to the agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only informational tool, the description provides the essential facts needed to decide whether to call it. It is slightly thin on expected return formatting or behavior when no program is open, but those are minor given the simplicity and the safety annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This tool has zero parameters, so the empty input schema fully covers the parameter surface. The description's mention of the 'currently open' program provides the only relevant context needed, which is appropriate here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource as the currently open program and lists the specific details returned: format, architecture, and function count. However, it lacks an explicit verb and does not directly distinguish itself from the sibling tools beyond the implied 'currently open' scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'currently open' gives useful context that this tool applies after a binary is loaded, and the sibling list includes open_binary as a likely alternative. Still, there is no explicit statement of when to use this tool versus others, leaving the routing mostly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rename_symbolRename symbolA
Rename a function, or a local variable inside one. Pass old_name to rename a local; omit it to rename the function itself. This is what a click on an identifier in the decompiler view fires.
| Name | Required | Description | Default |
|---|---|---|---|
| address | Yes | Address of the function that owns the symbol | |
| new_name | Yes | ||
| old_name | No | Current local-variable name. Omit to rename the function. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal a mutating operation (readOnlyHint=false) that is not classified as destructive. The description adds the function-vs-local mode distinction, but that is also captured in the schema's old_name description. It does not disclose persistence, reference updates, return behavior, or error cases, so it adds only modest transparency beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: the first defines the operation, the second gives the conditional parameter behavior, and the third provides practical context. There is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward 3-parameter rename, the description plus schema is enough to select the correct parameters. However, there is no output schema and no mention of return values, side effects, name validity, or whether renaming updates references elsewhere. This leaves some invocation uncertainty for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description restates the old_name behavior already present in the schema ('Current local-variable name. Omit to rename the function.'). It does not add meaningful semantics for new_name beyond its schema minLength, nor does it explain naming constraints or the address parameter beyond what the schema states. With 67% schema coverage, the description is adequate but not compensatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Rename a function, or a local variable inside one.' It clearly differentiates from sibling tools by stating exactly what operation is performed, and the added UI-context sentence reinforces the tool's purpose without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit procedural guidance: pass old_name to rename a local variable, omit it to rename the function itself. It also notes that this is what a click on an identifier fires, giving a concrete real-world trigger. It does not explicitly name alternatives or exclusions, but the operation is distinct enough among siblings that this is a minor gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_programSave programA
Write renames and comments back to the Ghidra project on disk. Nothing is lost without this, but nothing is durable with it either.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag non-read-only, non-destructive, closed-world behavior, and the description adds a persistence trait: changes are only durable after calling it. It also implies that the tool has no effect without pending renames or comments, which is useful context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences that front-load the action and then add a memorable durability caveat. There is no filler or duplication of schema data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless save operation with no output schema, the description fully covers what the tool does and when its effect matters. No additional return-value or parameter details are needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and schema coverage is 100%, so there is nothing for the description to clarify. Baseline 4 applies for a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the action (write back) and resource (renames/comments to the Ghidra project on disk), so an agent understands the tool's job. It doesn't explicitly name sibling tools like rename_symbol or add_comment, but the 'on disk' qualifier draws a practical distinction from in-memory edits.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The durability remark ('Nothing is lost without this, but nothing is durable with it either') signals that this is a save/persist step to run after editing operations, not a standalone tool. It does not name exclusions or alternatives, but the sequencing is reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xrefs_toCross-referencesBRead-only
Everything that references an address.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| address | Yes | Target address, e.g. 0x140001000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the read-only, closed-world character, and the description's 'Everything' is consistent with openWorldHint=false, suggesting an exhaustive in-program search. It adds little beyond the annotations, so it neither harms nor meaningfully enriches the behavioral picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The one-sentence description is short, with no filler. It is arguably too terse to carry much context, but for the core purpose it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read-only lookup, the basics are present: target address and optional limit appear in the schema. But there is no output schema and no mention of what the returned references look like or how the limit applies, so an agent must infer behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only the address parameter is documented in the schema; limit has no description, and the tool description adds no parameter-level meaning. At 50% coverage the description needed to compensate for the undocumented limit but did not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The phrase 'Everything that references an address' clearly names the returned resource (cross-references to a target address) and implies a lookup action. It is not a tautology, but it lacks an explicit verb and does not contrast itself with siblings like call_graph, which also deals with reference relationships.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given for when to prefer this tool over call_graph or other listing tools. The description merely states the function, so an agent gets no exclusions or selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
10 tool updates
v0.1.1- First observed
add_comment - First observed
call_graph - First observed
decompile - First observed
find_strings - First observed
list_functions - First observed
open_binary - First observed
program_info - First observed
rename_symbol - First observed
save_program - First observed
xrefs_to
TDQS
Each tool maps to a clearly distinct operation: loading, querying metadata, searching strings, decompiling, listing functions, graphing calls, finding xrefs, renaming, commenting, and saving. The few related tools like call_graph and xrefs_to are cleanly separated by their descriptions and intended use cases.
Most tools follow a readable verb_noun pattern such as open_binary, find_strings, list_functions, rename_symbol, add_comment, and save_program. A few commands deviate—program_info, call_graph, and xrefs_to are noun-style and decompile is a bare verb—but the names are still concise, snake_case, and reasonably predictable.
Ten tools is well-scoped for a Ghidra reverse-engineering server. Each tool covers a distinct step in the analyze-annotate-persist workflow, and none feel redundant or padded.
The surface covers the full core workflow: open, inspect, find strings, decompile, explore call graphs/xrefs, rename, comment, and save. Minor gaps remain—there is no raw disassembly view or broader symbol/import browser—but an agent can work around them using the provided tools.
Maintenance
Related MCP Connectors
Renders interactive Chart.js charts and dashboards inline in AI conversations.
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Live browser debugging for AI assistants — DOM, console, network via MCP.
AI Agent with Architectural Memory. Impact analysis (free), tests and code from the graph (pro).
Related MCP Servers
- FlicenseAqualityDmaintenanceEnables LLMs to perform binary analysis using Ghidra in headless mode, extracting functions, pseudocode, structs, and enums from binaries for interactive reverse-engineering.94-
- AlicenseNot gradedqualityDmaintenanceEnables LLMs to autonomously reverse engineer binaries using Ghidra's capabilities including decompilation, function analysis, automatic renaming, and BSim integration for function similarity matching.1AGPL 3.0
- AlicenseNot gradedqualityCmaintenanceBridges Ghidra's reverse engineering capabilities with AI tools through 179 specialized tools for automated binary analysis and documentation. It supports full read/write access for function decompilation, renaming, and cross-binary documentation transfer in both GUI and headless modes.Apache 2.0
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to analyze binaries, debug processes, and inspect kernel state using Ghidra, x64dbg, WinDbg, and ILSpyCmd.6Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/hellosverre/ghidralens'
If you have feedback or need assistance with the MCP directory API, please join our Discord server