MCP Server that wraps the local Cutter FastAPI plugin endpoints into MCP tools usable by LLMs for reverse engineering and binary analysis
CutterMCP-plus is a binary analysis tool wrapper around a local Cutter FastAPI plugin. All 20 tools are present with descriptions and input schemas. However, there are consistent gaps in schema completeness, output documentation, and error handling guidance. Naming is action-verb-based and generally clear (list_*, get_*, disasm_*, decompile, rename_*, set_*). Descriptions are mostly adequate (80-150 chars) but lack actionable context for LLM decision-making and error recovery. Parameter schemas are present but lack proper typing constraints (enums, ranges, patterns). Output schemas are not documented, LLMs cannot plan downstream calls without knowing what fields are returned. No error handling guidance is provided; failed calls offer no recovery path. Moderate quality, functional but missing several pattern implementations required for production agent use.
Get the currently selected address (hex string).
Get information of the function containing the current address.
Decompile the function. addr is the address to decompile. If this fails, you can try disasm_text for disassembly.
Disassemble the entire function as JSON (pdfj). Beware of large functions. If result is null, use text instead.
Disassemble the entire function as text (pdf) given its address. Recommended, but be cautious of large functions. If this fails, try disasm_text.
Linear disassembly in JSON format. Returns {addr, count, ops:[...]}. Default 64 ops.
No output schemas documented. Return types are inferred from code (Dict, str, List) but LLMs cannot plan downstream tool calls without knowing what fields each tool returns (e.g., does list_functions return 'addr', 'name', 'size'? What's the exact field name?). This blocks composition and forces agents to guess about response structure.
No error handling guidance. Descriptions do not explain what happens on failure (e.g., 'If addr is invalid, returns what? Try what?' for disasm_by_func_text). Agents have no recovery path when tools fail. No categorization of errors as retryable, user-fixable, or fatal.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 61 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Linear disassembly text: from addr, list count instructions, default 64. Can be used as a fallback when disasm_by_func_text fails.
Get detailed structured information of a single function (address, size, xrefs, etc.). Pass the hexadecimal address string.
List entry points.
List brief information of functions. Returns up to limit items. Use this first to filter targets, then fetch disassembly/decompiled code. Returns fields: addr (hex), name, size, n_bb.
List global symbols.
List segments/sections. Returns fields: name, vaddr, paddr, size, perm.
List strings. Can filter out shorter strings with min_length. Returns fields: addr, length, type, string.
List variables/parameters in the function. Returns a variables array.
Read raw bytes at the given address. Default size is 64.
Rename a function.
Rename local variable/parameter.
Set a comment at the given address (CCu).
Set local variable type.
Get cross-references to a given address.
Parameter constraints missing or incomplete. addr parameters accept 'hexadecimal address string' but no regex pattern, length limit, or format validation is defined. size, count, offset, limit parameters have no min/max bounds. count defaults to 64, size defaults to 64, but what are the absolute limits? An LLM could request 1,000,000 instructions, causing a timeout or OOM.
Descriptions lack actionable context for LLM decision-making. Many descriptions (65-75 chars) state WHAT but not WHEN or WHY to use the tool. E.g., 'Get detailed structured information of a single function', when would an LLM prefer this over function_detail? What's the exact difference? 'Disassemble the entire function as JSON (pdfj). Beware of large functions. If result is null, use text instead.', this warns of a problem but does not explain the root cause or when JSON vs text is preferable.
No pagination guidance in return descriptions. list_functions, list_strings, list_segments, list_globals all accept offset/limit but descriptions do not explain the response format (is there a 'total' count? a 'next_cursor'?). This blocks agents from implementing reliable pagination loops.
Write tools (rename_function, set_comment, rename_local_variable, set_local_variable_type) return 'ok' string on success but this is undocumented. What does 'ok' mean? Is it idempotent (safe to retry)? What do errors look like? Does a duplicate rename fail or silently succeed?
No confirmation pattern for destructive operations. rename_function and rename_local_variable directly modify the binary analysis database with no dry-run or confirmation step. Agents can accidentally overwrite function names or variable types. Pattern: confirmation-request not implemented.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Protocol 2026-07-28 supports tool-level hints to guide agent behavior. read_bytes should be marked readOnly. rename_function and set_comment should be marked destructive. This helps agents respect agent constraints and plan more carefully.