Skip to main content
Glama

GhidraLens

Ghidra, rendered inside your AI client. Click a symbol to rename it. Click a call to follow it.

CI MCP Apps Ghidra 11.3+ Local models npm MIT

The decompiler view

Every Ghidra MCP server so far returns text. The model can read it; you cannot navigate it. GhidraLens returns the same analysis as an interactive view — built on MCP Apps (io.modelcontextprotocol/ui), the extension that lets a server ship real HTML into the conversation.

You and the model are looking at the same live program. Rename a variable by clicking it and the model's next decompile sees the new name.

That is a real screenshot: where.exe, decompiled by Ghidra, every identifier carrying the address it came from.


What you get

View

What it does

Decompiler

Ghidra's C output as a live token stream — every identifier carries its address and its kind. Click a local to rename it, click a call to follow it. Callers, callees and variables in a sidebar.

Function browser

Every function in the binary, filterable and sortable by address, name, size or caller count. Click a row to decompile it.

Call graph

Callers to the left, callees to the right, the function you asked about in the middle. Click any node to recenter.

Function browser

The function browser

Call graph

The call graph

Ten tools total. Three open views; the rest are lookups and writes, including two the model never sees — they exist only so a click in a view can fire them.

Related MCP server: GhidraMCP

How it fits together

  MCP client  ──stdio──▶  server/  ──HTTP──▶  bridge/  ──JPype──▶  Ghidra (JVM)
  (Claude,                 TypeScript         PyGhidra            program stays
   Cursor, …)              MCP server         session             resident
       ▲
       │  ui:// HTML in a sandboxed iframe
       └──  ui/  three self-contained views

The bridge is a separate long-lived process on purpose. Ghidra's auto-analysis is the expensive step, and it happens once. Measured on a 64 KB Windows system utility (198 functions):

First open, with analysis

25 s

Re-open the same binary

0.3 s

Decompile one 2 KB function

0.4 s

87-node call graph

< 0.1 s

Restart the MCP server or the client and the analysed program is still there.

Setup

Prerequisites: Ghidra 11.3+, a JDK 21+, Python 3.9–3.13 (not 3.14 — JPype has no wheel for it yet), Node 20+. See bridge/setup.py.md — the Python side is fussy and that file covers every way it goes wrong. GhidraLens finds a JDK for you if JAVA_HOME is unset, which covers the usual "installed Java, shell has not restarted" case.

git clone https://github.com/hellosverre/ghidralens
cd ghidralens
npm install
npm run build

Then start the bridge on the binary you want to look at:

python bridge/serve.py --binary /path/to/target.exe

It prints a token. Put that, and the path to the built server, into your MCP client config:

{
  "mcpServers": {
    "ghidralens": {
      "command": "npx",
      "args": ["-y", "ghidralens"],
      "env": {
        "GHIDRALENS_BRIDGE_URL": "http://127.0.0.1:8799",
        "GHIDRALENS_TOKEN": "paste-the-printed-token-here"
      }
    }
  }
}

Running from a clone instead? Point command at node and args at /absolute/path/to/ghidralens/server/dist/index.js.

Then ask your client: "decompile the function that handles license validation".

Also listed in the official MCP Registry as io.github.hellosverre/ghidralens.

Editing the config by hand? Quit the client first — properly, including any system-tray icon. Claude Desktop keeps its own copy of claude_desktop_config.json in memory and writes it back over yours when it exits, so an edit made while it is running silently disappears on the next restart. Editing through Settings → Developer → Edit Config avoids the race entirely.

Tools

Tool

Visible to

Renders

open_binary

model

program_info

model

decompile

model + view

Decompiler

list_functions

model + view

Function browser

call_graph

model + view

Call graph

find_strings

model

xrefs_to

model + view

rename_symbol

model + view

add_comment

view only

save_program

model

add_comment is hidden from the model deliberately. Visibility is how MCP Apps separates "the agent may do this" from "a click may do this"; keeping write tools out of the model's list keeps it short and stops the model from renaming things on its own initiative.

Renames and comments live in memory until save_program writes them into the Ghidra project — after which they show up in the Ghidra GUI like any other edit.

