{ "version": "7.0.0", "description": "GhidraMCP REST API Endpoint Specification", "total_endpoints": 209, "categories": { "analysis": "Completeness analysis, control flow, similarity, memory inspection", "comment": "Plate, decompiler, disassembly and repeatable comments", "datatype": "Struct/enum/union CRUD, apply data types, type conflicts, validation", "debugger": "Ghidra TraceRmi debugger control (GUI only)", "documentation": "Function hashing, cross-binary documentation transfer, undocumented discovery", "emulation": "P-code emulation (run functions with controlled inputs)", "function": "Decompile, disassemble, rename, prototype, variables, create/delete functions", "getter": "Current GUI context (address, function, selection)", "headless": "Headless server program management (no GUI required)", "listing": "Enumerate functions, strings, segments, imports, exports, namespaces, classes, data", "malware": "Anti-analysis detection, suspicious instructions, IOC extraction, crypto constants", "program": "Program management, script execution, memory read, bookmarks, save", "project": "Project lifecycle management", "server": "Ghidra Server connection and version control", "symbol": "Create/rename/delete labels, rename data, globals, external locations", "system": "Server-side prompt/automation policy", "utility": "Health checks, schema, version, tool control", "xref": "Cross-references, call graphs, incoming/outgoing calls, data refs" }, "endpoints": [ { "path": "/add_function_tag", "method": "POST", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "tags", "tag_comments", "assignments", "program" ], "servers": [ "gui", "headless" ], "description": "Attach tags to ONE function (function + tags) OR MANY in one transaction (assignments=[{function,tags}, ...]). Tags are comma-separated and created on the fly (give a new tag a description with tag_comments). Replaces batch_add_function_tags and create_function_tag." }, { "path": "/add_memory_reference", "method": "POST", "category": "xref", "params": [ "from_address", "to_address", "ref_type", "source_type", "operand_index", "program" ], "servers": [ "gui", "headless" ], "description": "Create a user-defined cross-reference between two memory addresses that the auto-analyzer can't infer (runtime-populated pointer tables, vtables, late-bound function pointers, missed jump/switch tables). Leaves the underlying bytes untouched while adding proper bidirectional navigation. ref_type accepts any RefType name (DATA, READ, WRITE, COMPUTED_CALL, UNCONDITIONAL_JUMP, ...); source_type defaults to USER_DEFINED so refs are distinct from analyzer output and survive re-analysis. Accepts space-prefixed addresses (mem:1000)." }, { "path": "/add_struct_field", "method": "POST", "category": "datatype", "params": [ "struct_name", "field_name", "field_type", "offset", "program" ], "servers": [ "gui", "headless" ], "description": "Add struct field" }, { "path": "/analysis_status", "method": "GET", "category": "program", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Get auto-analysis status for open programs" }, { "path": "/analyze_api_call_chains", "method": "GET", "category": "malware", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Analyze API call chains" }, { "path": "/analyze_call_graph", "method": "GET", "category": "xref", "params": [ "start_function", "end_function", "analysis_type", "program" ], "servers": [ "gui", "headless" ], "description": "Analyze function call graph patterns" }, { "path": "/analyze_control_flow", "method": "GET", "category": "analysis", "params": [ "function_name", "program" ], "servers": [ "gui", "headless" ], "description": "Analyze control flow" }, { "path": "/analyze_data_region", "method": "POST", "category": "analysis", "params": [ "address", "max_scan_bytes", "include_xref_map", "include_boundary_detection", "program" ], "servers": [ "gui", "headless" ], "description": "Analyze data region" }, { "path": "/analyze_dataflow", "method": "GET", "category": "analysis", "params": [ "address", "variable", "direction", "max_steps", "program" ], "servers": [ "gui", "headless" ], "description": "Trace value propagation through a function (PCode graph, forward/backward)" }, { "path": "/analyze_for_documentation", "method": "GET", "category": "analysis", "params": [ "function", "address", "name", "function_address", "function_name", "program", "variant" ], "servers": [ "gui", "headless" ], "description": "Composite RE documentation analysis (decompile + classify + variables + completeness); decompiled_code is stamped with language_id + variant, and withheld if a supplied variant= contradicts the program" }, { "path": "/analyze_function_complete", "method": "GET", "category": "analysis", "params": [ "function", "name", "address", "function_address", "function_name", "include_xrefs", "include_callees", "include_callers", "include_disasm", "include_variables", "include_completeness", "program", "variant" ], "servers": [ "gui", "headless" ], "description": "Comprehensive single-call function analysis. Accepts function name or address. decompiled_code is stamped with language_id + variant, and withheld if a supplied variant= contradicts the program." }, { "path": "/analyze_function_completeness", "method": "GET", "category": "analysis", "params": [ "function", "address", "name", "function_address", "function_name", "compact", "addresses", "program" ], "servers": [ "gui", "headless" ], "description": "Analyze documentation completeness" }, { "path": "/analyze_global_completeness", "method": "GET", "category": "datatype", "params": [ "address", "compact", "program" ], "servers": [ "gui", "headless" ], "description": "Score a global variable's documentation completeness on a budgeted 0-100 scale — the data-address analog of analyze_function_completeness. Six axes: meaningful name, explanatory plate comment, real type, formatted bytes (core, drive effective_score + DOC_DRAFT) plus enum/equate and struct membership (advanced, forgiven in effective_score). A global with no real type (no defined data, or an undefined* type) is hard-capped at 79 and can never band COMPLETE_80 or above, no matter how good its name and comment are — apply a type with set_global first. Returns raw score, effective_score, COMPLETE_, per-axis breakdown, and which axes are still missing." }, { "path": "/analyze_struct_field_usage", "method": "POST", "category": "datatype", "params": [ "address", "struct_name", "max_functions", "program" ], "servers": [ "gui", "headless" ], "description": "Analyze struct field usage" }, { "path": "/apply_data_classification", "method": "POST", "category": "datatype", "params": [ "address", "classification", "name", "comment", "type_definition", "program" ], "servers": [ "gui", "headless" ], "description": "Apply data classification" }, { "path": "/apply_data_type", "method": "POST", "category": "datatype", "params": [ "address", "type_name", "clear_existing", "program", "strict_mode" ], "servers": [ "gui", "headless" ], "description": "Apply data type" }, { "path": "/apply_documentation", "method": "POST", "category": "analysis", "params": [ "address", "target_address", "entries", "goto", "name", "function_name", "prototype", "calling_convention", "return_type", "params", "parameters", "variable_types", "variable_renames", "plate_comment", "comments", "labels", "tags", "tag_comments", "score", "program" ], "servers": [ "gui", "headless" ], "description": "Apply documentation to ONE function (fields at the top level) OR MANY (entries=[{address, ...