Binary MCP Server (Sarks0/binary-mcp) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 279 tools. No publisher has claimed this listing.

Caution

56/100

Binary MCP Server

Item: Binary MCP Server
Rating: 56
Author: M8ven

Enables AI assistants to analyze binaries, debug processes, and inspect kernel state using Ghidra, x64dbg, WinDbg, and ILSpyCmd.

→ Sarks0/binary-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

Sarks0

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: OBSIDIAN_AUTH_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes279 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

analyze_binary

Analyze a binary file with Ghidra headless analyzer.

load_pdb

Apply a Windows PDB to an analyzed binary.

clean_cache

Drop cached analysis artifacts from the cache directory.

get_functions

List all identified functions in the binary.

get_imports

Extract imported functions and libraries.

get_strings

Extract all strings from the binary with cross-references.

get_xrefs

Get cross-references for a function or arbitrary address.

decompile_function

Decompile a function to C-like pseudocode.

expand_callgraph

BFS the callee graph from a starting function and decompile what's missing.

get_call_graph

Generate function call graph.

find_api_calls

Find Windows API calls categorized by behavior.

get_memory_map

Extract memory layout and sections with entropy analysis.

extract_metadata

Get binary metadata and headers (PE/ELF/Mach-O).

search_bytes

Search for a byte/instruction pattern in the binary.

detect_crypto

Identify cryptographic constants and algorithms.

generate_iocs

Generate indicators of compromise (IOCs) from analysis.

diagnose_setup

Run diagnostic checks on Ghidra installation and environment.

check_binary

Check binary compatibility BEFORE running Ghidra analysis.

list_data_types

List data types (structures and enums) found in the binary.

rename_function

Rename a function in the analysis cache.

add_note

Attach a free-text annotation to a function or specific instruction.

get_notes

List user-supplied annotations for a binary.

delete_note

Remove a user-supplied annotation.

start_analysis_session

Start a new analysis session to track all tool outputs.

save_session

Save the current analysis session to disk.

list_sessions

List all saved analysis sessions.

get_session_summary

Get a lightweight summary of a session without loading full data.

load_session_section

Load a specific section of session data (chunked retrieval).

load_full_session

Load ALL data from a session (WARNING: may be very large).

delete_session

Delete a saved session.

find_related_sessions

Find all sessions related to a specific binary.

configure_auto_session

Enable or disable automatic session management.

get_active_session

Get information about the currently active session.

detect_crypto_patterns

Detect encryption and encoding patterns in a binary file.

analyze_xor_encryption

Analyze potential XOR encryption and find likely keys.

decrypt_xor

Decrypt a file using XOR with the specified key.

decode_base64_file

Decode a Base64 encoded file.

detect_python_packer

Detect if a binary is packed with a Python packer.

extract_python_packed

Extract files from a Python packed executable.

analyze_pyc_file

Analyze a .pyc (compiled Python bytecode) file.

list_python_archive_contents

List contents of a Python packed archive.

analyze_control_flow

Build and analyze the control flow graph (CFG) of a function.

detect_loops

Detect natural loops in a function's control flow graph.

find_dead_code

Find potentially dead or unreferenced code in the binary.

get_function_complexity

Compute comprehensive complexity metrics for a single function.

diff_binaries

Diff two analyzed binaries and rank likely security fixes.

find_ioctl_handlers

Recover the IOCTL dispatch map for a kernel driver / opcode router.

analyze_dotnet

Analyze a .NET assembly and list all types.

get_dotnet_types

List types in a .NET assembly with optional filtering.

decompile_dotnet_type

Decompile a specific .NET type to C# source code.

search_dotnet_types

Search for types matching a pattern in a .NET assembly.

decompile_dotnet_assembly

Decompile entire .NET assembly to C# source files.

get_dotnet_il

Get IL (Intermediate Language) disassembly of a .NET assembly or type.

diagnose_dotnet_setup

Check .NET analysis tools installation status.

x64dbg_status

Get x64dbg debugger status.

x64dbg_connect

Connect to x64dbg debugger.

x64dbg_attach

Attach x64dbg to a running process.

x64dbg_detach

Detach from the current process without terminating it.

x64dbg_create_minidump

Create a minidump of the debuggee process.

x64dbg_run

Start or resume execution in x64dbg.

x64dbg_wait_paused

Wait until debugger is paused (breakpoint hit, exception, etc.).

x64dbg_wait_running

Wait until debugger is running.

x64dbg_wait_debugging

Wait until debugging has started (binary is loaded).

