so_get_entrypoints

What so_get_entrypoints does on SO Analyzer MCP

AI agents call so_get_entrypoints to retrieve information from SO Analyzer MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why so_get_entrypoints is rated Low

This tool performs static analysis and information retrieval on Android native libraries—it reads and reports structural metadata (entry points) from ELF binaries. No code execution, data modification, or irreversible changes occur. While the SO Analyzer server as a whole includes destructive capabilities (patching, binary modification), this specific tool is read-only analysis, making it low severity.

From the tool's definition Tool name 'so_get_entrypoints' and description state it retrieves/identifies entry points in SO files (ELF entry, _init/_fini, constructors/destructors, JNI_OnLoad) without modifying the binary. The verb is 'get' (retrieve) not execute, write, or delete.

The rule that runs so_get_entrypoints safely

PolicyLayer is an MCP gateway: it sits between your AI agents and SO Analyzer MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For so_get_entrypoints, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "so_get_entrypoints": {}
  }
}

Questions about so_get_entrypoints