{ "version": "7.0.0", "description": "GhidraMCP REST API Endpoint Specification", "total_endpoints": 253, "categories": { "listing": "List program data", "getter": "Get specific data", "rename": "Rename symbols", "search": "Search functionality", "decompile": "Decompilation/disassembly", "comment": "Set comments", "xref": "Cross-references", "datatype": "Data type operations", "analysis": "Analysis tools", "program": "Program management", "project": "Project lifecycle management", "server": "Server connection and version control", "script": "Script execution", "utility": "Utility endpoints", "emulation": "P-code emulation (run functions with controlled inputs)" }, "endpoints": [ { "path": "/add_function_tag", "method": "POST", "category": "function", "params": [ "function", "tags", "assignments", "program" ], "description": "Attach one or more tags to a function. Tags are comma-separated and will be auto-created if they do not already exist." }, { "path": "/add_memory_reference", "method": "POST", "category": "xref", "params": [ "from_address", "to_address", "ref_type", "source_type", "operand_index", "program" ], "description": "Create a user-defined cross-reference between two memory addresses that the auto-analyzer can't infer (runtime-populated pointer tables, vtables, late-bound function pointers, missed jump/switch tables). Leaves the underlying bytes untouched while adding proper bidirectional navigation. ref_type accepts any RefType name (DATA, READ, WRITE, COMPUTED_CALL, UNCONDITIONAL_JUMP, ...); source_type defaults to USER_DEFINED so refs are distinct from analyzer output and survive re-analysis. Accepts space-prefixed addresses (mem:1000)." }, { "path": "/add_struct_field", "method": "POST", "category": "datatype", "params": [ "struct_name", "field_name", "field_type", "offset", "program" ], "description": "Add struct field" }, { "path": "/analysis_status", "method": "GET", "category": "program", "params": [ "program" ], "description": "Get auto-analysis status for open programs" }, { "path": "/analyze_api_call_chains", "method": "GET", "category": "analysis", "params": [ "program" ], "description": "Analyze API call chains" }, { "path": "/analyze_call_graph", "method": "GET", "category": "analysis", "params": [ "start_function", "end_function", "analysis_type", "program" ], "description": "Analyze function call graph patterns" }, { "path": "/analyze_control_flow", "method": "GET", "category": "analysis", "params": [ "function_name", "program" ], "description": "Analyze control flow" }, { "path": "/analyze_data_region", "method": "POST", "category": "analysis", "params": [ "address", "max_scan_bytes", "include_xref_map", "include_assembly_patterns", "include_boundary_detection", "program" ], "description": "Analyze data region" }, { "path": "/analyze_dataflow", "method": "GET", "category": "analysis", "params": [ "address", "variable", "direction", "max_steps", "program" ], "description": "Trace value propagation through a function (PCode graph, forward/backward)" }, { "path": "/analyze_for_documentation", "method": "GET", "category": "analysis", "params": [ "function_address", "program" ], "description": "Composite RE documentation analysis (decompile + classify + variables + completeness)" }, { "path": "/analyze_function_complete", "method": "GET", "category": "analysis", "params": [ "name", "include_xrefs", "include_callees", "include_callers", "include_disasm", "include_variables", "include_completeness", "program" ], "description": "Comprehensive single-call function analysis. Accepts function name or address." }, { "path": "/analyze_function_completeness", "method": "GET", "category": "analysis", "params": [ "function_address", "compact", "addresses", "program" ], "description": "Analyze documentation completeness" }, { "path": "/analyze_global_completeness", "method": "GET", "category": "datatype", "params": [ "address", "compact", "program" ], "description": "Score a global variable's documentation completeness on a budgeted 0-100 scale — the data-address analog of analyze_function_completeness. Six axes: meaningful name, explanatory plate comment, real type, formatted bytes (core, drive effective_score + DOC_DRAFT) plus enum/equate and struct membership (advanced, forgiven in effective_score). A global with no real type (no defined data, or an undefined* type) is hard-capped at 79 and can never band COMPLETE_80 or above, no matter how good its name and comment are — apply a type with set_global first. Returns raw score, effective_score, COMPLETE_, per-axis breakdown, and which axes are still missing." }, { "path": "/analyze_struct_field_usage", "method": "POST", "category": "analysis", "params": [ "address", "struct_name", "max_functions", "program" ], "description": "Analyze struct field usage" }, { "path": "/apply_data_classification", "method": "POST", "category": "analysis", "params": [ "address", "classification", "name", "comment", "type_definition", "program" ], "description": "Apply data classification" }, { "path": "/apply_data_type", "method": "POST", "category": "datatype", "params": [ "address", "type_name", "clear_existing", "program", "strict_mode" ], "description": "Apply data type" }, { "path": "/apply_function_documentation", "method": "POST", "category": "utility", "params": [ "json_body", "program" ], "description": "Apply function documentation" }, { "path": "/archive_ingest_function", "method": "POST", "category": "documentation", "params": [ "address", "program", "version_override", "dry_run" ], "description": "Ingest a single function's documentation into the cross-version archive (re_kb.functions on bsim