Developing the views without Ghidra

npm run dev:ui
# open http://localhost:5173/dev/harness.html

ui/dev/harness.ts is a real MCP Apps host — it runs the SDK's AppBridge against the view in an iframe, so the ui/initialize handshake, the opening ui/notifications/tool-result, and every tools/call a click fires all go over real postMessage JSON-RPC. There is a message trace down the right-hand side and a host-theme switch, because the views have to look right in both.

Two data sources, switchable in the toolbar:

  • fixtures — no Ghidra needed, nothing to install

  • live bridge — proxies to a running bridge, so you develop against a real analysed program

Use live before you trust anything. Fixtures are tidy; real output is a 400-line function with 56 locals and an 87-node call graph, and that is where layout actually breaks.

Running it on a local model

Reverse engineering is exactly the work people would rather not send to a hosted model, so agent/ollama-agent.mjs is a small MCP host that puts GhidraLens behind Ollama instead. No API key, nothing leaves the machine.

OLLAMA_MODEL=qwen3:14b node agent/ollama-agent.mjs "what does this binary do?"

It respects _meta.ui.visibility, so the app-only tools stay hidden from the model — the same separation a graphical client enforces. A ~9B model is enough to orient itself with find_strings and list_functions; a 14B is noticeably better at reading decompiled C.

Tests

Suite

Needs Ghidra

Covers

node server/smoke.mjs

no

MCP surface: tools, ui:// resources, tool visibility, graceful failure with no bridge

python bridge/test_serve.py

no

Bridge auth, CSRF rejection, routing, input validation

python bridge/test_session.py

yes

Every Ghidra call: analysis, caching, decompiler tokens, imports, renames, writes

node server/live.mjs

yes (bridge running)

The whole chain, and that every payload matches the shape the views index into

The first two are what CI can run. test_session.py is the one that matters after touching bridge/session.py — it is the only thing that proves the Ghidra API calls are right, and it caught three real bugs the day it was written.

Containerising it

The Dockerfile builds the server and views for clients or registries that want to start it themselves. One thing to get right:

CMD ["node", "server/dist/index.js"]     # correct
CMD ["npm", "run", "start"]              # breaks the protocol

A stdio MCP server speaks JSON-RPC on stdout, and npm run / pnpm run print the script banner there first:

> ghidralens@0.1.1 start
> node server/dist/index.js

Those lines land in the stream ahead of the handshake and the client gives up mid-initialize. The symptom is unhelpful - the container builds, starts, exits cleanly, and the client just reports no tools - so it is worth not stepping on. Invoke node directly.

Real analysis still needs the bridge on the host: 127.0.0.1 inside a container is the container, so point GHIDRALENS_BRIDGE_URL at host.docker.internal or a real address.

Security

The bridge binds 127.0.0.1 only, requires a per-run token in X-GhidraLens-Token, and rejects any request carrying an Origin or Referer header — so a page open in your browser cannot reach your decompiler. It has no multi-user model and is not meant to be exposed; --host refuses anything but loopback.

Analysing a binary does not execute it, but Ghidra will happily open malware. Use the same isolation you would use for any other RE work.

Licence

MIT.

Available Tools

10 tools
add_commentAdd commentA

Attach a plate comment at an address. Persists into the Ghidra project, so notes made here show up in the Ghidra GUI.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
addressYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is not read-only, and the description adds meaningful context by stating the comment persists into the Ghidra project and appears in the GUI. This goes beyond the annotation signal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no filler. The core action is front-loaded, and the second sentence adds relevant persistence behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, but the description omits important invocation details like address format and whether an existing comment is replaced or supplemented. It covers persistence well enough but is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description only generically references 'an address.' It does not explain the expected format of address (e.g., hex, symbol) or the semantics of text, leaving the agent without guidance on how to fill the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Attach a plate comment at an address.' This clearly identifies the operation and distinguishes it from sibling tools like decompile or rename_symbol.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives. The sentence about persistence provides motivation but not selection criteria or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

