Kawaiidra MCP MCP Server: 94 Tools with Risk Policies

// ALL 94 KAWAIIDRA MCP TOOLS

READ 60 tools

Read batch_decompile Decompile multiple functions in a single Ghidra invocation. More efficient than calling get_function_decomp... Read analyze_jni_methods Find JNI methods in Android native libraries. Locates JNI_OnLoad, RegisterNatives calls, and Java_* exporte... Read analyze_mach_ports Analyze Mach port operations, message handlers, and IPC patterns. Read analyze_mach_traps Analyze Mach trap table and system call handlers in XNU kernel. Read analyze_sandbox_ops Analyze sandbox operations, profiles, and policy checks in iOS/macOS binaries. Read bridge_status Get JPype bridge status. Shows if the fast bridge mode is active (100-1000x faster than subprocess) or if f... Read cache_stats Get cache statistics including hit rate, size, and entry count. Use this to monitor cache performance. Read compare_binaries Compare two analyzed binaries to find added, removed, and modified functions. Useful for diffing versions o... Read detect_entitlement_checks Find entitlement validation code and checks in iOS/macOS binaries. Read detect_kpp_ktrr Detect Kernel Patch Protection (KPP) and Kernel Text Read-only Region (KTRR) markers and related code in iO... Read detect_libraries Identify standard libraries, frameworks, and third-party code by analyzing imports and function names. Read detect_vulnerabilities Detect potential security vulnerabilities using pattern analysis. Identifies unsafe functions, buffer issue... Read diff_functions Compare two functions by showing a side-by-side diff of their decompiled code. Functions can be in the same... Read disassemble_bytes Disassemble raw bytes at any address (not function-bound). Useful for examining data regions, padding, or u... Read extract_api_endpoints Extract API endpoints, URLs, hostnames, and paths from binary strings. Useful for finding cloud services an... Read find_crypto_constants Find cryptographic constants like AES S-boxes, CRC tables, and magic numbers. Useful for identifying crypto... Read find_dead_code Find unreachable or orphaned functions — functions with no callers (xrefs to). Helps identify unused code, ... Read find_functions Search for functions by name pattern Read find_hardcoded_secrets Find potential hardcoded secrets: API keys, tokens, passwords, private keys, and credentials in strings. Read find_iokit_classes Find and analyze IOKit class hierarchies, vtables, and user client interfaces. Read find_kernel_symbols Find and analyze kernel symbols, including unexported symbols, for XNU research. Read find_pac_gadgets Find Pointer Authentication Code (PAC) bypass gadgets and signing/auth operations for ARM64e research. Read find_similar_functions Find functions similar to a reference function based on structure, instructions, and patterns. Read get_annotated_disassembly Get richly annotated disassembly with cross-references, comments, and mapped decompiled code lines. Read get_binary_info Get metadata about an analyzed binary (architecture, format, sections) Read get_call_graph Extract call hierarchy showing function relationships. Returns a tree/graph of which functions call which o... Read get_control_flow_graph Extract control flow graph with basic blocks for understanding function logic flow. Read get_current_address Get the current address. In GUI mode, returns the user Read get_current_function Get the current function. In GUI mode, returns the function at user Read get_current_selection Get the current selection range from Ghidra GUI. Only available in GUI mode when connected to a running Ghi... Read get_data_structures Extract struct/class definitions and data type information from the binary. Read get_data_type_details Get detailed information about a specific data type including size, fields, and category. Read get_function_decompile Get decompiled C code for a specific function Read get_function_disassembly Get assembly listing for a specific function Read get_function_hash Get SHA-256 hash of a function Read get_function_metrics Get complexity metrics for a function: cyclomatic complexity, basic block count, instruction count, and siz... Read get_function_signature Get the prototype/signature string of a function (lighter than full decompile). Returns return type, name, ... Read get_function_variables List all variables (parameters, local variables, return type) of a function with their types, storage locat... Read get_function_with_context Extract function decompilation along with all dependencies (called functions, data types, strings) for comp... Read get_function_xrefs Get cross-references to and from a function Read get_memory_map Get memory segments and sections of an analyzed binary Read get_xrefs_from Get all cross-references FROM a specific address (not just functions). Read get_xrefs_to Get all cross-references TO a specific address (not just functions). Read gui_status Get the status of GUI mode connection. Shows whether GUI mode is enabled, if ghidra_bridge is available, an... Read list_analyzed_binaries List all binaries that have been analyzed in a project Read list_bookmarks List all bookmarks, optionally filtered by category. Read list_data_items List defined data labels and their values. Read list_data_types List available data types in the binary. Supports filtering by name substring and category path. Read list_exports List exported functions and symbols from the binary. Read list_functions List all functions in an analyzed binary Read list_imports List imported functions and symbols from external libraries. Read list_labels List labels/symbols with optional name filter and address range. Read list_namespaces List all namespaces and classes in the binary. Read list_strings List all defined strings in a binary Read read_memory Read raw bytes at an address. Returns hex dump with ASCII representation. Read search_bytes Search for a byte pattern in the binary. Supports ?? wildcards for unknown bytes. Example pattern: Read search_strings Search for strings matching a pattern in a binary Read semantic_code_search Search for code by behavior patterns like file I/O, networking, cryptography, string operations, or memory ... Read suggest_symbol_names Suggest better variable and function names based on usage patterns, string references, and API calls. Read generate_report Generate an exhaustive, ground-truth binary analysis report. Extracts all available information in a single...