Postgres). Idempotent; field-level merge resolution happens on the archive side. Use archive_ingest_program for bulk." }, { "path": "/archive_ingest_program", "method": "POST", "category": "documentation", "params": [ "program", "version_override", "limit", "skip_default_named", "dry_run" ], "description": "Bulk-ingest every function in a program into the cross-version documentation archive. Posts each to /v1/doc_archive/upsert. Returns per-binary counts (created / updated / conflicts_enqueued / errors)." }, { "path": "/archive_project", "method": "POST", "category": "headless", "params": [ "output_dir", "output_name" ], "description": "Archive the currently open project to a Ghidra-native .gar file. The result can be restored into any Ghidra GUI via File → Restore Project, or back into a headless instance via /restore_project. Captures the entire project (all programs, folders, settings, version-control metadata) — unlike /export_program which ships a single program as .gzf. Output is written to `output_dir/output_name` (defaults: /data/exports and `.gar`). Refuses to overwrite an existing file. Callers should /save_all_programs first to flush pending in-memory edits." }, { "path": "/audit_global", "method": "GET", "category": "datatype", "params": [ "address", "program" ], "description": "Audit a global variable's documentation state. Returns name, type, length, plate comment, xref count, and list of issues. Use this before set_global so you know exactly what's missing." }, { "path": "/audit_globals_in_function", "method": "GET", "category": "datatype", "params": [ "address", "program" ], "description": "Audit every global variable referenced from within a function in one call. Walks the function's instructions, collects unique data references, and returns the per-global audit (same shape as audit_global) plus a summary of how many are fully documented vs have issues. The killer per-function pre-flight tool — start every doc pass with this when the function has global xrefs." }, { "path": "/batch_apply_documentation", "method": "POST", "category": "analysis", "params": [ "address", "name", "prototype", "calling_convention", "variable_types", "variable_renames", "plate_comment", "decompiler_comments", "disassembly_comments", "goto", "score", "program" ], "description": "Apply all documentation to a function in one call" }, { "path": "/batch_get_comments", "method": "GET", "category": "comment", "params": [ "addresses", "only_with_comments", "program" ], "description": "Get listing comments (plate/pre/eol/post/repeatable) at MANY addresses in one call. Same per-address shape as get_comment. Pass only_with_comments=true to omit addresses with no comment at all -- the common case for corpus-wide sweeps, where most functions are undocumented and only the documented subset is interesting. On programs with multiple address spaces (e.g., embedded targets), prefix addresses with the space name (mem:1000) to avoid ambiguous resolution." }, { "path": "/batch_rename_function_components", "method": "POST", "category": "rename", "params": [ "function_address", "function_name", "parameter_renames", "local_renames", "return_type", "program" ], "description": "Batch rename function components" }, { "path": "/batch_set_comments", "method": "POST", "category": "comment", "params": [ "address", "decompiler_comments", "disassembly_comments", "plate_comment", "program" ], "description": "Set multiple comments" }, { "path": "/batch_string_anchor_report", "method": "GET", "category": "documentation", "params": [ "pattern", "program" ], "description": "Report of source file strings and their FUN_* functions" }, { "path": "/bulk_fuzzy_match", "method": "GET", "category": "documentation", "params": [ "source_program", "target_program", "threshold", "offset", "limit", "filter" ], "description": "Bulk cross-binary function matching" }, { "path": "/can_rename_at_address", "method": "GET", "category": "analysis", "params": [ "address", "program" ], "description": "Check if address can be renamed" }, { "path": "/check_connection", "method": "GET", "category": "utility", "params": [], "description": "Health check endpoint" }, { "path": "/checkin_program", "method": "POST", "category": "headless", "params": [ "path", "comment", "keep_checked_out" ], "description": "Check an open program back in to the shared Ghidra Server as a new version" }, { "path": "/clear_flow_and_repair", "method": "POST", "category": "function", "params": [ "start_address", "end_address", "program" ], "description": "Run Ghidra's GUI 'Clear Flow and Repair' action on a seed range: clears instruction flow reachable from the seed, then repairs function bodies and re-disassembles retained flow (ClearFlowAndRepairCmd with clear_data=false, clear_labels=false, repair=true). Use to rebuild regions whose flow was created under wrong assumptions, e.g. a function truncated while a callee was incorrectly marked non-returning. The command follows control flow BEYOND the seed range; the reported observations are seed-local only and do not describe everything the command changed. The flow traversal is not cancellable — a very large connected flow can hold the write lock (GUI: the Swing thread) until it completes. Ghidra treats a seed with exactly one candidate flow start (an instruction that is neither a function entry nor reached by fallthrough from inside the seed) as the flow being intentionally removed and does not reseed that start during repair; consequently, applying this action to otherwise healthy flow can clear code, matching the GUI action's behavior. The response's seed_range.end_address_exclusive is null