}, ...]). Per function, every step is optional and independent and the response reports each one: rename, signature, variable types and renames, comments, labels, then a completeness score. It accepts what get_function_documentation exports (with target_address), so documentation copied between versions applies as it is. The signature is applied before the comments on purpose, because setting a prototype wipes the plate comment." }, { "path": "/archive_ingest_function", "method": "POST", "category": "documentation", "params": [ "function", "address", "name", "function_address", "function_name", "program", "version_override", "dry_run" ], "servers": [ "gui", "headless" ], "description": "Ingest a single function's documentation into the cross-version archive (the doc archive service configured via GHIDRA_MCP_ARCHIVE_URL). Idempotent; field-level merge resolution happens on the archive side. Use archive_ingest_program for bulk." }, { "path": "/archive_ingest_program", "method": "POST", "category": "documentation", "params": [ "program", "version_override", "limit", "skip_default_named", "dry_run" ], "servers": [ "gui", "headless" ], "description": "Bulk-ingest every function in a program into the cross-version documentation archive. Posts each to /v1/doc_archive/upsert. Returns per-binary counts (created / updated / conflicts_enqueued / errors)." }, { "path": "/archive_project", "method": "POST", "category": "project", "params": [ "output_dir", "output_name" ], "servers": [ "gui", "headless" ], "description": "Archive the currently open project to a Ghidra-native .gar file. The result can be restored into any Ghidra GUI via File → Restore Project, or back into a headless instance via /restore_project. Captures the entire project (all programs, folders, settings, version-control metadata) — unlike /export_program which ships a single program as .gzf. Output is written to `output_dir/output_name` (defaults: /data/exports and `.gar`). Refuses to overwrite an existing file, and refuses while an open program has unsaved changes, since the archive would not contain them: save first." }, { "path": "/audit_global", "method": "GET", "category": "datatype", "params": [ "address", "program" ], "servers": [ "gui", "headless" ], "description": "Audit a global variable's documentation state. Returns name, type, length, plate comment, xref count, and list of issues. Use this before set_global so you know exactly what's missing." }, { "path": "/audit_globals_in_function", "method": "GET", "category": "datatype", "params": [ "function", "address", "name", "function_address", "function_name", "program" ], "servers": [ "gui", "headless" ], "description": "Audit every global variable referenced from within a function in one call. Walks the function's instructions, collects unique data references, and returns the per-global audit (same shape as audit_global) plus a summary of how many are fully documented vs have issues. The killer per-function pre-flight tool — start every doc pass with this when the function has global xrefs." }, { "path": "/batch_rename_function_components", "method": "POST", "category": "function", "params": [ "function", "address", "function_address", "function_name", "parameter_renames", "local_renames", "return_type", "program" ], "servers": [ "gui", "headless" ], "description": "Batch rename function components" }, { "path": "/batch_set_comments", "method": "POST", "category": "comment", "params": [ "address", "decompiler_comments", "disassembly_comments", "plate_comment", "program" ], "servers": [ "gui", "headless" ], "description": "Set multiple comments" }, { "path": "/batch_string_anchor_report", "method": "GET", "category": "documentation", "params": [ "pattern", "program" ], "servers": [ "gui", "headless" ], "description": "Report of source file strings and their FUN_* functions" }, { "path": "/bulk_fuzzy_match", "method": "GET", "category": "documentation", "params": [ "source_program", "target_program", "threshold", "offset", "limit", "filter" ], "servers": [ "gui", "headless" ], "description": "Bulk cross-binary function matching" }, { "path": "/can_rename_at_address", "method": "GET", "category": "symbol", "params": [ "address", "program" ], "servers": [ "gui", "headless" ], "description": "Check if address can be renamed" }, { "path": "/check_connection", "method": "GET", "category": "utility", "params": [], "servers": [ "gui", "headless" ], "description": "Liveness probe: {status, server_kind (gui/headless), version, program when one is current}. Cheap and token-less, unlike the fuller /mcp/health; both servers answer it identically." }, { "path": "/checkin_program", "method": "POST", "category": "server", "params": [ "path", "comment", "keep_checked_out", "dry_run" ], "servers": [ "gui", "headless" ], "description": "Check an open program back in to the shared Ghidra Server as a new version" }, { "path": "/clear_flow_and_repair", "method": "POST", "category": "function", "params": [ "start_address", "end_address", "program" ], "servers": [ "gui", "headless" ], "description": "Run Ghidra's GUI 'Clear Flow and Repair' action on a seed range: clears instruction flow reachable from the seed, then repairs function bodies and re-disassembles retained flow (ClearFlowAndRepairCmd with clear_data=false, clear_labels=false, repair=true). Use to rebuild regions whose flow was created under wrong assumptions, e.g. a function truncated while a callee was incorrectly marked non-returning. The command follows control flow BEYOND the seed range; the reported observations are seed-local only and do not describe everything the command changed. The flow traversal is not cancellable — a very large connected flow can hold the write lock until it completes. Ghidra treats a seed with exactly one candidate flow start (an instruction that is neither a function entry nor reached by fallthrough from inside the seed) as the flow being intentionally removed and does not reseed that start during repair; consequently, applying this action to otherwise healthy flow can clear code, matching the GUI action's behavior. The response's seed_range.end_address_exclusive is null when the seed ends at its address space's maximum address, since that boundary has no representable exclusive successor. Results are reachability-dependent and the command is not idempotent: some damaged regions may require more than one application to rebuild, while applying it again to healthy flow can clear code — inspect the before/after observations and resulting disassembly after every call." }, { "path": "/clear_function_comments", "method": "POST", "category": "comment", "params": [ "function", "address", "name", "function_address", "function_name", "clear_plate", "clear_pre", "clear_eol", "program" ], "servers": [ "gui", "headless" ], "description": "Clear all comments for a function" }, { "path": "/clear_instruction_flow_override", "method": "POST", "category": "function", "params": [ "address", "program" ], "servers": [ "gui", "headless" ], "description": "Clear flow override" }, { "path": "/clone_data_type", "method": "POST", "category": "datatype", "params": [ "source_type", "new_name", "program" ], "servers": [ "gui", "headless" ], "description": "Clone data type" }, { "path": "/close_program", "method": "POST", "category": "program", "params": [ "name", "save" ], "servers": [ "gui", "headless" ], "description": "Close an open program by project path or name. Never prompts interactively: unsaved changes are saved first by default (save=true) or silently discarded (save=false) before closing, so this cannot block the caller on a GUI confirmation dialog the way Ghidra's own close normally would." }, { "path": "/close_project", "method": "POST", "category": "headless", "params": [], "servers": [ "headless" ], "description": "Close the currently open project" }, { "path": "/compare_programs_documentation", "method": "GET", "category": "documentation", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Compare documentation across programs" }, { "path": "/configure_analyzer", "method": "POST", "category": "analysis", "params": [ "name", "enabled", "program" ], "servers": [ "gui", "headless" ], "description": "Configure an analysis plugin" }, { "path": "/convert_number", "method": "GET", "category": "listing", "params": [ "text", "size" ], "servers": [ "gui", "headless" ], "description": "Convert number between bases" }, { "path": "/create_data_type_category", "method": "POST", "category": "datatype", "params": [ "category_path", "program" ], "servers": [ "gui", "headless" ], "description": "Create data type category" }, { "path": "/create_derived_type", "method": "POST", "category": "datatype", "params": [ "kind", "base_type", "name", "length", "program" ], "servers": [ "gui", "headless" ], "description": "Create a type built on another: a typedef alias, an array or a pointer. An existing