Loading ToolBench
Provides AI control of Ghidra through the MCP-Link server using reflection-style code execution for unlimited API access. Connects to Aura Friday MCP-Link server and registers as 'ghidra' tool.
This MCP server has critical structural and documentation deficiencies. Tool definitions lack proper input schemas visible in the provided code, schemas are inferred from parameter documentation rather than formally defined. Descriptions exist but are generic and don't follow LLM-optimized patterns (most under 50 chars or generic boilerplate). Most critically, 4 of 7 tools (execute_java, execute_script, execute_python, call_tool) expose dangerous arbitrary code execution with minimal guardrails, no dry-run capability, no confirmation pattern, and inadequate error guidance. Parameter descriptions are sparse, 'operation' fields are not explained clearly, 'session_id' semantics are undefined. No output schemas documented. The 'call_tool' tool creates a meta-tool anti-pattern that invites infinite loops. Security is severely compromised: the server accepts arbitrary Java/Python code with full Ghidra API access, no sandboxing, no rate limiting, and no permission gates. Transport is HTTP, which is acceptable, but the protocol implementation is incomplete.
Call other MCP tools on the MCP-Link server
Get a description of a Java type including its methods, fields, and constructors
Pure Java reflection-based execution with 100% API access to Ghidra APIs
Executes Python code with full Ghidra API access using Ghidra's built-in scripting infrastructure
Executes multiple Java expressions in sequence like a script, supporting variable assignments and print statements
List available fields on a Java object or class using reflection
List available methods on a Java object or class using reflection
Arbitrary code execution without sandboxing or confirmation. Tools execute_java, execute_script, and execute_python accept arbitrary user-supplied code and execute it with full Ghidra API privileges. No dry-run mode, no confirmation pattern, no resource limits, no timeout guards. A single malformed or malicious expression can crash Ghidra or corrupt analysis. This violates the confirmation-request pattern entirely.
No input schemas formally defined or visible in source. Tools reference parameter names and types in descriptions, but JSON Schema definitions are not visible in provided code. This means schema validation is likely missing, and LLMs cannot verify valid inputs before tool invocation.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-21 | F | 33 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 21 | - | v1 |
No output schemas documented. None of the 7 tools document what they return, field names, types, or structure. Agents cannot plan downstream tool calls or extract required data without guessing.
Meta-tool anti-pattern: call_tool invokes other tools on the same server, creating potential infinite loops and composition ambiguity. Agents can already call tools directly via the MCP protocol, this tool adds unnecessary indirection and risk without clear value.
No error guidance or recovery hints. Tools document no error cases, recovery steps, or classification (retryable vs fatal). When execute_java fails to compile, what should the agent do? The tool provides no guidance.
Stateful 'session_id' parameter suggests server-side session management, which conflicts with modern MCP stateless design. It is unclear how session_id is generated, validated, or expired. If sessions are persistent, this creates a security risk, old sessions could be replayed or hijacked.
Vague parameter descriptions. The 'operation' parameter is documented as 'must be execute_java, eval, or reflect' but the description does not explain what 'eval' or 'reflect' modes do, how they differ, or when to use each. Similarly, session_id is marked 'Optional' with no guidance on when to provide it or how persistence works.
No pagination or result limits documented. If list_methods or list_fields returns a large class (e.g. java.lang.Object with hundreds of inherited methods), the response could exceed context limits. No limit or pagination parameter documented.
No audit trail or logging mechanism visible. The MCPLinkConnection class references 'ui_provider_for_logging' but no details on what is logged, to where, or how agents can audit their own actions. This is critical for compliance if Ghidra analysis is regulated.