binary-ninja-mcp

List all function names in the program with pagination.

List entry point(s) of the loaded binary.

Retype a variable in a function.

Rename a variable in a function.

Rename multiple local variables in one call. - function_identifier: function name or address (hex) - Provide either mapping_json (JSON object old->new), renames_json (JSON array of {old,new}), or pairs ("old1:new1,old2:new2"). Returns per-item results and totals.

Define types from a C code string.

List all namespace/class names in the program with pagination.

Hexdump data starting at an address. When length < 0, reads the exact defined size if available.

Hexdump a data symbol by name or address. When length < 0, reads the exact defined size if available.

Return a declaration-like string and a hexdump for a data symbol by name or address. LLM-friendly: includes both a C-like declaration (when possible) and text hexdump.

Decompile a specific function by name and return the decompiled C code.

Get IL for a function in the selected view. - view: one of hlil, mlil, llil - ssa: set True to request SSA form (MLIL/LLIL only)

Retrive the disassembled code of a function with a given name as assemby mnemonic instructions.

Get all cross references to a named struct field (member).

Rename a function by its current name to a new user-defined name. The configured prefix (default "mcp_") will be automatically prepended if not present.

Rename a data label at the specified address.

Set a comment at a specific address.

Set a comment for a function.

Get the comment at a specific address.

Get the comment for a function.

List all memory segments in the program with pagination.

List sections in the program with pagination. Returns one line per section with: start-end, size, name, and any semantics/type if available.

List imported symbols in the program with pagination.

List all strings in the database (paginated).

List matching strings in the database (paginated, filtered).

List all local types in the database (paginated).

Search local types whose name or declaration contains the substring.

List all strings in the database (aggregated across pages).

List exported functions/symbols with pagination.

List all non-global namespaces in the program with pagination.

List defined data labels and their values with pagination.

Search for functions whose name contains the given substring.

Get the current status of the loaded binary.

List managed/open binaries known to the server with ids and active flag.

Select which binary to analyze by ordinal, internal view id, full path, or basename. Call this after listing binaries whenever you need to switch analysis targets.

Delete the comment at a specific address.

Delete the comment for a function.

Retrive the name of the function the address belongs to. Address must be in hexadecimal format 0x00001

Retrive definition of a user defined type (struct, enumeration, typedef, union)

Get all cross references (code and data) to the given address. Address can be hex (e.g., 0x401000) or decimal.

Get cross references/usages related to a struct name.

Get xrefs/usages related to a struct or type name. Includes global instances, code refs to those, HLIL matches, and functions whose signature mentions the type.

Get usages/xrefs of an enum by scanning for member values and matches.

Get cross references/usages related to a union type by name.

Get stack frame variable information for a function by name or address. Returns names, offsets, sizes, and types of local variables.

Convert and annotate a value at an address in Binary Ninja. Adds a comment with hex/dec and C literal/string so you can see the change.

Convert a number or string to multiple representations (hex/dec/bin, LE/BE, C char/string literals). Accepts decimal (e.g., 123), hex (0x7b or 7Bh), binary (0b1111011), octal (0o173), char ('A'), or string ("ABC" with escapes like A).

Resolve a type name and return its declaration and details (kind, members, enum values).

List callers and caller sites for one or more function identifiers (name or address). Provide comma-separated identifiers like "sub_401000,main".

List callees and call sites for one or more function identifiers (name or address). Provide comma-separated identifiers like "sub_401000,main".

Set a function's prototype by name or address.

Create a function at the given address. Platform is optional (e.g., "linux-x86_64"). Use "default" to explicitly select the BinaryView/platform default. Returns status and function info; no-op if the function already exists.

List all available platform names from Binary Ninja.

Create or update a local type from a C declaration.

Set a local variable's type.

Patch bytes at a given address in the binary. - address: Address to patch (hex string like "0x401000" or decimal) - data: Hex string of bytes to write (e.g., "90 90" or "9090" or "0x90 0x90") - save_to_file: If True (default), save patched binary to disk and re-sign on macOS. If False, only modify in memory without affecting the original file. Returns status with original and patched bytes. On macOS, automatically re-signs the binary after patching to avoid execution errors.