Loading ToolBench
MCP server for GDA (Ghidra Decompiler Analysis) -sv CLI mode. Provides tools for APK analysis including reconnaissance, malware scanning, code decompilation, and cross-referencing.
GDA-MCP-Server has 29 tools with consistent naming (gda_* prefix) and basic descriptions. However, critical gaps undermine quality: (1) Most parameter descriptions are minimal (1-10 chars) and lack format/constraint details. E.g., 'cidx' param in gda_sclass is described only as 'Class index in hex format' with no validation rules or examples of valid ranges. (2) No output schemas are documented, tools return dict but LLMs cannot infer field structure. (3) Error handling is absent, no guidance on retryability, user-fixable errors, or recovery paths. (4) Many tools lack parameter descriptions entirely (e.g., gda_help, gda_binfo, gda_pname have no params but descriptions don't explain when to call them vs similar tools). (5) Pagination is implemented but inconsistently documented, some tools mention 'Use next_offset to continue' but response structure (total_count, has_more) is not specified. Naming is solid (verb_noun pattern, clear intent), but parameter and output quality are well below production baseline.
List sensitive API methods. Paginated by lines (default 200). Use next_offset to continue.
Strings referenced by methods. Paginated by lines (default 200). Use next_offset to continue.
Attach to an already-running gda.exe -sv (does not spawn a new process).
Attack surface / exported components.
AndroidManifest.xml content.
APK base info: hashes, size, package, DEX stats.
Signing certificate.
No output schemas documented. Tools return dict but LLMs cannot infer field structure, types, or chaining IDs. E.g., gda_find returns results but response format (array vs object, field names, pagination metadata) is undocumented.
Parameter descriptions are minimal or missing. E.g., gda_sclass cidx param: 'Class index in hex format (e.g. 0002d3)' lacks validation rules, min/max length, or error guidance. gda_pclass cidx similarly underdescribed. No format constraints (regex, length) stated.
Pagination inconsistently documented. Tools like gda_appstr, gda_malscan state 'Use next_offset to continue' but response structure (total_count, has_more, next_offset) is not specified. LLMs cannot determine when pagination is exhausted.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 51 | <=2025-11-25 | v2 |
Disassemble a method. e.g. method@0045F0 or -n signature
Decompile class/method. Paginated by lines (default 200). e.g. class@02001e
Search. search_type: class|class_with_package|method|method_with_package|field|api_method|string|all. Paginated by lines (default 200). Use next_offset to continue.
DEX header for the n-th DEX (0-based).
GDA shell help.
List interface classes.
List methods of a class. Paginated by lines (default 200). cname like com.example.MainActivity
Malicious behavior scan. Paginated by lines (default 200). Use next_offset to continue.
List native methods.
Packer / protector detection.
List parent class by class index (hex).
Permission list.
Package name.
Send a raw GDA shell command (advanced). Paginated by lines (default 200).
List subclasses by class index (hex), e.g. 0002d3
Sensitive information (keys, tokens, etc.). Paginated by lines (default 200).
Set GDA output file (set -o).
Start gda.exe -sv with the given APK. Must be called before analysis tools.
Show whether GDA -sv is running and which APK/port.
Stop the GDA -sv process started by this MCP (no-op for attach-only).
URLs / paths / content URIs. Paginated by lines (default 200).
Cross-reference. xref_type: class|method|field|string|resource|all. Paginated by lines.
No error handling guidance. Tools provide no recovery hints, retryability classification, or actionable error messages. E.g., if gda_start_server fails (APK not found, port in use), LLM receives no guidance on next steps.
Many tools lack clear use-case differentiation. E.g., gda_help, gda_binfo, gda_pname, gda_permission, gda_axml, gda_cert, gda_packer all return APK metadata but descriptions don't explain when to call each vs others. LLMs may select wrong tool.