same-named type is replaced." }, { "path": "/create_enum", "method": "POST", "category": "datatype", "params": [ "name", "values", "size", "program" ], "servers": [ "gui", "headless" ], "description": "Create enumeration" }, { "path": "/create_folder", "method": "POST", "category": "project", "params": [ "path" ], "servers": [ "gui", "headless" ], "description": "Create a folder in the project" }, { "path": "/create_function", "method": "POST", "category": "function", "params": [ "address", "name", "disassemble_first", "program" ], "servers": [ "gui", "headless" ], "description": "Create function at address" }, { "path": "/create_function_signature", "method": "POST", "category": "datatype", "params": [ "name", "return_type", "parameters", "program" ], "servers": [ "gui", "headless" ], "description": "Create function signature type" }, { "path": "/create_label", "method": "POST", "category": "symbol", "params": [ "address", "name", "labels", "program" ], "servers": [ "gui", "headless" ], "description": "Create label" }, { "path": "/create_memory_block", "method": "POST", "category": "program", "params": [ "name", "address", "size", "read", "write", "execute", "volatile", "comment", "bytes_hex", "bytes_base64", "initialized", "fill_byte", "overlay", "program" ], "servers": [ "gui", "headless" ], "description": "Create memory block, optionally initialized with byte contents (hex or base64)" }, { "path": "/create_project", "method": "POST", "category": "headless", "params": [ "parentDir", "name" ], "servers": [ "headless" ], "description": "Create a new Ghidra project" }, { "path": "/create_property_map", "method": "POST", "category": "program", "params": [ "name", "type", "program" ], "servers": [ "gui", "headless" ], "description": "Create a user property map to store typed values keyed by address. Types: int, long, string, void (address-presence tag). Use a string map holding JSON to store arbitrary structured per-address data. Call save_program to persist." }, { "path": "/create_struct", "method": "POST", "category": "datatype", "params": [ "name", "fields", "replace_placeholder", "program" ], "servers": [ "gui", "headless" ], "description": "Create structure. Body fields must be a JSON array of objects with name and type, plus optional decimal offset. Example fields: [{\"name\":\"dwId\",\"type\":\"uint\",\"offset\":0},{\"name\":\"pNext\",\"type\":\"void *\",\"offset\":4}]. Type may be any resolvable Ghidra data type or existing struct name." }, { "path": "/create_union", "method": "POST", "category": "datatype", "params": [ "name", "fields", "program" ], "servers": [ "gui", "headless" ], "description": "Create union" }, { "path": "/debugger/dynamic_to_static", "method": "GET", "category": "debugger", "params": [ "address" ], "servers": [ "gui" ], "description": "Translate a runtime dynamic address from the current trace back to a static Ghidra program address" }, { "path": "/debugger/interrupt", "method": "POST", "category": "debugger", "params": [], "servers": [ "gui" ], "description": "Interrupt (break into) the running target" }, { "path": "/debugger/launch", "method": "POST", "category": "debugger", "params": [ "executable_path", "args", "cwd", "timeout_seconds", "program", "offer", "python_executable", "windbg_dir" ], "servers": [ "gui" ], "description": "Launch an executable through Ghidra's Trace RMI debugger launcher" }, { "path": "/debugger/launch_offers", "method": "GET", "category": "debugger", "params": [ "program" ], "servers": [ "gui" ], "description": "List available debugger launch/attach options for the current program" }, { "path": "/debugger/list_breakpoints", "method": "GET", "category": "debugger", "params": [], "servers": [ "gui" ], "description": "List all breakpoints in the current trace" }, { "path": "/debugger/modules", "method": "GET", "category": "debugger", "params": [], "servers": [ "gui" ], "description": "List modules (DLLs/EXEs) loaded in the debugged process" }, { "path": "/debugger/read_memory", "method": "GET", "category": "debugger", "params": [ "address", "size" ], "servers": [ "gui" ], "description": "Read memory from the debugged process. Returns hex dump and DWORD interpretation." }, { "path": "/debugger/registers", "method": "GET", "category": "debugger", "params": [], "servers": [ "gui" ], "description": "Read CPU registers from the current debug trace snapshot. Shows general-purpose registers (EAX-EDI, EIP, ESP, EFLAGS for x86)" }, { "path": "/debugger/remove_breakpoint", "method": "POST", "category": "debugger", "params": [ "address" ], "servers": [ "gui" ], "description": "Remove a breakpoint at an address" }, { "path": "/debugger/resume", "method": "POST", "category": "debugger", "params": [], "servers": [ "gui" ], "description": "Resume execution of the debugged process" }, { "path": "/debugger/set_breakpoint", "method": "POST", "category": "debugger", "params": [ "address" ], "servers": [ "gui" ], "description": "Set a software execution breakpoint at an address in the trace" }, { "path": "/debugger/stack_trace", "method": "GET", "category": "debugger", "params": [ "depth" ], "servers": [ "gui" ], "description": "Get the call stack backtrace for the current thread" }, { "path": "/debugger/static_to_dynamic", "method": "GET", "category": "debugger", "params": [ "address", "program" ], "servers": [ "gui" ], "description": "Translate a static Ghidra program address to a runtime dynamic address in the current trace" }, { "path": "/debugger/status", "method": "GET", "category": "debugger", "params": [], "servers": [ "gui" ], "description": "Get debugger status: active trace, thread, execution state, module count" }, { "path": "/debugger/step", "method": "POST", "category": "debugger", "params": [ "kind" ], "servers": [ "gui" ], "description": "Single-step the debugged process: into the next instruction (follows calls), over it (does not follow calls), or out of the current function (run to return)." }, { "path": "/debugger/traces", "method": "GET", "category": "debugger", "params": [], "servers": [ "gui" ], "description": "List all open debug traces" }, { "path": "/delete_bookmark", "method": "POST", "category": "program", "params": [ "address", "category", "program" ], "servers": [ "gui", "headless" ], "description": "Delete bookmark" }, { "path": "/delete_data_type", "method": "POST", "category": "datatype", "params": [ "type_name", "resolve_demangler_duplicate", "program" ], "servers": [ "gui", "headless" ], "description": "Delete data type" }, { "path": "/delete_file", "method": "POST", "category": "project", "params": [ "filePath" ], "servers": [ "gui", "headless" ], "description": "Delete a file from the project" }, { "path": "/delete_function", "method": "POST", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "program" ], "servers": [ "gui", "headless" ], "description": "Delete function at address" }, { "path": "/delete_function_tag", "method": "POST", "category": "function", "params": [ "name", "program" ], "servers": [ "gui", "headless" ], "description": "Delete a program-wide function tag definition. This detaches the tag from every function that had it." }, { "path": "/delete_label", "method": "POST", "category": "symbol", "params": [ "address", "name", "labels", "program" ], "servers": [ "gui", "headless" ], "description": "Delete label at address" }, { "path": "/delete_project", "method": "POST", "category": "project", "params": [ "projectPath" ], "servers": [ "headless" ], "description": "Delete a Ghidra project" }, { "path": "/delete_property_map", "method": "POST", "category": "program", "params": [ "name", "program" ], "servers": [ "gui", "headless" ], "description": "Delete a user property map and all values it holds. Call save_program to persist." }, { "path": "/detect_array_bounds", "method": "POST", "category": "analysis", "params": [ "address", "max_scan_range", "program" ], "servers": [ "gui", "headless" ], "description": "Detect array bounds" }, { "path": "/detect_crypto_constants", "method": "GET", "category": "malware", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Detect crypto constants" }, { "path": "/detect_malware_behaviors", "method": "GET", "category": "malware", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Detect