when the seed ends at its address space's maximum address, since that boundary has no representable exclusive successor. Results are reachability-dependent and the command is not idempotent: some damaged regions may require more than one application to rebuild, while applying it again to healthy flow can clear code — inspect the before/after observations and resulting disassembly after every call." }, { "path": "/clear_function_comments", "method": "POST", "category": "comment", "params": [ "address", "clear_plate", "clear_pre", "clear_eol", "program" ], "description": "Clear all comments for a function" }, { "path": "/clear_instruction_flow_override", "method": "POST", "category": "analysis", "params": [ "address", "program" ], "description": "Clear flow override" }, { "path": "/clone_data_type", "method": "POST", "category": "datatype", "params": [ "source_type", "new_name", "program" ], "description": "Clone data type" }, { "path": "/close_program", "method": "POST", "category": "program", "params": [ "name", "save" ], "description": "Close an open program by project path or name. Never prompts interactively: unsaved changes are saved first by default (save=true) or silently discarded (save=false) before closing, so this cannot block the caller on a GUI confirmation dialog the way Ghidra's own close normally would." }, { "path": "/close_project", "method": "POST", "category": "headless", "params": [], "description": "Close the currently open project" }, { "path": "/compare_programs_documentation", "method": "GET", "category": "utility", "params": [ "program" ], "description": "Compare documentation across programs" }, { "path": "/configure_analyzer", "method": "POST", "category": "analysis", "params": [ "name", "enabled", "program" ], "description": "Configure an analysis plugin" }, { "path": "/convert_number", "method": "GET", "category": "utility", "params": [ "text", "size" ], "description": "Convert number between bases" }, { "path": "/create_array_type", "method": "POST", "category": "datatype", "params": [ "base_type", "length", "name", "program" ], "description": "Create array type" }, { "path": "/create_data_type_category", "method": "POST", "category": "datatype", "params": [ "category_path", "program" ], "description": "Create data type category" }, { "path": "/create_enum", "method": "POST", "category": "datatype", "params": [ "name", "values", "size", "program" ], "description": "Create enumeration" }, { "path": "/create_folder", "method": "POST", "category": "project", "params": [ "path", "program" ], "description": "Create a folder in the project" }, { "path": "/create_function", "method": "POST", "category": "analysis", "params": [ "address", "name", "disassemble_first", "program" ], "description": "Create function at address" }, { "path": "/create_function_signature", "method": "POST", "category": "datatype", "params": [ "name", "return_type", "parameters", "program" ], "description": "Create function signature type" }, { "path": "/create_function_tag", "method": "POST", "category": "function", "params": [ "name", "comment", "program" ], "description": "Create a program-wide function tag definition with an optional comment. Use add_function_tag to attach it to functions." }, { "path": "/create_label", "method": "POST", "category": "rename", "params": [ "address", "name", "labels", "program" ], "description": "Create label" }, { "path": "/create_memory_block", "method": "POST", "category": "analysis", "params": [ "name", "address", "size", "read", "write", "execute", "volatile", "comment", "program" ], "description": "Create memory block" }, { "path": "/create_pointer_type", "method": "POST", "category": "datatype", "params": [ "base_type", "name", "program" ], "description": "Create pointer type" }, { "path": "/create_project", "method": "POST", "category": "headless", "params": [ "parentDir", "name" ], "description": "Create a new Ghidra project" }, { "path": "/create_property_map", "method": "POST", "category": "program", "params": [ "name", "type", "program" ], "description": "Create a user property map to store typed values keyed by address. Types: int, long, string, void (address-presence tag). Use a string map holding JSON to store arbitrary structured per-address data. Call save_program to persist." }, { "path": "/create_struct", "method": "POST", "category": "datatype", "params": [ "name", "fields", "replace_placeholder", "program" ], "description": "Create structure. Body fields must be a JSON array of objects with name and type, plus optional decimal offset. Example fields: [{\"name\":\"dwId\",\"type\":\"uint\",\"offset\":0},{\"name\":\"pNext\",\"type\":\"void *\",\"offset\":4}]. Type may be any resolvable Ghidra data type or existing struct name." }, { "path": "/create_typedef", "method": "POST", "category": "datatype", "params": [ "name", "base_type", "program" ], "description": "Create typedef" }, { "path": "/create_union", "method": "POST", "category": "datatype", "params": [ "name", "fields", "program" ], "description": "Create union" }, { "path": "/debugger/dynamic_to_static", "method": "GET", "category": "debugger", "params": [ "address" ], "description": "Translate a runtime dynamic address from the current trace back to a static Ghidra program address" }, { "path": "/debugger/interrupt", "method": "POST", "category": "debugger", "params": [], "description": "Interrupt (break into) the running target" }, { "path": "/debugger/launch", "method": "POST", "category": "debugger", "params": [ "executable_path", "args", "cwd", "timeout_seconds", "program", "offer", "python_executable" ], "description": "Launch an executable