Loading ToolBench
MCP server that exposes Ghidra reverse engineering capabilities through an HTTP bridge, allowing decompilation, disassembly, function analysis, and binary metadata inspection
GhidraMCP has 27 tools with consistent naming (verb_noun pattern: list_, get_, decompile_, rename_, set_, search_) and basic parameter schemas. However, tool descriptions are minimal (10-50 chars, well below the 194-char baseline), parameter descriptions lack depth, and output schemas are entirely undocumented. No error handling guidance, no recovery paths, and no indication of which operations are destructive. The bridge_mcp_ghidra.py file shows tool registration via @mcp.tool() decorators with parameter type hints, but descriptions are one-liners that do not explain WHEN to use each tool or what the LLM should expect in return. Risk classification (READ_ONLY vs WRITE) is noted in metadata but not surfaced in tool descriptions to guide agent behavior.
Decompile a specific function by name and return the decompiled C code.
Decompile a function at the given address.
Get assembly code (address: instruction; comment) for a function.
Get the address currently selected by the user.
Get the function currently selected by the user.
Get a function by its address.
Get all references to the specified function by name.
Tool descriptions are 10 - 50 characters, far below the 194-char baseline. Examples: 'List all function names in the program with pagination' (54 chars) lacks WHEN to use it or what the LLM should do with results. Descriptions do not explain the relationship between similar tools (list_methods vs list_functions vs search_functions_by_name).
Output schemas are completely undocumented. Tools return strings or lists of strings (safe_get/safe_post return types), but the LLM has no visibility into what fields are present, their types, or how to chain results to downstream tools. E.g., decompile_function returns a string, but does it include line numbers, variable names, or just raw C code?
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Get all references from the specified address (xref from).
Get all references to the specified address (xref to).
List all namespace/class names in the program with pagination.
List defined data labels and their values with pagination.
List exported functions/symbols with pagination.
List all functions in the database.
List imported symbols in the program with pagination.
List all function names in the program with pagination.
List all non-global namespaces in the program with pagination.
List all memory segments in the program with pagination.
List all defined strings in the program with their addresses.
Rename a data label at the specified address.
Rename a function by its current name to a new user-defined name.
Rename a function by its address.
Rename a local variable within a function.
Search for functions whose name contains the given substring.
Set a comment for a given address in the function pseudocode.
Set a comment for a given address in the function disassembly.
Set a function's prototype.
Set a local variable's type.
No error handling guidance. safe_get() and safe_post() return generic error strings ('Error 404: ...', 'Request failed: ...') with no recovery hints. An LLM receiving 'Error 404: Function not found' has no guidance on whether to retry, search for alternatives, or ask the user. No distinction between retryable and fatal errors.
Destructive operations (rename_function, rename_data, rename_variable, set_decompiler_comment, set_function_prototype) lack confirmation or dry-run support. An agent could irreversibly rename a critical function without user approval. No tool annotations (destructiveHint) to signal to the LLM that these operations are irreversible.
Parameter descriptions are minimal or absent. E.g., 'address' parameters appear in 10+ tools but lack format guidance (hex vs decimal? with or without '0x' prefix?). 'name' parameters do not clarify whether they accept partial matches or require exact names. No constraints on string length, character sets, or valid ranges for numeric parameters.