malware behaviors" }, { "path": "/diff_functions", "method": "GET", "category": "documentation", "params": [ "address_a", "address_b", "program_a", "program_b" ], "servers": [ "gui", "headless" ], "description": "Diff two functions" }, { "path": "/disassemble_bytes", "method": "POST", "category": "function", "params": [ "start_address", "end_address", "length", "restrict_to_execute_memory", "include_instructions", "max_instructions", "program" ], "servers": [ "gui", "headless" ], "description": "Disassemble byte range" }, { "path": "/disassemble_function", "method": "GET", "category": "function", "params": [ "address", "name", "function_address", "function_name", "function", "program" ], "servers": [ "gui", "headless" ], "description": "Disassemble function" }, { "path": "/emulate_function", "method": "POST", "category": "emulation", "params": [ "function", "address", "name", "function_address", "function_name", "registers", "memory", "max_steps", "return_registers", "read_memory_after", "program" ], "servers": [ "gui", "headless" ], "description": "Emulate a single function with controlled register/memory inputs. Returns final register state after execution. Ideal for understanding hash functions, crypto routines, or any pure-computation code path." }, { "path": "/emulate_hash_batch", "method": "POST", "category": "emulation", "params": [ "hash_function_address", "string_register", "result_register", "target_hash", "candidates", "initial_registers", "wide_string", "program" ], "servers": [ "gui", "headless" ], "description": "Brute-force API hash resolution. Emulates a hash function with each candidate API name and returns the one that produces the target hash. Ideal for resolving ROR13, CRC32, djb2, FNV, and custom hash algorithms." }, { "path": "/exit_ghidra", "method": "POST", "category": "program", "params": [], "servers": [ "gui", "headless" ], "description": "Save and exit Ghidra" }, { "path": "/export_program", "method": "POST", "category": "project", "params": [ "program_name", "output_dir", "output_name" ], "servers": [ "gui", "headless" ], "description": "Export an open or project-resident program to a Ghidra Zip File (.gzf). Looks up the program in the open-programs map first (so it works on file-loaded programs without a project), then falls back to the open project's DomainFile." }, { "path": "/extract_iocs_with_context", "method": "GET", "category": "malware", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Extract IOCs with context" }, { "path": "/find_anti_analysis_techniques", "method": "GET", "category": "malware", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Find anti-analysis techniques" }, { "path": "/find_code_gaps", "method": "GET", "category": "analysis", "params": [ "min_size", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Find gaps of undefined bytes between functions in executable memory" }, { "path": "/find_data_types", "method": "GET", "category": "datatype", "params": [ "pattern", "category", "kind", "categories", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Find data types by name or path pattern, category and kind, one record per type (name, kind, category, size, path). With categories=true, list the category paths instead. With no filter it lists every type." }, { "path": "/find_dead_code", "method": "GET", "category": "analysis", "params": [ "function_name", "program" ], "servers": [ "gui", "headless" ], "description": "Find dead code" }, { "path": "/find_functions", "method": "GET", "category": "listing", "params": [ "name_pattern", "pattern", "query", "name", "regex", "min_xrefs", "max_xrefs", "calling_convention", "has_custom_name", "is_thunk", "is_external", "tag", "sort_by", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Find functions: every filter is optional, so with none it lists the whole program a page at a time. Filter by name (substring or regex=true), xref count, calling convention, whether the name is user-given, thunk or external, or by tag (tag=a,b keeps functions carrying ANY of them); each result lists its tags; sort by address, name or xref_count. Replaces list_functions, list_functions_enhanced, search_functions and search_functions_enhanced, which returned four different shapes for the same question." }, { "path": "/find_next_undefined_function", "method": "GET", "category": "analysis", "params": [ "start_address", "criteria", "pattern", "direction", "program" ], "servers": [ "gui", "headless" ], "description": "Find next undefined function" }, { "path": "/find_similar_functions", "method": "GET", "category": "analysis", "params": [ "target_function", "threshold", "program" ], "servers": [ "gui", "headless" ], "description": "Find similar functions" }, { "path": "/find_similar_functions_fuzzy", "method": "GET", "category": "documentation", "params": [ "function", "address", "name", "function_address", "function_name", "source_program", "target_program", "threshold", "limit" ], "servers": [ "gui", "headless" ], "description": "Cross-binary fuzzy function matching. On programs with multiple address spaces (e.g., embedded targets), prefix addresses with the space name (mem:1000) to avoid ambiguous resolution." }, { "path": "/find_undocumented_by_string", "method": "GET", "category": "documentation", "params": [ "address", "program" ], "servers": [ "gui", "headless" ], "description": "Find undocumented functions referencing string" }, { "path": "/force_decompile", "method": "GET", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "program", "variant" ], "servers": [ "gui", "headless" ], "description": "Force fresh decompilation (output stamped with language_id + variant; optional variant= is checked against the loaded one)" }, { "path": "/get_address_spaces", "method": "GET", "category": "program", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "List all physical and overlay address spaces in the program (overlays include is_overlay flag and overlayed_space name)" }, { "path": "/get_assembly_context", "method": "POST", "category": "xref", "params": [ "xref_sources", "context_instructions", "program" ], "servers": [ "gui", "headless" ], "description": "Get assembly context" }, { "path": "/get_comment", "method": "GET", "category": "comment", "params": [ "address", "addresses", "only_with_comments", "program" ], "servers": [ "gui", "headless" ], "description": "Get listing comments (plate/pre/eol/post/repeatable) at ANY address, including data addresses (works on functions and data globals alike), for ONE address (address=) or MANY in one call (addresses=a,b,c). All five kinds are always present in each result: null means the kind was never set, \"\" means it was explicitly cleared. Each result also has a convenience `comment` (first non-empty) and `has_comment` flag. Bulk mode wraps the results with requested / returned / with_comments counts." }, { "path": "/get_entry_points", "method": "GET", "category": "listing", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Get program entry points" }, { "path": "/get_enum_values", "method": "GET", "category": "datatype", "params": [ "enum_name", "program" ], "servers": [ "gui", "headless" ], "description": "Get enumeration values" }, { "path": "/get_external_location", "method": "GET", "category": "listing", "params": [ "address", "dll_name", "program" ], "servers": [ "gui", "headless" ], "description": "Get external location details" }, { "path": "/get_field_access_context", "method": "POST", "category": "analysis", "params": [ "struct_address", "field_offset", "num_examples", "program" ], "servers": [ "gui", "headless" ], "description": "Get field access context" }, { "path": "/get_full_call_graph", "method": "GET", "category": "xref", "params": [ "format", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Get full call graph" }, { "path": "/get_function_call_graph", "method": "GET", "category": "xref", "params": [ "function", "name", "address", "function_name", "function_address", "depth", "direction", "program" ], "servers": [ "gui", "headless" ], "description": "Get call graph" }, { "path": "/get_function_count", "method": "GET", "category": "listing", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Return