call_graphCall graphA
Read-only

Draw the callers and callees around one function as a navigable graph. Depth is capped at 3 because call graphs fan out exponentially.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
depthNo
addressNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description complements this by disclosing the depth cap of 3 and the reason behind it (exponential fan-out). It also describes the output modality as a navigable graph, adding useful behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The main action is front-loaded, and the depth-cap rationale is a useful, concise addition that earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, no required parameters, and zero parameter descriptions, the description leaves important gaps: what 'name' vs 'address' mean, whether either is sufficient, and what the navigable graph output actually contains. For a tool with this much structural ambiguity, the description is not complete enough for an agent to invoke it reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the parameters, but it does not. 'name' and 'address' are both undocumented and their relationship is unclear, and 'depth' is only implicitly referenced by the cap statement, not explained as a user-controllable parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Draw') and clearly identifies the resource: callers and callees around one function. It also distinguishes this tool by emphasizing the navigable graph output, which separates it from list-oriented siblings like xrefs_to or list_functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context for use is implied: call_graph is for exploring the caller/callee relationships of a single function as a graph. However, it never explicitly states when to prefer this over xrefs_to or other sibling tools, nor does it mention any exclusions or alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decompileDecompile functionA
Read-only

Decompile one function to C and show it in an interactive view. Identify the function by address (hex) or by name.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoFunction name, e.g. main
addressNoEntry point, e.g. 0x140001000

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the tool is known to be a safe read operation. The description adds that the result appears in an interactive C view and that the function can be identified by address or name, which is useful but does not address edge behavior such as missing symbols or invalid addresses. Given the read-only annotation, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The core action and output are front-loaded in the first sentence, and the identification criteria complete the second sentence efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only decompile tool with two self-describing optional parameters, the description covers the main usage: decompile one function, see C in an interactive view, and identify the function by name or address. It does not describe failure behavior or state that at least one identifier is required, but that gap is minor given the clarity of the rest of the definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter described and exemplified in the input schema. The description adds the relationship that identification can be done 'by address (hex) or by name,' but it does not clarify whether exactly one must always be provided or what happens if both are supplied. Overall, the description adds only marginal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Decompile one function to C and show it in an interactive view.' This clearly conveys what the tool does and is easy to distinguish from siblings such as list_functions or call_graph, which target listing or relationships rather than C pseudocode for a single function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when a single function needs to be decompiled) and says how to identify the function 'by address (hex) or by name,' but it does not explicitly state when not to use it or name an alternative. The context is clear enough to infer basic usage, but there is no direct routing guidance versus sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_stringsFind stringsA
Read-only

Search defined string data. Usually the fastest way into an unknown binary - find the message, then look at what references it.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
queryNo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, covering the safety profile, and the description aligns with that by describing a search operation. The description adds a speed/strategy heuristic beyond the annotations, but it does not disclose behavioral details such as case sensitivity, substring vs. exact matching, or how the limit parameter affects results. This is acceptable given the read-only annotation but not richly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences deliver a precise definition and a useful workflow heuristic. Every word earns its place, and the core action is front-loaded. No redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only search tool, the description provides enough to understand purpose and workflow. However, since there is no output schema and parameter descriptions are absent, an agent must infer query matching behavior, result shape, and the practical meaning of the limit parameter. Slightly more detail would make it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden of explaining parameters. It does not compensate: there is no mention of what query means (substring, regex, case sensitivity) or how limit behaves beyond the schema's min/max. The parameter names are somewhat self-explanatory, but the description adds no semantic value for them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action and resource: 'Search defined string data.' It also distinguishes itself from function-oriented siblings like decompile, list_functions, and call_graph by emphasizing string discovery. The added heuristic about finding a message and looking at references makes the purpose concrete and memorable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit context: it is 'usually the fastest way into an unknown binary' and suggests a follow-up step ('find the message, then look at what references it'). It does not explicitly name the sibling tool xrefs_to or state when not to use it, but the intended workflow is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_functionsList functionsA
Read-only

Browse the program's functions in a sortable table. Filter by substring; sort by address, name, size or caller count.