x64dbg_run_and_wait

Run execution and wait until it pauses (breakpoint, exception, etc.).

x64dbg_pause

Pause execution in x64dbg.

x64dbg_step_into

Step into next instruction(s).

x64dbg_step_over

Step over next instruction(s).

x64dbg_get_registers

Get current CPU register values.

x64dbg_set_breakpoint

Set breakpoint at address.

x64dbg_delete_breakpoint

Delete breakpoint at address.

x64dbg_set_breakpoints

Set multiple breakpoints in a single call.

x64dbg_delete_breakpoints

Delete multiple breakpoints in a single call.

x64dbg_list_breakpoints

List all breakpoints.

x64dbg_set_exception_breakpoint

Set breakpoint on an exception code.

x64dbg_delete_exception_breakpoint

Delete an exception breakpoint.

x64dbg_list_exception_breakpoints

List all exception breakpoints.

x64dbg_skip_exception

Add exception to ignore list so debugger passes it to the application.

x64dbg_read_memory

Read memory from debugged process.

x64dbg_disassemble

Disassemble instructions at address.

x64dbg_trace_execution

Trace execution for N steps.

x64dbg_trace_api_calls

Trace specific API calls with parameter capture.

x64dbg_start_trace

Start recording an instruction execution trace.

x64dbg_stop_trace

Stop recording the instruction execution trace.

x64dbg_get_trace

Get recorded trace data formatted as a listing.

x64dbg_clear_trace

Clear trace data from memory.

x64dbg_get_api_params

Get parameters for current API call based on calling convention.

x64dbg_run_to_address

Run until reaching specified address.

x64dbg_step_out

Step out of current function.

x64dbg_get_stack

Get call stack trace.

x64dbg_get_modules

x64dbg_get_threads

Get list of process threads.

x64dbg_switch_thread

Switch active thread in the debugger.

x64dbg_suspend_thread

Suspend a thread in the debugged process.

x64dbg_resume_thread

Resume a suspended thread in the debugged process.

x64dbg_suspend_all_threads

Suspend all threads in the debugged process.

x64dbg_resume_all_threads

Resume all threads in the debugged process.

x64dbg_write_memory

Write bytes to process memory.

x64dbg_dump_memory

Dump memory region to file.

x64dbg_search_memory

Search memory for byte pattern.

x64dbg_find_assembly

Search for assembly instruction patterns in memory.

179 further tools are not listed here. The complete surface is in the source.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configGHIDRA_HOME"env": {"": "/path/to/ghidra"}

configDOTNET_ROOT

configKDNET_TIMEOUT

configWINDBG_DEBUG

configWINDBG_PATHWinDbg/CDB installation path Auto-detected

configProgramFiles

configBINARY_MCP_SYMBOL_OFFLINE

configBINARY_MCP_ALLOW_HTTP_SYMBOLS

🔐 secretOBSIDIAN_AUTH_TOKEN

configPROGRAMFILES

configXDG_CONFIG_HOME

configGHIDRA_MAX_HEAP_MB

configGHIDRA_FUNCTION_TIMEOUT

configGHIDRA_MAX_FUNCTIONS

configGHIDRA_SKIP_DECOMPILE

configGHIDRA_ANALYSIS_BUDGET

configGHIDRA_RESUME_MANIFEST

configGHIDRA_RESUME_CACHE

configGHIDRA_START_ADDRESS

configGHIDRA_END_ADDRESS

configGHIDRA_ENABLE_FID

configGHIDRA_CONTEXT_JSON

configX64DBG_HOST

configX64DBG_PORT

configX64DBG_TIMEOUT

configWINDBG_TIMEOUT

configBINARY_MCP_CARVE_DIR

configXDG_CACHE_HOME

configBINARY_MCP_SYMBOL_CACHE

configBINARY_MCP_SYMBOL_PATH

config_NT_SYMBOL_PATH

configBINARY_MCP_ALLOWED_DIRS

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

279/279 tools missing one or more hints — analyze_binary (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); load_pdb (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); clean_cache (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +276 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — x64dbg_delete_debug_state deletes at line 6874 (state_file.unlink())

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Tool inputs are validated

229/279 tool handlers declare input schemas (82%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

277/279 tool handlers wrap calls in try/catch (99%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/sarks0/binary-mcp?variant=verified)](https://m8ven.ai/mcp/sarks0/binary-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: cbcab21d34dcbc9d4731457926e258f265129d54

code hash: 3db64b91461dcc7ff9200081a16bbfb68f4e01b80789d6668daabab616db1071

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client