the number of functions in the loaded program" }, { "path": "/get_function_documentation", "method": "GET", "category": "documentation", "params": [ "function", "address", "name", "function_address", "function_name", "program" ], "servers": [ "gui", "headless" ], "description": "Export function documentation" }, { "path": "/get_function_hash", "method": "GET", "category": "documentation", "params": [ "function", "address", "name", "function_address", "function_name", "offset", "limit", "filter", "program" ], "servers": [ "gui", "headless" ], "description": "Compute the normalized opcode hash of ONE function (function=), or of MANY in one call by omitting it: every function, paged, optionally only the documented or undocumented ones (filter=). On programs with multiple address spaces (e.g., embedded targets), prefix addresses with the space name (mem:1000) to avoid ambiguous resolution." }, { "path": "/get_function_pcode", "method": "GET", "category": "analysis", "params": [ "function", "address", "name", "function_address", "function_name", "granularity", "program" ], "servers": [ "gui", "headless" ], "description": "Dump raw P-code for a function (issue #192). Returns low (basic-iter) and high (HighFunction) P-code with basic blocks and varnodes. Granularity controls output: 'basic' = basic-block iter only (less memory), 'high' = HighFunction graph (default; includes both BB iter and op-iter). For P-code emulators / ML pipelines / alternative decompilers." }, { "path": "/get_functions", "method": "GET", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "functions", "fields", "include_call_context", "call_context_limit", "call_context_lines", "call_context_window", "include_disasm", "program", "variant" ], "servers": [ "gui", "headless" ], "description": "Everything about one or many functions in a single call. Pass functions= as a comma-separated list of names or addresses for bulk mode (up to 20); omit it and pass function=/name=/address= for one. Pass fields= as a comma-separated subset to skip work you do not need — omitted or empty returns everything. When the requested fields need no decompiled text (e.g. fields=callers,callees,signature,labels,entry_point), the target function is NOT decompiled (238 ms cold / 5–10 ms warm per function); only decompiled_code (and call_context when enabled) pays that cost. Decompiled text renders EOL comments (// style), so comments written with set_comment are visible in the code. Replaces get_function_by_address, get_function_variables, get_function_xrefs, decompile_function, and the former get_function_callers/callees/labels/signature tools. Completeness scoring is NOT included — call analyze_function_completeness for that. A bundle carrying decompiled_code or call_context is stamped with language_id + variant (in bulk mode, every entry), and on a processor whose variants load different SLEIGH decoders (PowerPC vs PowerPC VLE) also carries variant_ambiguous + variant_candidates; pass variant= to have that assumption checked: naming a variant the program is not loaded under is refused." }, { "path": "/get_language_metadata", "method": "GET", "category": "program", "params": [ "include_registers", "include_default_symbols", "program" ], "servers": [ "gui", "headless" ], "description": "Dump the program's language description: address spaces, registers, default symbols, endianness, pointer size (issue #192). Use for P-code emulators / ML pipelines that need the SLEIGH-level facts. include_registers/include_default_symbols toggle expensive sections. Also reports the loaded variant, available_variants (each with the SLEIGH decoder it loads) and variant_ambiguous: where the legal variant= values are listed." }, { "path": "/get_metadata", "method": "GET", "category": "program", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Get program metadata" }, { "path": "/get_program_options", "method": "GET", "category": "program", "params": [ "group", "program" ], "servers": [ "gui", "headless" ], "description": "Read all options in a program option group with types, current values, defaults, and descriptions. Omit group to list the option groups instead (e.g. 'Program Information', 'Analyzers', 'Decompiler'), each with its option count." }, { "path": "/get_project_info", "method": "GET", "category": "project", "params": [], "servers": [ "gui", "headless" ], "description": "Get info about the currently open project" }, { "path": "/get_property", "method": "GET", "category": "program", "params": [ "map", "address", "program" ], "servers": [ "gui", "headless" ], "description": "Read the value stored at an address in a property map. Returns has_value=false and a null value when the address holds no property." }, { "path": "/get_struct_layout", "method": "GET", "category": "datatype", "params": [ "struct_name", "program" ], "servers": [ "gui", "headless" ], "description": "Get structure layout" }, { "path": "/get_type_size", "method": "GET", "category": "datatype", "params": [ "type_name", "program" ], "servers": [ "gui", "headless" ], "description": "Get data type size and info" }, { "path": "/get_ui_cursor", "method": "GET", "category": "getter", "params": [ "type" ], "servers": [ "gui", "headless" ], "description": "What the analyst is looking at right now: cursor address, the function under it, the listing selection, and the focused program — one call instead of four. type=address|function|selection|program|all (default all). Takes NO program parameter: the focused program is an answer this reports, not an input. Headless has no analyst and no cursor, so every facet reports null with a reason there — use the program parameter on a data endpoint instead. Replaces get_current_address, get_current_function, get_current_selection and get_current_program_info." }, { "path": "/get_valid_data_types", "method": "GET", "category": "datatype", "params": [ "category", "program" ], "servers": [ "gui", "headless" ], "description": "Get valid data type names" }, { "path": "/get_xrefs_from", "method": "GET", "category": "xref", "params": [ "address", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Get references from address" }, { "path": "/get_xrefs_to", "method": "GET", "category": "xref", "params": [ "address", "addresses", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Get references to address" }, { "path": "/import_data_types", "method": "POST", "category": "datatype", "params": [ "source", "format", "program" ], "servers": [ "gui", "headless" ], "description": "Import data types from GDT" }, { "path": "/import_file", "method": "POST", "category": "program", "params": [ "file_path", "project_folder", "language", "compiler_spec", "auto_analyze" ], "servers": [ "gui", "headless" ], "description": "Import a binary file from disk into the current Ghidra project and open it. For raw firmware binaries, specify language (e.g. 'ARM:LE:32:Cortex') and optionally compiler_spec (e.g. 'default')." }, { "path": "/import_program", "method": "POST", "category": "project", "params": [ "gzf_path", "target_folder", "target_name", "overwrite" ], "servers": [ "gui", "headless" ], "description": "Import a Ghidra Zip File (.gzf) into the currently open project as a new DomainFile under target_folder (default '/'). Refuses to overwrite a program that is currently loaded in memory." }, { "path": "/inspect_memory_content", "method": "GET", "category": "analysis", "params": [ "address", "length", "detect_strings", "program" ], "servers": [ "gui", "headless" ], "description": "Inspect memory bytes" }, { "path": "/list_analyzers", "method": "GET", "category": "analysis", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "List available analysis plugins" }, { "path": "/list_bookmarks", "method": "GET", "category": "program", "params": [ "category", "address", "program" ], "servers": [ "gui", "headless" ], "description": "List bookmarks" }, { "path": "/list_calling_conventions", "method": "GET", "category": "listing", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "List available calling conventions" }, { "path": "/list_class_members", "method": "GET", "category": "function", "params": [ "class_name", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "List the member functions of a C++ class. A function counts as a member if it lives in the class's namespace (e.g. after set_function_this_type re-parents it) OR its implicit 'this' parameter types as ' *'. Each result reports how it matched (namespace / this_type / both). Replaces the manual 'search __thiscall functions then read each signature' workflow." }, { "path": "/list_data_items_by_xrefs", "method": "GET", "category": "listing", "params": [ "offset", "limit", "format", "filter", "type_filter", "min_xrefs", "include_all_sections", "program" ], "servers": [ "gui", "headless" ], "description": "List data sorted by xref count" }, { "path": "/list_function_tags", "method": "GET", "category": "function", "params": [ "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "List all program-wide function tag definitions with their use counts." }, { "path": "/list_globals", "method": "GET", "category": "listing", "params": [ "offset", "limit", "filter", "type_filter", "min_xrefs", "include_all_sections", "name_substring", "program" ], "servers": [ "gui", "headless" ], "description": "List global variables" }, { "path": "/list_open_programs", "method": "GET", "category": "program", "params": [], "servers": [ "gui", "headless" ], "description": "List open programs" }, { "path": "/list_program_items", "method": "GET", "category": "listing", "params": [ "kind", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "List one kind of program inventory with pagination. Replaces list_classes, list_methods, list_namespaces, list_imports, list_exports, list_segments, list_data_items and list_external_locations — one envelope ({kind, items, count, total, limit, offset}), item shape varies by kind: classes|methods|namespaces → string names; imports|exports → {address, name}; segments → {name, start, end, size, readable, writable, executable, initialized}; data_items → {address, block, label, size, type}; external_locations → {name, library, address, original_imported_name?}. Unknown kind is an error listing the valid values." }, { "path": "/list_project_files", "method": "GET", "category": "program", "params": [ "folder" ], "servers": [ "gui", "headless" ], "description": "List project files" }, { "path": "/list_projects", "method": "GET", "category": "project", "params": [ "searchDir" ], "servers": [ "headless" ], "description": "List available Ghidra projects" }, { "path": "/list_properties", "method": "GET", "category": "program", "params": [ "map", "start", "end", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "List (address, value) entries stored in a property map, with pagination. Optionally restrict to an inclusive address range with start/end. Omit map to list the property maps instead: each one's name, value type (int|long|string|object|void) and how many addresses hold a value." }, { "path": "/list_scripts", "method": "GET", "category": "program", "params": [ "filter" ], "servers": [ "gui", "headless" ], "description": "List available Ghidra scripts" }, { "path": "/list_shadowed_globals", "method": "GET", "category": "listing", "params": [ "offset", "limit", "include_all_sections", "program" ], "servers": [ "gui", "headless" ], "description": "List named global DATA symbols that have NO type of their own because a larger data unit starting at an earlier address covers them. These are invisible to /list_globals - it resolves the CONTAINING unit, so it reports the covering neighbour's type at the shadowed address and the global looks perfectly typed. Each record carries the container that swallowed it. Use this to find documentation that a neighbouring type application destroyed, or a symbol sitting inside an array where it does not belong." }, { "path": "/list_strings", "method": "GET", "category": "listing", "params": [ "offset", "limit", "filter", "program" ], "servers": [ "gui", "headless" ], "description": "List defined strings" }, { "path": "/mcp/health", "method": "GET", "category": "utility", "params": [], "servers": [ "gui", "headless" ], "description": "Server health: kind (gui/headless), build, current program, uptime, HTTP pool, memory, endpoint count" }, { "path": "/mcp/schema", "method": "GET", "category": "utility", "params": [], "servers": [ "gui", "headless" ], "description": "Machine-readable API schema with endpoint metadata" }, { "path": "/merge_program_documentation", "method": "POST", "category": "documentation", "params": [ "source", "target", "dry_run" ], "servers": [ "gui", "headless" ], "description": "Bulk merge: copy all RE documentation (function names, signatures, plate comments, instruction comments at EOL/PRE/POST, non-default labels & global symbols) from one program to another at matching addresses. Server-side iteration in a single transaction. Designed for the orphan-rescue workflow: source is typically '_recovered', target is the original '.dll'. Set dry_run=true to count without writing." }, { "path": "/modify_struct_field", "method": "POST", "category": "datatype", "params": [ "struct_name", "field_name", "new_type", "new_name", "program" ], "servers": [ "gui", "headless" ], "description": "Modify a field in a structure: retype it (new_type, which also embeds a struct by value, e.g. Rectangle inside LayoutNode), rename it (new_name), or both. Fields can be identified by name or by offset (for unnamed fields). For layout size changes (grow/shrink padding), use resize_struct instead of manual delete+create." }, { "path": "/move_data_type_to_category", "method": "POST", "category": "datatype", "params": [ "type_name", "category_path", "program" ], "servers": [ "gui", "headless" ], "description": "Move data type to category" }, { "path": "/move_file", "method": "POST", "category": "project", "params": [ "filePath", "destFolder" ], "servers": [ "gui", "headless" ], "description": "Move a program file to a different folder in the project, preserving analysis and documentation. Refuses on unsaved changes; closes, moves and reopens a program that is open but clean." }, { "path": "/move_folder", "method": "POST", "category": "project", "params": [ "sourcePath", "destPath" ], "servers": [ "gui", "headless" ], "description": "Move a project folder and everything under it into another folder. Refuses to move a folder into itself or its own descendant." }, { "path": "/open_program", "method": "POST", "category": "program", "params": [ "path", "auto_analyze" ], "servers": [ "gui", "headless" ], "description": "Open program from project" }, { "path": "/open_project", "method": "POST", "category": "headless", "params": [ "path", "headless", "program" ], "servers": [ "gui", "headless" ], "description": "Open an existing Ghidra project (.gpr file or directory). GUI mode adds optional `headless` (default true) to suppress auto-launching CodeBrowser, and optional `program` to auto-launch CodeBrowser for a specific file when headless=false. Headless server ignores the extra params." }, { "path": "/prompt_policy", "method": "POST", "category": "system", "params": [ "action", "reason", "seconds" ], "servers": [ "gui" ], "description": "Temporarily enable, disable, or query scoped automation prompt handling" }, { "path": "/read_memory", "method": "GET", "category": "program", "params": [ "address", "length", "program" ], "servers": [ "gui", "headless" ], "description": "Read raw memory" }, { "path": "/reanalyze", "method": "POST", "category": "program", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Trigger full auto-analysis on a program" }, { "path": "/recreate_struct", "method": "POST", "category": "datatype", "params": [ "name", "fields", "size", "replace_placeholder", "force", "program" ], "servers": [ "gui", "headless" ], "description": "Replace a structure in one step: optionally remove an existing same-named type, then create with fields JSON (same shape as create_struct). Use when resize_struct cannot apply or you are rebuilding layout from get_struct_layout export. Set force=true to delete a non-stub type that is not referenced." }, { "path": "/remove_function_tag", "method": "POST", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "tags", "assignments", "program" ], "servers": [ "gui", "headless" ], "description": "Detach one or more tags from a