Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@BinDiff MCP Tool compare original.bin and patched.bin to see which functions changed"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that provides binary comparison capabilities using IDA Pro and BinDiff.
Compare Binaries: Compare two binary files (e.g., original vs. patched).
Function Analysis: Get a summary of similarity and a list of changed functions.
Headless Operation: Uses IDA Pro in headless mode and IDAPython for automation.
Related MCP server: IDA Pro MCP
Python 3.10+
IDA Pro (9.0+ recommended)
BinDiff (installed and capable of running from command line).
uv (recommended for package management).
Download the latest .deb package (e.g., bindiff_8_amd64.deb) from the official releases.
Install using dpkg:
sudo dpkg -i bindiff_8_amd64.debVerify installation:
which bindiffThe tool attempts to auto-detect IDA and BinDiff. You can override these by setting environment variables or editing src/config.py.
IDA Pro: 9.1 (recommended) or 9.0+.
BinDiff: Installed via installer.
Environment:
IDADIR: Path to IDA installation (e.g., /Applications/IDA91/IDA Professional 9.1.app/Contents/MacOS).
BINDIFF_PATH: Path to bindiff binary (e.g., /usr/local/bin/bindiff).
IDA Pro: 9.0+ installed (e.g., in /opt/idapro-9.1).
BinDiff: Installed and accessible.
Environment:
IDADIR: Required. Set to your IDA installation base directory containing libidalib.so (e.g., /opt/idapro-9.1).
BINDIFF_PATH: Path to bindiff executable (default checks $PATH).
Ensure idalib is present in $IDADIR/idalib.
IDADIR: Path to the IDA Pro installation directory (containing idat and idalib).
BINDIFF_PATH: Path to the bindiff executable.
MCP_TIMEOUT: Timeout for analysis steps in seconds (default: 3600).
Clone this repository.
Install dependencies using uv:
uv syncStart the server in SSE mode so it can be accessed by remote or local clients via HTTP:
Linux (Docker/Server):
IDADIR=/app/ida-pro-9.1 BINDIFF_PATH=/usr/bin/bindiff uv run bindiff-mcp --transport sse --host 0.0.0.0 --port 8001macOS:
IDADIR="/Applications/IDA91/IDA Professional 9.1.app/Contents/MacOS" BINDIFF_PATH=/usr/local/bin/bindiff uv run bindiff-mcp --transport sse --host 0.0.0.0 --port 8001Configure your MCP client to connect via the /sse endpoint:
{
"mcpServers": {
"bindiff-mcp": {
"type": "remote",
"url": "http://127.0.0.1:8001/sse"
}
}
}Structure:
src/server.py: Main MCP server entry point.
src/core/: Core logic for IDA export, BinDiff execution, and parsing.
src/config.py: Configuration handling.
Compares two binary files using IDA Pro and BinDiff.
Resulting detailed difference lists are saved to the specified directory (default: current directory).
Generated files:
1. matched_similar.json (Identical functions)
2. matched_different.json (Matched but Changed functions)
3. primary_only.json (Unmatched in Primary)
4. secondary_only.json (Unmatched in Secondary)
Args:
primary_binary: Path to the first binary (e.g. original)
secondary_binary: Path to the second binary (e.g. patched)
output_results_dir: Directory to save the result files (default: current dir)
| Name | Required | Description | Default |
|---|---|---|---|
| primary_binary | Yes | ||
| secondary_binary | Yes | ||
| output_results_dir | No | . |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: it performs a comparison (implying read-only analysis), saves results to files, lists the specific output files generated, and specifies a default directory. This covers essential operational traits without contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, starting with the core purpose, followed by output details and parameter explanations. Each sentence adds value without redundancy, making it efficient and well-structured for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (binary comparison with file generation), no annotations, and an output schema present, the description is largely complete. It explains the purpose, behavior, and parameters thoroughly. However, it could slightly enhance completeness by mentioning potential prerequisites (e.g., IDA Pro/BinDiff installation) or error handling, though the output schema may cover return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must compensate. It adds significant meaning beyond the schema by explaining each parameter's purpose (e.g., 'Path to the first binary (e.g. original)'), providing examples, and clarifying the default behavior for the output directory. This fully documents all three parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('compares two binary files') and resources ('using IDA Pro and BinDiff'), and distinguishes its function by detailing the output files generated. It goes beyond a simple restatement of the name to explain what the comparison entails.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by specifying the types of binaries (e.g., 'original' vs. 'patched') and the default output directory, but it does not explicitly state when to use this tool versus alternatives or provide any exclusions. With no sibling tools, this is adequate but lacks explicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0bindiff_compareWith only one tool, there is no possibility of ambiguity or overlap between tools. The single tool has a clearly defined purpose of comparing binary files using BinDiff and IDA Pro.
The single tool name 'bindiff_compare' follows a clear verb_noun pattern and is consistent with itself. There are no other tools to create inconsistency.
A single tool is generally too few for most server purposes, making the surface feel thin and incomplete. While this might be appropriate for a very narrow utility, it limits functionality and suggests the server may be under-scoped.
The server appears focused on binary comparison, but with only a compare tool, there are significant gaps. Missing operations might include analyzing results, managing comparisons, or integrating with other BinDiff features, making the surface incomplete for typical binary analysis workflows.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
AI-powered codebase analysis — call graphs, security, dead code, complexity. 150+ tools.
Enterprise code intelligence for M&A, security audits, and tech debt. Hosted server with 200k free.
Ground-truth code graph for your codebase: exact callers, callees, symbols & dependencies.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/u21h2/bindiff-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
