MCP server for binary reverse engineering analysis using sleuthre-core
sleuthre-mcp exposes 17 reverse-engineering tools with consistent naming (verb_noun pattern: get_*, open_*, rename_*, add_*, save_*, load_*, run_*) and complete input schemas. However, descriptions are terse (10-50 chars, well below the 194-char baseline), lack context on WHEN to use each tool, and omit dependency hints. Parameters are typed but lack detailed constraints (e.g., address format, count bounds). Output schemas are not documented. Error handling is absent from descriptions. Tools are well-scoped (single responsibility), but the interface prioritizes reverse-engineering domain knowledge over LLM-friendly guidance.
Add or update a comment at an address
Get control flow graph for a function
Disassemble N instructions starting at an address
List all exports
List all discovered functions
Get HLIL (High-Level Intermediate Language) decompiled code for a function
List all imports
Get LLIL (Low-Level Intermediate Language) for a function
Descriptions are uniformly terse (10-50 chars vs. 194-char baseline). Most lack context on WHEN to use the tool, prerequisites, or what to do with results. E.g., 'Get LLIL for a function' does not explain that LLIL is an intermediate representation or when to prefer it over HLIL.
Output schemas are not documented. LLMs cannot infer what fields get_functions, get_strings, get_xrefs, or get_cfg return, forcing them to guess or make wasteful follow-up calls. No pagination guidance for list-like tools.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Get MLIL (Medium-Level Intermediate Language) in SSA form for a function
Get SSA variables and their usage sites for a function
List all discovered strings
Get cross-references for an address
Load a previously saved project from a .slre file
Load a binary file (ELF/PE) for analysis
Rename a function
Run analysis plugins and return findings
Save the current project to a .slre file
Parameter descriptions lack actionable constraints. 'address' is described as 'hex format (e.g., 0x1000)' but does not specify valid range, alignment, or what happens if the address is invalid. 'count' in get_disasm has a default but no min/max bounds.
No error handling guidance in tool descriptions. LLMs do not know what to do if open_binary fails (file not found? unsupported format?), if an address is out of bounds, or if a project save fails due to invalid path.
Tool composition assumes stateful context (e.g., open_binary must be called before get_disasm, but this dependency is not documented). LLMs may attempt to call get_disasm without first opening a binary, leading to failures.