function. Does not delete the program-wide tag definition — use delete_function_tag for that." }, { "path": "/remove_program_option", "method": "POST", "category": "program", "params": [ "group", "name", "program" ], "servers": [ "gui", "headless" ], "description": "Remove an option from a program option group. Built-in registered options may be re-created with defaults by Ghidra; primarily for clearing custom options. Call save_program to persist." }, { "path": "/remove_property", "method": "POST", "category": "program", "params": [ "map", "address", "program" ], "servers": [ "gui", "headless" ], "description": "Remove the value stored at a single address in a property map. Call save_program to persist." }, { "path": "/remove_reference", "method": "POST", "category": "xref", "params": [ "from_address", "to_address", "operand_index", "program" ], "servers": [ "gui", "headless" ], "description": "Remove memory cross-reference(s) from one address to another — the inverse of add_memory_reference. Removes every reference from_address -> to_address regardless of operand by default; pass operand_index >= 0 to remove only the reference on that operand. Removes both user-defined and analyzer-inferred references and reports each removed reference's source_type. Accepts space-prefixed addresses (mem:1000)." }, { "path": "/remove_struct_field", "method": "POST", "category": "datatype", "params": [ "struct_name", "field_name", "program" ], "servers": [ "gui", "headless" ], "description": "Remove struct field" }, { "path": "/rename_data_type", "method": "POST", "category": "datatype", "params": [ "old_name", "new_name", "program" ], "servers": [ "gui", "headless" ], "description": "Rename a data type (struct, union, enum, typedef) in place, preserving existing applications of it" }, { "path": "/rename_function", "method": "POST", "category": "function", "params": [ "old_name", "function_address", "function", "oldName", "new_name", "program", "strict_mode" ], "servers": [ "gui", "headless" ], "description": "Rename function by name" }, { "path": "/rename_symbol", "method": "POST", "category": "symbol", "params": [ "target", "address", "function_address", "new_name", "kind", "old_name", "program", "strict_mode" ], "servers": [ "gui", "headless" ], "description": "Rename a symbol of any kind. kind=auto (default): an address target routes to rename-or-create-label (handles data/label/any symbol at the address); a name target routes to a global. Force with kind=data|global|label|external. For kind=label pass old_name (the current label). Replaces rename_data / rename_global_variable / rename_label / rename_or_label / rename_external_location." }, { "path": "/rename_variables", "method": "POST", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "variable_renames", "force_individual", "program" ], "servers": [ "gui", "headless" ], "description": "Batch rename variables" }, { "path": "/resize_struct", "method": "POST", "category": "datatype", "params": [ "name", "new_size", "preserve_fields", "force", "program" ], "servers": [ "gui", "headless" ], "description": "Grow or shrink an existing structure by total byte size. Defined fields whose end offset fits within new_size are preserved; growth pads with undefined filler. Refuses shrink that would clip defined fields unless force=true. See docs/STRUCT_RESIZE_WORKFLOW.md." }, { "path": "/resolve_duplicate_type", "method": "POST", "category": "datatype", "params": [ "type_name", "delete_demangler_stub", "program" ], "servers": [ "gui", "headless" ], "description": "Find duplicate data types by simple name; delete unused /Demangler size-1 stubs when a larger canonical type exists. Helps fix 'Can't resolve datatype' and create_struct already exists on placeholders." }, { "path": "/restore_project", "method": "POST", "category": "project", "params": [ "gar_path", "parent_dir", "project_name" ], "servers": [ "gui", "headless" ], "description": "Restore a Ghidra .gar archive into a fresh on-disk project at `parent_dir/project_name`. The open project is left alone, and the restored one is NOT opened automatically; follow up with /open_project so owner reset and project bookkeeping run via the same code path as a user-driven open. Fails loudly if the destination project already exists." }, { "path": "/run_analysis", "method": "POST", "category": "analysis", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Run auto-analysis on the current program" }, { "path": "/run_ghidra_script", "method": "POST", "category": "program", "params": [ "script_name", "args", "timeout_seconds", "capture_output", "program" ], "servers": [ "gui", "headless" ], "description": "Run script with output capture" }, { "path": "/run_script_inline", "method": "POST", "category": "program", "params": [ "code", "args", "program" ], "servers": [ "gui", "headless" ], "description": "Run inline script code" }, { "path": "/save_all_programs", "method": "GET", "category": "program", "params": [], "servers": [ "gui", "headless" ], "description": "Save all open programs" }, { "path": "/save_program", "method": "GET", "category": "program", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Save current program" }, { "path": "/search_byte_patterns", "method": "GET", "category": "analysis", "params": [ "pattern", "mask", "program" ], "servers": [ "gui", "headless" ], "description": "Search for byte patterns" }, { "path": "/search_instructions", "method": "GET", "category": "analysis", "params": [ "mnemonic", "operand_pattern", "function", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Search for instructions by mnemonic and/or operand substring. Complement to /search_byte_patterns (byte-level); this matches after Ghidra has parsed instructions, so you can search for 'mov' + '[ecx+0xD0]' without knowing the encoding. Case-insensitive substring match on both fields. Returns {address, function, mnemonic, operands, bytes} per match." }, { "path": "/search_strings", "method": "GET", "category": "listing", "params": [ "search_term", "min_length", "encoding", "offset", "limit", "program" ], "servers": [ "gui", "headless" ], "description": "Search defined strings by a regex/substring pattern" }, { "path": "/server/admin/set_permissions", "method": "POST", "category": "server", "params": [ "repo", "user", "access_level" ], "servers": [ "gui", "headless" ], "description": "Set user permissions on a repository" }, { "path": "/server/admin/terminate_all_checkouts", "method": "POST", "category": "server", "params": [ "path" ], "servers": [ "gui", "headless" ], "description": "Terminate all checkouts in a folder recursively" }, { "path": "/server/admin/terminate_checkout", "method": "POST", "category": "server", "params": [ "path", "checkout_id" ], "servers": [ "gui", "headless" ], "description": "Terminate all checkouts on a single file" }, { "path": "/server/admin/users", "method": "GET", "category": "server", "params": [], "servers": [ "gui", "headless" ], "description": "List all users on the server" }, { "path": "/server/authenticate", "method": "POST", "category": "server", "params": [ "username", "password" ], "servers": [ "gui", "headless" ], "description": "Register server credentials for programmatic authentication" }, { "path": "/server/checkouts", "method": "GET", "category": "server", "params": [ "path" ], "servers": [ "gui", "headless" ], "description": "List all checked-out files in a folder, including server-side checkouts" }, { "path": "/server/connect", "method": "POST", "category": "server", "params": [], "servers": [ "gui", "headless" ], "description": "Report/establish the Ghidra server connection. Takes no parameters: GUI mode uses the open project, headless mode uses the GHIDRA_SERVER_HOST and GHIDRA_SERVER_PORT environment variables." }, { "path": "/server/disconnect", "method": "POST", "category": "server", "params": [], "servers": [ "gui", "headless" ], "description": "Disconnect from the Ghidra server" }, { "path": "/server/repositories", "method": "GET", "category": "server", "params": [], "servers": [ "gui", "headless" ], "description": "List repositories on the connected server" }, { "path": "/server/repository/create", "method": "POST", "category": "server", "params": [ "name" ], "servers": [ "gui", "headless" ], "description": "Create a new repository on the server" }, { "path": "/server/repository/file", "method": "GET", "category": "server", "params": [ "repo", "path" ], "servers": [ "gui", "headless" ], "description": "Get file info from a server repository" }, { "path": "/server/repository/files", "method": "GET", "category": "server", "params": [ "repo", "path" ], "servers": [ "gui", "headless" ], "description": "List files in a server repository folder" }, { "path": "/server/status", "method": "GET", "category": "server", "params": [], "servers": [ "gui", "headless" ], "description": "Check headless server connection status" }, { "path": "/server/version_control/add", "method": "POST", "category": "server", "params": [ "path", "comment", "keep_checked_out" ], "servers": [ "gui", "headless" ], "description": "Add a file to version control" }, { "path": "/server/version_control/checkout", "method": "POST", "category": "server", "params": [ "path", "exclusive" ], "servers": [ "gui", "headless" ], "description": "Check out a version-controlled file" }, { "path": "/server/version_control/undo_checkout", "method": "POST", "category": "server", "params": [ "path", "keep" ], "servers": [ "gui", "headless" ], "description": "Undo a file checkout" }, { "path": "/server/version_history", "method": "GET", "category": "server", "params": [ "path" ], "servers": [ "gui", "headless" ], "description": "Get version history for a file" }, { "path": "/set_bookmark", "method": "POST", "category": "program", "params": [ "address", "category", "comment", "program" ], "servers": [ "gui", "headless" ], "description": "Set bookmark" }, { "path": "/set_comment", "method": "POST", "category": "comment", "params": [ "address", "comment", "type", "program" ], "servers": [ "gui", "headless" ], "description": "Set a listing comment of a given kind (plate/pre/eol/post/repeatable) at ANY address, including data addresses. Symmetric writer for get_comment; sets a PLATE comment on a function or a data global alike." }, { "path": "/set_function_no_return", "method": "POST", "category": "function", "params": [ "function_address", "address", "name", "function_name", "function", "no_return", "noReturn", "program" ], "servers": [ "gui", "headless" ], "description": "Set no-return attribute" }, { "path": "/set_function_prototype", "method": "POST", "category": "function", "params": [ "function_address", "address", "name", "function_name", "function", "prototype", "calling_convention", "program" ], "servers": [ "gui", "headless" ], "description": "Set function prototype (return type, param types, calling convention). NOTE: the function name in the prototype string does NOT rename the function — call rename_function separately if needed." }, { "path": "/set_function_tag_comment", "method": "POST", "category": "function", "params": [ "name", "comment", "program" ], "servers": [ "gui", "headless" ], "description": "Update the comment/description on an existing program-wide function tag." }, { "path": "/set_function_this_type", "method": "POST", "category": "function", "params": [ "function_address", "address", "name", "function_name", "function", "this_type", "thisType", "program" ], "servers": [ "gui", "headless" ], "description": "Set the decompiler/database type of the implicit 'this' pointer (ECX on x86 __thiscall/__fastcall). Use after set_function_prototype when decompile still shows void* this or a wrong class. Accepts 'MyClass *' or 'MyClass'. On programs with multiple address spaces, prefix function_address with the space name (mem:1000)." }, { "path": "/set_global", "method": "POST", "category": "datatype", "params": [ "address", "name", "type_name", "array_length", "plate_comment", "program", "strict_mode", "allow_evict" ], "servers": [ "gui", "headless" ], "description": "Atomically apply name + type + plate-comment + array length to a global variable. Single-transaction; rejects on validation failure with no partial write. Replaces the 4-tool chain (apply_data_type → rename_data → batch_set_comments → create_label)." }, { "path": "/set_image_base", "method": "POST", "category": "program", "params": [ "address", "program" ], "servers": [ "gui", "headless" ], "description": "Set the base address of the program (rebases all addresses)" }, { "path": "/set_memory_block", "method": "POST", "category": "program", "params": [ "block", "address", "read", "write", "execute", "volatile", "program" ], "servers": [ "gui", "headless" ], "description": "Change an existing memory block's permissions or volatility. The one that matters most: firmware loaders often mark the flash block writable, and the decompiler then treats every literal-pool load as a variable (iVar2 = DAT_08016e58) instead of folding it into the constant it holds; marking flash read-only lets peripheral and RAM addresses show as constants or their labels." }, { "path": "/set_program_option", "method": "POST", "category": "program", "params": [ "group", "name", "value", "type", "program" ], "servers": [ "gui", "headless" ], "description": "Set a typed program option. If the option already exists its type is reused; otherwise pass type (string|int|long|double|float|boolean). New/custom options are created on demand. Call save_program to persist." }, { "path": "/set_property", "method": "POST", "category": "program", "params": [ "map", "address", "value", "program" ], "servers": [ "gui", "headless" ], "description": "Set a value at an address in a property map. The value is coerced to the map's type (int/long/string); 'void' maps ignore the value and just tag the address. Create the map first with create_property_map. Call save_program to persist." }, { "path": "/set_variable_storage", "method": "POST", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "variable_name", "storage", "program" ], "servers": [ "gui", "headless" ], "description": "Set variable storage" }, { "path": "/set_variable_type", "method": "POST", "category": "function", "params": [ "function_address", "address", "name", "function_name", "function", "variable_name", "parameter_name", "new_type", "program" ], "servers": [ "gui", "headless" ], "description": "Set the data type of a function variable (local OR parameter) by name at the decompiler (high-level) layer. Pass variable_name='this' to type a __thiscall/__fastcall implicit this. Replaces set_local_variable_type / set_parameter_type / set_decompiler_variable_type." }, { "path": "/set_variables", "method": "POST", "category": "function", "params": [ "function", "address", "name", "function_address", "function_name", "variables", "program" ], "servers": [ "gui", "headless" ], "description": "Set types and names for multiple variables atomically. Types are applied first, then renames, in a single transaction. Hungarian prefix validation is enforced: the new name's prefix must match the type. On programs with multiple address spaces, prefix addresses with the space name." }, { "path": "/suggest_field_names", "method": "POST", "category": "datatype", "params": [ "struct_address", "struct_size", "program" ], "servers": [ "gui", "headless" ], "description": "Suggest field names" }, { "path": "/switch_program", "method": "GET", "category": "program", "params": [ "program" ], "servers": [ "gui", "headless" ], "description": "Switch current program" }, { "path": "/tool/goto_address", "method": "POST", "category": "utility", "params": [ "address" ], "servers": [ "gui" ], "description": "Navigate CodeBrowser listing and decompiler to a specific address" }, { "path": "/tool/running_tools", "method": "GET", "category": "utility", "params": [], "servers": [ "gui" ], "description": "List all running Ghidra tool windows" }, { "path": "/validate_data_type", "method": "GET", "category": "datatype", "params": [ "address", "type_name", "program" ], "servers": [ "gui", "headless" ], "description": "Validate data type syntax" }, { "path": "/validate_function_prototype", "method": "GET", "category": "datatype", "params": [ "function", "address", "name", "function_address", "function_name", "prototype", "calling_convention", "program" ], "servers": [ "gui", "headless" ], "description": "Validate function prototype" } ] }