through Ghidra's Trace RMI debugger launcher" }, { "path": "/debugger/launch_offers", "method": "GET", "category": "debugger", "params": [ "program" ], "description": "List available debugger launch/attach options for the current program" }, { "path": "/debugger/list_breakpoints", "method": "GET", "category": "debugger", "params": [], "description": "List all breakpoints in the current trace" }, { "path": "/debugger/modules", "method": "GET", "category": "debugger", "params": [], "description": "List modules (DLLs/EXEs) loaded in the debugged process" }, { "path": "/debugger/read_memory", "method": "GET", "category": "debugger", "params": [ "address", "size" ], "description": "Read memory from the debugged process. Returns hex dump and DWORD interpretation." }, { "path": "/debugger/registers", "method": "GET", "category": "debugger", "params": [], "description": "Read CPU registers from the current debug trace snapshot. Shows general-purpose registers (EAX-EDI, EIP, ESP, EFLAGS for x86)" }, { "path": "/debugger/remove_breakpoint", "method": "POST", "category": "debugger", "params": [ "address" ], "description": "Remove a breakpoint at an address" }, { "path": "/debugger/resume", "method": "POST", "category": "debugger", "params": [], "description": "Resume execution of the debugged process" }, { "path": "/debugger/set_breakpoint", "method": "POST", "category": "debugger", "params": [ "address" ], "description": "Set a software execution breakpoint at an address in the trace" }, { "path": "/debugger/stack_trace", "method": "GET", "category": "debugger", "params": [ "depth" ], "description": "Get the call stack backtrace for the current thread" }, { "path": "/debugger/static_to_dynamic", "method": "GET", "category": "debugger", "params": [ "address", "program" ], "description": "Translate a static Ghidra program address to a runtime dynamic address in the current trace" }, { "path": "/debugger/status", "method": "GET", "category": "debugger", "params": [], "description": "Get debugger status: active trace, thread, execution state, module count" }, { "path": "/debugger/step_into", "method": "POST", "category": "debugger", "params": [], "description": "Single-step into the next instruction (follows calls)" }, { "path": "/debugger/step_out", "method": "POST", "category": "debugger", "params": [], "description": "Step out of the current function (run to return)" }, { "path": "/debugger/step_over", "method": "POST", "category": "debugger", "params": [], "description": "Step over the next instruction (does not follow calls)" }, { "path": "/debugger/traces", "method": "GET", "category": "debugger", "params": [], "description": "List all open debug traces" }, { "path": "/decompile_function", "method": "GET", "category": "decompile", "params": [ "address", "functions", "program", "timeout" ], "description": "Decompile function" }, { "path": "/delete_bookmark", "method": "POST", "category": "comment", "params": [ "address", "category", "program" ], "description": "Delete bookmark" }, { "path": "/delete_data_type", "method": "POST", "category": "datatype", "params": [ "type_name", "resolve_demangler_duplicate", "program" ], "description": "Delete data type" }, { "path": "/delete_file", "method": "POST", "category": "project", "params": [ "filePath" ], "description": "Delete a file from the project" }, { "path": "/delete_function", "method": "POST", "category": "analysis", "params": [ "address", "program" ], "description": "Delete function at address" }, { "path": "/delete_function_tag", "method": "POST", "category": "function", "params": [ "name", "program" ], "description": "Delete a program-wide function tag definition. This detaches the tag from every function that had it." }, { "path": "/delete_label", "method": "POST", "category": "rename", "params": [ "address", "name", "labels", "program" ], "description": "Delete label at address" }, { "path": "/delete_project", "method": "POST", "category": "project", "params": [ "projectPath" ], "description": "Delete a Ghidra project" }, { "path": "/delete_property_map", "method": "POST", "category": "program", "params": [ "name", "program" ], "description": "Delete a user property map and all values it holds. Call save_program to persist." }, { "path": "/detect_array_bounds", "method": "POST", "category": "analysis", "params": [ "address", "analyze_loop_bounds", "analyze_indexing", "max_scan_range", "program" ], "description": "Detect array bounds" }, { "path": "/detect_crypto_constants", "method": "GET", "category": "analysis", "params": [ "program" ], "description": "Detect crypto constants" }, { "path": "/detect_malware_behaviors", "method": "GET", "category": "analysis", "params": [ "program" ], "description": "Detect malware behaviors" }, { "path": "/diff_functions", "method": "GET", "category": "utility", "params": [ "address_a", "address_b", "program_a", "program_b" ], "description": "Diff two functions" }, { "path": "/disassemble_bytes", "method": "POST", "category": "decompile", "params": [ "start_address", "end_address", "length", "restrict_to_execute_memory", "include_instructions", "max_instructions", "program" ], "description": "Disassemble byte range" }, { "path": "/disassemble_function", "method": "GET", "category": "decompile", "params": [ "address", "program" ], "description": "Disassemble function" }, { "path": "/embed_struct_field", "method": "POST", "category": "datatype", "params": [ "parent_struct", "field_name", "embedded_struct", "program" ], "description": "Replace a structure field with an embedded struct type by value (e.g. Rectangle inside LayoutNode). Uses modify_struct_field