Loading ToolBench
MCP server exposing Ghidra reverse engineering tools via PyGhidra
22 tools with consistent naming (verb_noun pattern) and complete input schemas. All tools have descriptions (avg 95 chars, within baseline 34-392). Parameters are well-typed with constraints (min/max, enums). However, output schemas are not documented in the source, LLMs cannot see what fields to expect from responses. Error handling is minimal; no recovery guidance or actionable error messages. Missing parameter descriptions for some fields (e.g., ghidra_get_function accepts 'name' OR 'address' but doesn't clarify mutual exclusivity). No security annotations despite WRITE operations on binary analysis state.
Decompile a function to C pseudocode.
Create or modify a struct data type.
Get assembly listing for a function.
Get the call graph for a function - what it calls and what calls it.
Get detailed info about a specific function by name or address.
Get metadata about the currently loaded binary.
Get cross-references to or from a specific address.
Output schemas not documented. LLMs cannot see what fields responses contain (e.g., ghidra_decompile returns pseudocode, but structure is opaque). This breaks tool chaining and forces agents to guess field names.
Mutually exclusive parameters not documented. ghidra_get_function accepts both 'name' and 'address' but doesn't clarify that one is required and they're mutually exclusive. LLMs may pass both or neither.
No error handling guidance. Tools lack recovery hints (e.g., 'Binary not found. Use ghidra_load_binary first.' or 'Function not found. Try ghidra_search_functions with a partial name.'). Agents cannot self-correct on failures.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
List exported symbols/functions.
List all functions in the loaded program with pagination.
List imported symbols/functions.
List all non-global namespaces (classes, modules) in the program.
List memory segments/sections in the binary.
List defined strings in the program with optional filtering.
Load a binary file into Ghidra for analysis. Returns program info summary.
Rename a function.
Rename a local variable within a function.
Run or re-run Ghidra's auto-analysis on the loaded program.
Search for a byte pattern in the binary's memory. Supports ?? wildcards. Pattern format: hex bytes separated by spaces. Use ?? for wildcard bytes. Examples: '48 89 e5', '48 ?? ?? 48 8b', 'ff 25 ?? ?? 00 00'
Search for functions whose name contains a given substring (case-insensitive).
Set a comment at a specific address.
Set a function's full type signature from a C-style prototype.
Change the data type of a local variable.
WRITE operations lack confirmation or dry-run support. ghidra_rename_function, ghidra_set_comment, ghidra_define_struct are destructive but have no confirmation step. Agents can accidentally corrupt analysis state.
No permission or scope declarations. Tools that modify binary analysis (rename, set_comment, define_struct) don't declare required permissions. No audit trail or access control visible.