Loading ToolBench
MCP server for Ghidra binary analysis platform, providing tools for disassembly, function analysis, cross-references, and vulnerability auditing
Five tools with complete input schemas and descriptions. Naming follows verb_noun pattern (audit, disassemble_range, get_function_info, get_program_info, get_xrefs). Descriptions are substantive (100-200 chars), explaining WHAT and WHEN. Parameters have types and descriptions. However, output schemas are not documented in the visible code, only input schemas are defined. Error handling is mentioned (errorReporting=true) but recovery guidance is not visible in tool definitions. No tool annotations (readOnlyHint, destructiveHint) despite all being READ_ONLY. Parameter descriptions could be more prescriptive about formats and constraints.
Run deterministic vuln/hardening checks. Actions: dangerous_calls (call sites of strcpy/gets/system/etc.), format_strings (printf calls with non-constant format), hardening (stack canary / NX / ASLR / RELRO / CFG / CET report), anti_analysis (IsDebuggerPresent / ptrace / RDTSC / VM checks).
Instruction-level disassembly over an address range or a whole function. Returns bytes, mnemonic, operands, flow_type, comments. Arch-portable through Ghidra's SLEIGH.
Return detailed information about a single function: signature, prototype, parameters, xref counts, analysis flags, and optionally decompiled C-like source. Use after list_functions to drill in.
Return high-level metadata about the active program: name, format, language, image base, entry points, address spaces, memory size, function/symbol counts. Per-field absence is silent (sentinel-on-missing).
Cross-references for an address: inbound (callers/accessors), outbound (what this touches), or both. Reference-type filter. Closes the count-only gap left by get_function_info.
Output schemas not documented. Tool definitions show input schemas but no return type documentation. LLMs cannot plan downstream calls or extract required fields without knowing what each tool returns.
Tool annotations missing. All five tools are READ_ONLY but lack readOnlyHint annotation. This prevents clients from understanding safety properties and optimizing caching/retry logic.
Parameter format constraints not explicit. 'address' and 'function' parameters accept multiple formats (name, address, interior body address) but descriptions lack regex patterns or format examples. LLMs may pass invalid formats.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Error recovery guidance absent. errorReporting=true but tool definitions do not include recovery hints (e.g., 'If function not found, try list_functions first'). Agents cannot self-correct on failures.
Pagination not implemented. get_xrefs and audit accept max_results but no cursor/offset for continuation. Large result sets cannot be fully retrieved across multiple calls.