Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions docs/guide/mcp.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,20 @@ The exact tool list may change as the MCP server develops, but both server varia
- **Program structure**: list entry points, segments, sections, symbols, imports, exports, relocations, data variables, and strings.
- **Memory inspection**: read bytes from the active BinaryView and receive the result as hex and base64.
- **Function inspection**: list and search functions, request function metadata, render disassembly, render decompiled Pseudo C, render IL, inspect basic blocks, callers, callees, cross-references, stack layout, and complexity metrics.
- **Binary Similarity (Ultimate, GUI server)**: configure and run comparisons across two or more MCP BinaryView handles, select providers and automatic resolvers, monitor or stop runs, focus reruns on selected functions, identify added and removed functions, review or override matches, render provider-annotated diffs, and port function metadata individually or in batches.

Use your MCP client's tool listing UI or command to see the complete set of tools available in your installed Binary Ninja version.

To run Binary Similarity entirely through MCP, open the related binaries with `bn_open_item_open` and choose their analyzed BinaryView handles. `bn_similarity_component_list` reports the installed provider and resolver names, descriptions, settings schemas, and defaults. Pass two or more handles to `bn_similarity_session_compare` in oldest-to-newest order. By default the tool creates a chain of comparison edges, enables every available provider, starts immediately, and waits for completion. Use the `edges` option for another acyclic graph, `providers` for provider selection, or `start: false` to inspect the configured session before calling `bn_similarity_session_run`.

Comparisons are review-only unless `resolvers` are selected. Adding `Metric Similarity Resolver` makes the run automatically select sufficiently strong matches and ask the provider that produced each selected result to apply it. Configure its `metrics.similarityThreshold` and `metrics.confidenceThreshold` values through `resolverSettings`. Provider-specific values can similarly be supplied through `providerSettings`.

Use `bn_similarity_session_progress` for overall and per-binary, provider, and resolver progress and timing. `bn_similarity_session_stop` requests a cooperative stop; a provider or resolver may take a moment to observe it. Graph and component configuration are fixed while a run is active. Once stopped, `bn_similarity_session_component_configure` can add or remove a component without rebuilding the session, and can update settings for components that support live updates. Changed component settings reschedule the affected work for the next run.

Use `bn_similarity_session_info` to inspect nodes and components, `bn_similarity_function_changes` to list added and removed functions across an edge, `bn_similarity_result_list` to inspect matches and resolver selections, and `bn_similarity_result_diff` to render changed functions. `bn_similarity_entity_schedule` limits the next provider pass to chosen entity IDs or function addresses, which is useful after tuning a matcher or when investigating a small set of functions. The inspection tools also work with the current Binary Similarity tab or sidebar session when no MCP-owned session exists.

MCP-created session nodes keep their BinaryViews loaded so results can be rendered or applied. `bn_similarity_result_resolve` records a reviewed match or clears a resolver's selection without changing analysis. `bn_similarity_result_apply` explicitly ports one provider result's available function names, types, variable information, and comments into the compared binary. `bn_similarity_result_apply_batch` accepts an explicit reviewed result list, or applies the session's currently selected results, and reports each function's outcome. Resolver-based automatic application and explicit application both mutate destination analysis; save its database afterward to persist the changes.

## Tool Calling Conventions

The MCP server exposes Binary Ninja state through a small set of identifiers and conventions. These are worth understanding because they differ from many REST APIs.
Expand Down