internally." }, { "path": "/emulate_function", "method": "POST", "category": "emulation", "params": [ "address", "registers", "memory", "max_steps", "return_registers", "read_memory_after", "program" ], "description": "Emulate a single function with controlled register/memory inputs. Returns final register state after execution. Ideal for understanding hash functions, crypto routines, or any pure-computation code path." }, { "path": "/emulate_hash_batch", "method": "POST", "category": "emulation", "params": [ "hash_function_address", "string_register", "result_register", "target_hash", "candidates", "initial_registers", "wide_string", "program" ], "description": "Brute-force API hash resolution. Emulates a hash function with each candidate API name and returns the one that produces the target hash. Ideal for resolving ROR13, CRC32, djb2, FNV, and custom hash algorithms." }, { "path": "/exit_ghidra", "method": "POST", "category": "program", "params": [], "description": "Save and exit Ghidra" }, { "path": "/export_program", "method": "POST", "category": "headless", "params": [ "program_name", "output_dir", "output_name" ], "description": "Export an open or project-resident program to a Ghidra Zip File (.gzf). Looks up the program in the open-programs map first (so it works on file-loaded programs without a project), then falls back to the open project's DomainFile." }, { "path": "/extract_iocs_with_context", "method": "GET", "category": "analysis", "params": [ "program" ], "description": "Extract IOCs with context" }, { "path": "/find_anti_analysis_techniques", "method": "GET", "category": "analysis", "params": [ "program" ], "description": "Find anti-analysis techniques" }, { "path": "/find_code_gaps", "method": "GET", "category": "analysis", "params": [ "min_size", "offset", "limit", "program" ], "description": "Find gaps of undefined bytes between functions in executable memory" }, { "path": "/find_dead_code", "method": "GET", "category": "analysis", "params": [ "function_name", "program" ], "description": "Find dead code" }, { "path": "/find_next_undefined_function", "method": "GET", "category": "analysis", "params": [ "start_address", "criteria", "pattern", "direction", "program" ], "description": "Find next undefined function" }, { "path": "/find_similar_functions", "method": "GET", "category": "search", "params": [ "target_function", "threshold", "program" ], "description": "Find similar functions" }, { "path": "/find_similar_functions_fuzzy", "method": "GET", "category": "documentation", "params": [ "address", "source_program", "target_program", "threshold", "limit" ], "description": "Cross-binary fuzzy function matching. On programs with multiple address spaces (e.g., embedded targets), prefix addresses with the space name (mem:1000) to avoid ambiguous resolution." }, { "path": "/find_undocumented_by_string", "method": "GET", "category": "utility", "params": [ "address", "program" ], "description": "Find undocumented functions referencing string" }, { "path": "/force_decompile", "method": "GET", "category": "decompile", "params": [ "address", "program" ], "description": "Force fresh decompilation" }, { "path": "/get_address_spaces", "method": "GET", "category": "program", "params": [ "program" ], "description": "List all physical and overlay address spaces in the program (overlays include is_overlay flag and overlayed_space name)" }, { "path": "/get_assembly_context", "method": "POST", "category": "analysis", "params": [ "xref_sources", "context_instructions", "include_patterns", "program" ], "description": "Get assembly context" }, { "path": "/get_bulk_function_hashes", "method": "GET", "category": "utility", "params": [ "offset", "limit", "filter", "program" ], "description": "Get bulk function hashes" }, { "path": "/get_bulk_xrefs", "method": "POST", "category": "xref", "params": [ "addresses", "program" ], "description": "Get xrefs for multiple addresses" }, { "path": "/get_comment", "method": "GET", "category": "comment", "params": [ "address", "program" ], "description": "Get listing comments (plate/pre/eol/post/repeatable) at ANY address, including data addresses (works on functions and data globals alike). Returns each comment kind plus a convenience `comment` (first non-empty) and `has_comment` flag." }, { "path": "/get_current_address", "method": "GET", "category": "getter", "params": [], "description": "Get cursor address (GUI only)" }, { "path": "/get_current_function", "method": "GET", "category": "getter", "params": [], "description": "Get function at cursor (GUI only)" }, { "path": "/get_current_program_info", "method": "GET", "category": "program", "params": [ "program" ], "description": "Get current program info" }, { "path": "/get_current_selection", "method": "GET", "category": "getter", "params": [], "description": "Get highlighted address ranges in the CodeBrowser listing (GUI only). Returns {program, is_empty, ranges:[{start,end,length}], min_address, max_address, num_addresses} or an empty-selection payload when nothing is highlighted." }, { "path": "/get_entry_points", "method": "GET", "category": "getter", "params": [ "program" ], "description": "Get program entry points" }, { "path": "/get_enum_values", "method": "GET", "category": "getter", "params": [ "enum_name", "program" ], "description": "Get enumeration values" }, { "path": "/get_external_location", "method": "GET", "category": "getter", "params": [ "address", "dll_name", "program" ], "description": "Get external location details" }, { "path": "/get_field_access_context", "method": "POST", "category": "analysis", "params": [ "struct_address", "field_offset", "num_examples", "program" ], "description": "Get field access context" }, { "path": "/get_full_call_graph", "method": "GET", "category": "getter", "params": [ "format", "limit", "program" ], "description": "Get full call graph" }, { "path": "/get_function_by_address", "method": "GET", "category": "getter", "params": [ "address", "program" ], "description": "Get function at address" }, { "path": "/get_function_call_graph", "method": "GET", "category": "getter", "params": [ "name", "address", "depth", "direction", "program" ], "description": "Get call graph" }, { "path": "/get_function_callees", "method": "GET", "category": "getter", "params": [ "name", "address", "offset", "limit", "program" ], "description": "Get functions called" }, { "path": "/get_function_callers", "method": "GET", "category": "getter", "params": [ "name", "address", "offset", "limit", "program" ], "description": "Get calling functions" }, { "path": "/get_function_count", "method": "GET", "category": "getter", "params": [ "program" ], "description": "Return the number of functions in the loaded program" }, { "path": "/get_function_documentation", "method": "GET", "category": "utility", "params": [ "address", "program" ], "description": "Export function documentation" }, { "path": "/get_function_hash", "method": "GET", "category": "utility", "params": [ "address", "program" ], "description": "Get function hash" }, { "path": "/get_function_jump_targets", "method": "GET", "category": "getter", "params": [ "name", "address", "offset", "limit", "program" ], "description": "Get jump targets" }, { "path": "/get_function_labels", "method": "GET", "category": "getter", "params": [ "name", "offset", "limit", "program" ], "description": "Get labels in function" }, { "path": "/get_function_pcode", "method": "GET", "category": "analysis", "params": [ "function_address", "granularity", "program" ], "description": "Dump raw P-code for a function (issue #192). Returns low (basic-iter) and high (HighFunction) P-code with basic blocks and varnodes. Granularity controls output: 'basic' = basic-block iter only (less memory), 'high' = HighFunction graph (default; includes both BB iter and op-iter). For P-code emulators / ML pipelines / alternative decompilers." }, { "path": "/get_function_signature", "method": "GET", "category": "utility", "params": [ "address", "program" ], "description": "Get function feature signature" }, { "path": "/get_function_tags", "method": "GET", "category": "function", "params": [ "function", "program" ], "description": "List all tags assigned to a specific function. Accepts either a function address or a function name." }, { "path": "/get_function_variables", "method": "GET", "category": "getter", "params": [ "function_name", "address", "program", "limit", "filter" ], "description": "List all variables in a function. Accepts function_name or address (address takes precedence). Use address to avoid name-lookup issues after a recent rename." }, { "path": "/get_function_xrefs", "method": "GET", "category": "xref", "params": [ "name", "address", "offset", "limit", "program" ], "description": "Get function cross-references" }, { "path": "/get_language_metadata", "method": "GET", "category": "program", "params": [ "include_registers", "include_default_symbols", "program" ], "description": "Dump the program's language description: address spaces, registers, default symbols, endianness, pointer size (issue #192). Use for P-code emulators / ML pipelines that need the SLEIGH-level facts. include_registers/include_default_symbols toggle expensive sections." }, { "path": "/get_metadata", "method": "GET", "category": "utility", "params": [ "program" ], "description": "Get program metadata" }, { "path": "/get_program_options", "method": "GET", "category": "program", "params": [ "group", "program" ], "description": "Read all options in a program option group with types, current values, defaults, and descriptions. Use list_option_groups to discover group names." }, { "path": "/get_project_info", "method": "GET", "category": "headless", "params": [], "description": "Get info about the currently open project" }, { "path": "/get_property", "method": "GET", "category": "program", "params": [ "map", "address", "program" ], "description": "Read the value stored at an address in a property map. Returns has_value=false and a null value when the address holds no property." }, { "path": "/get_struct_layout", "method": "GET", "category": "getter", "params": [ "struct_name", "program" ], "description": "Get structure layout" }, { "path": "/get_type_size", "method": "GET", "category": "datatype", "params": [ "type_name", "program" ], "description": "Get data type size and info" }, { "path": "/get_valid_data_types", "method": "GET", "category": "getter", "params": [ "category", "program" ], "description": "Get valid data type names" }, { "path": "/get_version", "method": "GET", "category": "utility", "params": [], "description": "Get plugin version" }, { "path": "/get_xrefs_from", "method": "GET", "category": "xref", "params": [ "address", "offset", "limit", "program" ], "description": "Get references from address" }, { "path": "/get_xrefs_to", "method": "GET", "category": "xref", "params": [ "address", "offset", "limit", "program" ], "description": "Get references to address" }, { "path": "/health", "method": "GET", "category": "utility", "params": [], "description": "Health check endpoint for headless server" }, { "path": "/import_data_types", "method": "POST", "category": "datatype", "params": [ "source", "format", "program" ], "description": "Import data types from GDT" }, { "path": "/import_file", "method": "POST", "category": "program", "params": [ "file_path", "project_folder", "language", "compiler_spec", "auto_analyze" ], "description": "Import a binary file from disk into the current Ghidra project and open it. For raw firmware binaries, specify language (e.g. 