convert_number
Convert a number or string to multiple representations (hex/dec/bin, C literals).
LABSCO SUMMARY
The naming pass survives the conversation, because it lands in the database rather than the chat log.
Most analysis bridges stop at reading. This one renames functions, variables and data labels, sets comments and prototypes, declares C types and retypes variables, so an hour spent working through a stripped binary leaves the .bndb better than it found it. patch_bytes goes further and writes to the binary itself, with save_to_file deciding whether that reaches disk, so it is worth knowing which binary select_binary has active before you use it.
What it is
A bridge to a running Binary Ninja instance: 54 tools covering the analysis views, the cross-reference graph, the type system and the write-back operations of a reverse-engineering session.
What you get
- The same function in three forms — decompiled C, IL in the hlil, mlil or llil view with optional SSA form, and assembly mnemonics
- Cross references to an address, and also to a named struct field, struct, union, enum or type, which is the lookup a decompiler listing does not give you
- Renames that persist into the database: functions, single variables, batches of local variables in one call, and data labels, plus comments at an address or on a function
- Type recovery — define types from a C string, declare or update a local type, retype a variable, set a function prototype, and resolve a type name to its members and enum values
- The orientation pass on a new sample: entry points, imports, exports, segments, sections, namespaces, paginated or filtered strings, and hexdumps of a data symbol
- Patching: write bytes at an address with the option to save to file, and create a function at an address the analysis missed
- Several open binaries known to one server, selected by ordinal, view id, full path or basename
Requirements
A Binary Ninja installation with the binary loaded — every tool acts on the view that Binary Ninja already has open. No credentials. Licensed GPL-3.0, which constrains how you redistribute anything built on it.
Setup effort
Follow the published steps
USE CASES
01
Working out what an unnamed function actually does
Read the function as decompiled C first, drop to hlil or mlil when the C hides an operation, and check the assembly when the IL hides one too. Three views of one function, without leaving the conversation.
02
Naming a stripped binary as you go
Once a function's purpose is clear, write it down where it lasts: rename the function, rename its locals in one call rather than one at a time, and leave the reasoning as a comment on the function or at the address that prompted it.
03
Tracing every place a struct field is touched
Cross references by address are ordinary; these go further and resolve them for a named struct field, a whole struct, an enum or a union — the question you have when you are trying to work out which code path writes a flag.
04
Recovering the data structures a program uses
Declare the struct you believe you are looking at from a C declaration, retype the variables that hold it, and set the function prototype so the decompiled C starts reading like the original source instead of a wall of casts.
05
Finding where to start on an unfamiliar sample
Entry points, imports and a filtered string list are the standard first ten minutes of triage. Filtering the strings matters here — a large binary's full string table is more than a model can usefully hold.
06
Patching a check and keeping the result
Write bytes at the address you decided on, with save_to_file deciding whether the change reaches disk or stays in the analysis database. Where the analysis missed a function entirely, create one at the address first.
54 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
declare_c_type
Create or update a local type from a C declaration.
decompile_function
Decompile a specific function by name and return the decompiled C code.
define_types
Define types from a C code string.
delete_comment
Delete the comment at a specific address.
delete_function_comment
Delete the comment for a function.
fetch_disassembly
Retrieve the disassembled code of a function as assembly mnemonic instructions.
format_value
Convert and annotate a value at an address in Binary Ninja.
function_at
Retrieve the name of the function the address belongs to.
get_binary_status
Get the current status of the loaded binary.
get_comment
Get the comment at a specific address.
get_data_decl
Return a declaration-like string and hexdump for a data symbol.
get_entry_points
List entry point(s) of the loaded binary.
get_function_comment
Get the comment for a function.
get_il
Get IL for a function in the selected view (hlil, mlil, llil).
get_stack_frame_vars
Get stack frame variable information for a function (names, offsets, sizes, types).
get_type_info
Resolve a type name and return its declaration and details (kind, members, enum values).
get_user_defined_type
Retrieve definition of a user defined type (struct, enumeration, typedef, union).
get_xrefs_to
Get all cross references (code and data) to the given address.
get_xrefs_to_enum
Get usages/xrefs of an enum by scanning for member values and matches.
get_xrefs_to_field
Get all cross references to a named struct field (member).
get_xrefs_to_struct
Get cross references/usages related to a struct name.
get_xrefs_to_type
Get xrefs/usages related to a struct or type name.
get_xrefs_to_union
Get cross references/usages related to a union type by name.
hexdump_address
Hexdump data starting at an address.
hexdump_data
Hexdump a data symbol by name or address.
list_all_strings
List all strings in the database (aggregated across pages).
list_binaries
List managed/open binaries known to the server with ids and active flag.
list_classes
List all namespace/class names in the program with pagination.
list_data_items
List defined data labels and their values with pagination.
list_exports
List exported functions/symbols with pagination.
list_imports
List imported symbols in the program with pagination.
list_local_types
List all local types in the database (paginated).
list_methods
List all function names in the program with pagination.
list_namespaces
List all non-global namespaces in the program with pagination.
list_platforms
List all available platform names from Binary Ninja.
list_sections
List sections in the program with pagination.
list_segments
List all memory segments in the program with pagination.
list_strings
List all strings in the database (paginated).
list_strings_filter
List matching strings in the database (paginated, filtered).
make_function_at
Create a function at the given address.
patch_bytes
Patch bytes at a given address in the binary.
rename_data
Rename a data label at the specified address.
rename_function
Rename a function by its current name. The configured prefix will be automatically prepended if not present.
rename_multi_variables
Rename multiple local variables in one call.
rename_single_variable
Rename a variable in a function.
retype_variable
Retype a variable in a function.
search_functions_by_name
Search for functions whose name contains the given substring.
search_types
Search local types whose name or declaration contains the substring.
select_binary
Select which binary to analyze by ordinal, internal view id, full path, or basename.
set_comment
Set a comment at a specific address.
set_function_comment
Set a comment for a function.
set_function_prototype
Set a function's prototype by name or address.
set_local_variable_type
Set a local variable's type.
BEFORE YOU INSTALL
What to know first
Tools you get
54 tools when we connected. get_callers and get_callees are documented but not exposed by the npm bridge; list_sections and convert_number are exposed but missing from the documented table.
Requires
- Binary Ninja, with this project's plugin installed and its MCP server started
- Python 3.12+
- npx on PATH
Where it runs
All 7 documented clients run the server on your machine.
CONTEXT COST
Moderate Standing cost
Rated by the size of the 54 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
Setup
Install the Binary Ninja MCP plugin from Binary Ninja's Plugin Manager (Plugins > Manage Plugins), or copy this repository into the Binary Ninja plugins folder
Open Binary Ninja, load a binary, and click the button at the bottom-left corner to start the MCP server the client configurations connect to on localhost:9009
npx
TERMINAL
npx -y binary-ninja-mcpMCP Clients
Cline, Roo Code, Claude Desktop, Cursor, Windsurf, Claude Code, LM Studio
JSON
{
"mcpServers": {
"binary-ninja-mcp": {
"command": "npx",
"args": [
"-y",
"binary-ninja-mcp",
"--host",
"localhost",
"--port",
"9009"
]
}
}
}