ParametersJSON Schema
NameRequiredDescriptionDefault
sortNo
limitNo
queryNoCase-insensitive name filter
offsetNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful details about filter and sort behavior, but it does not disclose output shape, pagination semantics, or any limits beyond the schema. This is acceptable but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences pack in the resource, action, filtering capability, and sortable columns. There is no filler, and the most useful information is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with no required parameters, the description covers the core purpose and key behaviors well. The main gaps are lack of explicit return shape and default/pagination behavior, but the sortable-table framing plus the schema's limit/offset fields make this largely sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is low at 25%, so the description must compensate. It adds meaning for the query parameter ('substring') and repeats sort fields, matching the sort enum. However, limit and offset are not explained in the description, leaving pagination semantics to be inferred from their names and schema constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly names the resource ('the program's functions') and the action ('browse'), with concrete capabilities like substring filtering and sorting. It does not explicitly distinguish itself from siblings such as call_graph or program_info, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you need a sortable, filterable table of functions. However, it gives no explicit guidance about when to prefer list_functions over sibling tools, nor any exclusions or when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

open_binaryOpen binaryA

Load an executable into the Ghidra session and run auto-analysis. Slow the first time for a given file (seconds to minutes); cached in the Ghidra project afterwards. Must be called before anything else.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path to the executable
analyzeNoRun auto-analysis. Only set false if already analysed.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description meaningfully adds context beyond the annotations: it warns about slow first-time execution, notes caching behavior in the Ghidra project, and declares a prerequisite relationship with all other tools. It does not contradict the readOnlyHint=false / openWorldHint=false annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with no filler. The core behavior is front-loaded, followed by performance expectations and the essential ordering rule.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only two parameters and no output schema, the description covers the necessary operational context: what it does, how long it might take, that results are cached, and that it must run first. A small gap is that it does not explicitly mention error conditions or what happens if the path is invalid, but this is not essential for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description does not need to compensate. The description reinforces that auto-analysis happens, which aligns with the 'analyze' parameter, but it does not add new parameter-level meaning beyond what the schema already explains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific action: load an executable into the Ghidra session and run auto-analysis. This clearly differentiates it from sibling analytical tools like decompile, list_functions, or call_graph, which operate on an already-loaded program.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Must be called before anything else,' giving the agent a clear ordering constraint. It also provides practical timing guidance (slow first load, cached afterwards) that helps the agent decide when this tool is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

program_infoProgram infoA
Read-only

What is currently open: format, architecture, function count.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already communicates that this is a safe read operation, so the description does not need to restate that. It adds some value by enumerating exactly what information is available, but it does not describe the return shape or behavior when no program is currently open.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with no filler. It front-loads the scope ('currently open') and then lists the exact informational payload, so every word contributes to the agent's understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only informational tool, the description provides the essential facts needed to decide whether to call it. It is slightly thin on expected return formatting or behavior when no program is open, but those are minor given the simplicity and the safety annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, so the empty input schema fully covers the parameter surface. The description's mention of the 'currently open' program provides the only relevant context needed, which is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as the currently open program and lists the specific details returned: format, architecture, and function count. However, it lacks an explicit verb and does not directly distinguish itself from the sibling tools beyond the implied 'currently open' scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'currently open' gives useful context that this tool applies after a binary is loaded, and the sibling list includes open_binary as a likely alternative. Still, there is no explicit statement of when to use this tool versus others, leaving the routing mostly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rename_symbolRename symbolA

Rename a function, or a local variable inside one. Pass old_name to rename a local; omit it to rename the function itself. This is what a click on an identifier in the decompiler view fires.

ParametersJSON Schema
NameRequiredDescriptionDefault
addressYesAddress of the function that owns the symbol
new_nameYes
old_nameNoCurrent local-variable name. Omit to rename the function.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal a mutating operation (readOnlyHint=false) that is not classified as destructive. The description adds the function-vs-local mode distinction, but that is also captured in the schema's old_name description. It does not disclose persistence, reference updates, return behavior, or error cases, so it adds only modest transparency beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: the first defines the operation, the second gives the conditional parameter behavior, and the third provides practical context. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward 3-parameter rename, the description plus schema is enough to select the correct parameters. However, there is no output schema and no mention of return values, side effects, name validity, or whether renaming updates references elsewhere. This leaves some invocation uncertainty for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description restates the old_name behavior already present in the schema ('Current local-variable name. Omit to rename the function.'). It does not add meaningful semantics for new_name beyond its schema minLength, nor does it explain naming constraints or the address parameter beyond what the schema states. With 67% schema coverage, the description is adequate but not compensatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Rename a function, or a local variable inside one.' It clearly differentiates from sibling tools by stating exactly what operation is performed, and the added UI-context sentence reinforces the tool's purpose without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit procedural guidance: pass old_name to rename a local variable, omit it to rename the function itself. It also notes that this is what a click on an identifier fires, giving a concrete real-world trigger. It does not explicitly name alternatives or exclusions, but the operation is distinct enough among siblings that this is a minor gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_programSave programA