'ARM:LE:32:Cortex') and optionally compiler_spec (e.g. 'default')." }, { "path": "/import_program", "method": "POST", "category": "headless", "params": [ "gzf_path", "target_folder", "target_name", "overwrite" ], "description": "Import a Ghidra Zip File (.gzf) into the currently open project as a new DomainFile under target_folder (default '/'). Refuses to overwrite a program that is currently loaded in memory." }, { "path": "/inspect_memory_content", "method": "GET", "category": "analysis", "params": [ "address", "length", "detect_strings", "program" ], "description": "Inspect memory bytes" }, { "path": "/list_analyzers", "method": "GET", "category": "analysis", "params": [ "program" ], "description": "List available analysis plugins" }, { "path": "/list_bookmarks", "method": "GET", "category": "listing", "params": [ "category", "address", "program" ], "description": "List bookmarks" }, { "path": "/list_calling_conventions", "method": "GET", "category": "listing", "params": [ "program" ], "description": "List available calling conventions" }, { "path": "/list_class_members", "method": "GET", "category": "function", "params": [ "class_name", "offset", "limit", "program" ], "description": "List the member functions of a C++ class. A function counts as a member if it lives in the class's namespace (e.g. after set_function_this_type re-parents it) OR its implicit 'this' parameter types as ' *'. Each result reports how it matched (namespace / this_type / both). Replaces the manual 'search __thiscall functions then read each signature' workflow." }, { "path": "/list_classes", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List namespace/class names" }, { "path": "/list_data_items", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List defined data" }, { "path": "/list_data_items_by_xrefs", "method": "GET", "category": "listing", "params": [ "offset", "limit", "format", "filter", "type_filter", "min_xrefs", "include_all_sections", "program" ], "description": "List data sorted by xref count" }, { "path": "/list_data_type_categories", "method": "GET", "category": "datatype", "params": [ "offset", "limit", "program" ], "description": "List data type categories" }, { "path": "/list_data_types", "method": "GET", "category": "datatype", "params": [ "category", "offset", "limit", "program" ], "description": "List data types" }, { "path": "/list_exports", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List exported symbols" }, { "path": "/list_external_locations", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List external locations" }, { "path": "/list_function_tags", "method": "GET", "category": "function", "params": [ "offset", "limit", "program" ], "description": "List all program-wide function tag definitions with their use counts." }, { "path": "/list_functions", "method": "GET", "category": "listing", "params": [ "program" ], "description": "List functions with addresses" }, { "path": "/list_functions_enhanced", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List functions with metadata" }, { "path": "/list_globals", "method": "GET", "category": "listing", "params": [ "offset", "limit", "filter", "type_filter", "min_xrefs", "include_all_sections", "name_substring", "program" ], "description": "List global variables" }, { "path": "/list_imports", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List imported symbols" }, { "path": "/list_methods", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List all function names with pagination" }, { "path": "/list_namespaces", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List all namespaces" }, { "path": "/list_open_programs", "method": "GET", "category": "program", "params": [], "description": "List open programs" }, { "path": "/list_option_groups", "method": "GET", "category": "program", "params": [ "program" ], "description": "List program option groups (e.g. 'Program Information', 'Analyzers', 'Decompiler'). Each group holds typed key→value settings; use get_program_options to read a group's entries." }, { "path": "/list_project_files", "method": "GET", "category": "program", "params": [ "folder" ], "description": "List project files" }, { "path": "/list_projects", "method": "GET", "category": "project", "params": [ "searchDir" ], "description": "List available Ghidra projects" }, { "path": "/list_properties", "method": "GET", "category": "program", "params": [ "map", "start", "end", "offset", "limit", "program" ], "description": "List (address, value) entries stored in a property map, with pagination. Optionally restrict to an inclusive address range with start/end." }, { "path": "/list_property_maps", "method": "GET", "category": "program", "params": [ "program" ], "description": "List user-defined property maps — typed per-address key→value stores. Each map reports its name, value type (int|long|string|object|void), and the number of addresses holding a value." }, { "path": "/list_scripts", "method": "GET", "category": "listing", "params": [ "filter" ], "description": "List available Ghidra scripts" }, { "path": "/list_segments", "method": "GET", "category": "listing", "params": [ "offset", "limit", "program" ], "description": "List memory segments" }, { "path": "/list_shadowed_globals", "method": "GET", "category": "listing", "params": [ "offset", "limit", "include_all_sections", "program" ], "description": "List