Loading ToolBench
MCP server that integrates with x64dbg debugger, providing tools for debugging, memory inspection, breakpoint management, and process control via HTTP/SSE transport
Server has 30 well-organized tools with explicit schemas and descriptions. Naming follows verb_noun convention (GetDebugState, LoadBinary, ReadMemory). Descriptions are present and contextual (avg ~120 chars), exceeding the 10-char minimum but below the 50-200 char LLM-optimized range. All tools have input schemas with type definitions. However, parameter descriptions are minimal (often 1-2 phrases), and output schemas are not documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. Security concerns: WriteMemToAddress and StopDebug are destructive but lack confirmation patterns. No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels in metadata.
Attaches the debugger to a running process by PID.
Clears the event log ring buffer.
Adds a comment or a label at a specific address in the disassembly.
Removes a breakpoint at an address or API symbol.
Disassembles instructions at an address. Returns instruction mnemonics with addresses. Default: 10 instructions from current IP.
Echoes the input back to the client.
Evaluates an x64dbg expression (address, register, arithmetic, symbol) and returns the result in hex and decimal.
Output schemas not documented. LLMs cannot plan downstream calls or extract required fields. No documentation of what fields each tool returns.
Destructive tools (WriteMemToAddress, StopDebug, DeleteBreakpoint) lack confirmation or dry-run patterns. No recovery guidance if agent makes mistakes.
No error handling or recovery guidance. Tools return success/failure but do not guide LLM on retry strategy, user-fixable issues, or next steps.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | <=2025-11-25 | v2 |
Executes an arbitrary x64dbg command string. Example: ExecuteDebuggerCommand command=run
Returns the current values of all general-purpose registers. Takes no arguments.
Returns the current thread's call stack. Takes no arguments.
Returns the current instruction pointer (EIP/RIP), the module it belongs to, and its label/comment. Takes no arguments.
Returns the current debugger state: whether a binary is loaded, whether it is running or paused, the PID, current instruction pointer, and current module. Always available. Takes no arguments.
Returns the last N debugger events (exceptions, breakpoints, DLL loads, thread events, etc.). Keeps the last 64 events in a ring buffer. Use this to see what happened in x64dbg.
Returns the memory map showing all memory regions with base address, size, protection flags, and type.
Lists all active breakpoints (software, hardware, and memory).
Lists the available MCP tools, optionally filtered to a single category.
Lists all loaded modules (DLLs/EXE) with base addresses and sizes.
Loads an executable into the debugger for a new debugging session. Equivalent to File > Open in the GUI. If a session is already active it is terminated first. The debuggee pauses at the system breakpoint.
Pauses (suspends) the running debuggee, equivalent to Debug > Pause (F12). Takes no arguments.
Reads raw bytes from the target process memory and returns a hex dump with ASCII. Example: ReadMemory address=0x7FF600001000, size=128
Restarts the current debugging session from the beginning. Takes no arguments.
Searches process memory for a specific text string and returns the addresses where it occurs.
Sets a software execution breakpoint (INT3) at an address or API symbol.
Executes a single instruction, stepping INTO any call encountered (F7). Takes no arguments.
Runs until the current function returns to its caller (Ctrl+F9). Takes no arguments.
Executes a single instruction, stepping OVER any call/subroutine entirely (F8). Takes no arguments.
Terminates the current debugging session and closes the debuggee process. Takes no arguments.
Blocks until the debuggee stops running (hits a breakpoint, exception, or exits). Returns the reason for the pause and the current address. Use after 'run' to wait for the target to break.
Patches memory by writing raw hex bytes to an address. WARNING: this modifies the live process. Example: WriteMemToAddress address=0x12345678, byteString=0F FF 90
Resumes execution of the debugged process (equivalent to F9 / 'run'). Returns whether the process is now running or has paused at a breakpoint. Takes no arguments.
Tool name 'run' violates verb_noun convention and is ambiguous. Should be 'RunDebugger' or 'ResumeExecution' to clarify intent.
Parameter descriptions are minimal (1-2 phrases). Missing format constraints, ranges, and dependency hints. E.g., 'address' param lacks format (hex vs decimal), 'size' lacks bounds (1-4096?).