WRITE 26 tools

Write add_enum_value Add a value to an existing enumeration. Write add_struct_field Add a field to an existing structure. Write apply_data_type Apply a data type at a specific address in the binary. Write batch_rename Rename multiple functions and/or labels in a single Ghidra invocation. Each rename entry specifies old_name... Write batch_set_comments Set comments at multiple addresses in a single Ghidra invocation. Each entry specifies address, comment, an... Write batch_set_types Set types for multiple variables across functions in a single Ghidra invocation. Each entry specifies funct... Write create_enum Create a new enumeration data type with values. Write create_function Create a new function at a specified address. Useful for defining functions that Ghidra Write create_label Create a label/symbol at a specific address. Write create_struct Create a new structure data type with optional initial fields. Write create_typedef Create a typedef alias for an existing data type. Write export_analysis Export analysis results (functions, symbols) to JSON file Write modify_struct_field Modify a field in an existing structure (change name, type, or comment). Write rename_data Rename a data label at a specified address. Write rename_function Rename a function in the binary analysis. Write rename_label Rename an existing label/symbol. Write rename_variable Rename a local variable within a function. Write set_bookmark Create a bookmark at an address with a category and comment. Write set_comment Set a comment at a specified address (EOL, PRE, POST, or PLATE comment). Write set_current_address Set the current address context for subsequent operations. This is useful in headless mode to establish a w... Write set_current_function Set the current function context for subsequent operations. This is useful in headless mode to establish a ... Write set_function_no_return Mark or unmark a function as non-returning (e.g., exit(), abort()). Non-returning functions affect control ... Write set_function_prototype Set a function Write set_local_variable_type Set the type of a local variable within a function. Write set_plate_comment Set a plate (function header) comment for a function. Plate comments appear as a block above the function i... Write set_pre_comment Set a pre-instruction comment at an address. Pre-comments appear on the line(s) before the instruction in t...

DESTRUCTIVE 6 tools

Destructive cache_clear Clear cached analysis results. Can clear all cache or filter by binary/project. Destructive clear_comments Clear all comments (EOL, PRE, POST, PLATE) within a function Destructive delete_data_type Delete a user-defined data type from the binary. Destructive delete_function Delete a function by address or name. Removes the function definition but not the underlying code bytes. Destructive delete_label Delete a label/symbol at a specific address. Destructive remove_struct_field Remove a field from a structure by index.

EXECUTE 2 tools

Execute run_script Execute arbitrary Jython code in the Ghidra scripting environment. Has access to currentProgram, ghidra API... Execute analyze_binary Import and analyze a binary file with Ghidra. Supports PE, ELF, Mach-O, and raw formats.

// FAQ

How many tools does the Kawaiidra MCP MCP server have? +

The Kawaiidra MCP MCP server exposes 94 tools across 4 categories: Read, Write, Destructive, Execute.

How do I enforce policies on Kawaiidra MCP tools? +

Route the Kawaiidra MCP server through the PolicyLayer gateway. Define allow, deny, or approval rules per tool in the dashboard; they are enforced on every call before it reaches the server.

What risk categories do Kawaiidra MCP tools fall into? +

Kawaiidra MCP tools are categorised as Read (60), Write (26), Destructive (6), Execute (2). Each category has a recommended default policy.

Enforce policy on every Kawaiidra MCP tool call.

Start from Kawaiidra MCP, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →

Free to start. No card required.

43,000+ MCP servers and 220,000+ tools scanned and risk-classified.