Write renames and comments back to the Ghidra project on disk. Nothing is lost without this, but nothing is durable with it either.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag non-read-only, non-destructive, closed-world behavior, and the description adds a persistence trait: changes are only durable after calling it. It also implies that the tool has no effect without pending renames or comments, which is useful context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences that front-load the action and then add a memorable durability caveat. There is no filler or duplication of schema data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless save operation with no output schema, the description fully covers what the tool does and when its effect matters. No additional return-value or parameter details are needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and schema coverage is 100%, so there is nothing for the description to clarify. Baseline 4 applies for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the action (write back) and resource (renames/comments to the Ghidra project on disk), so an agent understands the tool's job. It doesn't explicitly name sibling tools like rename_symbol or add_comment, but the 'on disk' qualifier draws a practical distinction from in-memory edits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The durability remark ('Nothing is lost without this, but nothing is durable with it either') signals that this is a save/persist step to run after editing operations, not a standalone tool. It does not name exclusions or alternatives, but the sequencing is reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

xrefs_toCross-referencesB
Read-only

Everything that references an address.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
addressYesTarget address, e.g. 0x140001000

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the read-only, closed-world character, and the description's 'Everything' is consistent with openWorldHint=false, suggesting an exhaustive in-program search. It adds little beyond the annotations, so it neither harms nor meaningfully enriches the behavioral picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The one-sentence description is short, with no filler. It is arguably too terse to carry much context, but for the core purpose it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read-only lookup, the basics are present: target address and optional limit appear in the schema. But there is no output schema and no mention of what the returned references look like or how the limit applies, so an agent must infer behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only the address parameter is documented in the schema; limit has no description, and the tool description adds no parameter-level meaning. At 50% coverage the description needed to compensate for the undocumented limit but did not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase 'Everything that references an address' clearly names the returned resource (cross-references to a target address) and implies a lookup action. It is not a tautology, but it lacks an explicit verb and does not contrast itself with siblings like call_graph, which also deals with reference relationships.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to prefer this tool over call_graph or other listing tools. The description merely states the function, so an agent gets no exclusions or selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 10 tool updatesv0.1.1
    • First observedadd_comment
    • First observedcall_graph
    • First observeddecompile
    • First observedfind_strings
    • First observedlist_functions
    • First observedopen_binary
    • First observedprogram_info
    • First observedrename_symbol
    • First observedsave_program
    • First observedxrefs_to

TDQS

A3.8/5.0
Disambiguation5/5

Each tool maps to a clearly distinct operation: loading, querying metadata, searching strings, decompiling, listing functions, graphing calls, finding xrefs, renaming, commenting, and saving. The few related tools like call_graph and xrefs_to are cleanly separated by their descriptions and intended use cases.

Naming Consistency4/5

Most tools follow a readable verb_noun pattern such as open_binary, find_strings, list_functions, rename_symbol, add_comment, and save_program. A few commands deviate—program_info, call_graph, and xrefs_to are noun-style and decompile is a bare verb—but the names are still concise, snake_case, and reasonably predictable.

Tool Count5/5

Ten tools is well-scoped for a Ghidra reverse-engineering server. Each tool covers a distinct step in the analyze-annotate-persist workflow, and none feel redundant or padded.

Completeness4/5

The surface covers the full core workflow: open, inspect, find strings, decompile, explore call graphs/xrefs, rename, comment, and save. Minor gaps remain—there is no raw disassembly view or broader symbol/import browser—but an agent can work around them using the provided tools.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables LLMs to autonomously reverse engineer binaries using Ghidra's capabilities including decompilation, function analysis, automatic renaming, and BSim integration for function similarity matching.
    1
    AGPL 3.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Bridges Ghidra's reverse engineering capabilities with AI tools through 179 specialized tools for automated binary analysis and documentation. It supports full read/write access for function decompilation, renaming, and cross-binary documentation transfer in both GUI and headless modes.
    Apache 2.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/hellosverre/ghidralens'

If you have feedback or need assistance with the MCP directory API, please join our Discord server