named global DATA symbols that have NO type of their own because a larger data unit starting at an earlier address covers them. These are invisible to /list_globals - it resolves the CONTAINING unit, so it reports the covering neighbour's type at the shadowed address and the global looks perfectly typed. Each record carries the container that swallowed it. Use this to find documentation that a neighbouring type application destroyed, or a symbol sitting inside an array where it does not belong." }, { "path": "/list_strings", "method": "GET", "category": "listing", "params": [ "offset", "limit", "filter", "program" ], "description": "List defined strings" }, { "path": "/load_program", "method": "POST", "category": "headless", "params": [ "file", "language", "compiler_spec" ], "description": "Load a binary file into the headless server for analysis. For raw firmware (no recognizable header), pass `language` (e.g. 'ARM:LE:32:Cortex') and optionally `compiler_spec` (e.g. 'default'); the file is then imported as raw binary with the requested processor. When `language` is omitted, the loader auto-detects the format." }, { "path": "/load_program_from_project", "method": "POST", "category": "headless", "params": [ "path" ], "description": "Load program from Ghidra project (headless)" }, { "path": "/mcp/health", "method": "GET", "category": "utility", "params": [], "description": "HTTP server health: pool stats, uptime, memory, active request count" }, { "path": "/mcp/schema", "method": "GET", "category": "utility", "params": [], "description": "Machine-readable API schema with endpoint metadata" }, { "path": "/merge_program_documentation", "method": "POST", "category": "documentation", "params": [ "source", "target", "dry_run" ], "description": "Bulk merge: copy all RE documentation (function names, signatures, plate comments, instruction comments at EOL/PRE/POST, non-default labels & global symbols) from one program to another at matching addresses. Server-side iteration in a single transaction. Designed for the orphan-rescue workflow: source is typically '_recovered', target is the original '.dll'. Set dry_run=true to count without writing." }, { "path": "/modify_struct_field", "method": "POST", "category": "datatype", "params": [ "struct_name", "field_name", "new_type", "new_name", "program" ], "description": "Modify struct field" }, { "path": "/modify_struct_field_type", "method": "POST", "category": "datatype", "params": [ "struct_name", "field_name", "new_type", "program" ], "description": "Set a structure field's type by name or offset (offset:N). Same as modify_struct_field with new_type only." }, { "path": "/move_data_type_to_category", "method": "POST", "category": "datatype", "params": [ "type_name", "category_path", "program" ], "description": "Move data type to category" }, { "path": "/move_file", "method": "POST", "category": "project", "params": [ "filePath", "destFolder" ], "description": "Move a program file to a different folder in the project, preserving analysis and documentation. Refuses on unsaved changes; closes, moves and reopens a program that is open but clean." }, { "path": "/move_folder", "method": "POST", "category": "project", "params": [ "sourcePath", "destPath" ], "description": "Move a project folder and everything under it into another folder. Refuses to move a folder into itself or its own descendant." }, { "path": "/open_program", "method": "GET", "category": "program", "params": [ "path", "auto_analyze" ], "description": "Open program from project" }, { "path": "/open_project", "method": "POST", "category": "headless", "params": [ "path", "headless", "program" ], "description": "Open an existing Ghidra project (.gpr file or directory). GUI mode adds optional `headless` (default true) to suppress auto-launching CodeBrowser, and optional `program` to auto-launch CodeBrowser for a specific file when headless=false. Headless server ignores the extra params." }, { "path": "/project/info", "method": "GET", "category": "project", "params": [], "description": "Get detailed project info including running tools and open programs" }, { "path": "/prompt_policy", "method": "POST", "category": "system", "params": [ "action", "reason", "seconds" ], "description": "Temporarily enable, disable, or query scoped automation prompt handling" }, { "path": "/read_memory", "method": "GET", "category": "analysis", "params": [ "address", "length", "program" ], "description": "Read raw memory" }, { "path": "/reanalyze", "method": "POST", "category": "program", "params": [ "program" ], "description": "Trigger full auto-analysis on a program" }, { "path": "/recreate_struct", "method": "POST", "category": "datatype", "params": [ "name", "fields", "size", "replace_placeholder", "force", "program" ], "description": "Replace a structure in one step: optionally remove an existing same-named type, then create with fields JSON (same shape as create_struct). Use when resize_struct cannot apply or you are rebuilding layout from get_struct_layout export. Set force=true to delete a non-stub type that is not referenced." }, { "path": "/remove_function_tag", "method": "POST", "category": "function", "params": [ "function", "tags", "assignments", "program" ], "description": "Detach one or more tags from a function. Does not delete the program-wide tag definition — use delete_function_tag for that." }, { "path": "/remove_program_option", "method": "POST", "category": "program", "params": [ "group", "name", "program" ], "description": "Remove an option from a program option group. Built-in registered options may be re-created with defaults by Ghidra; primarily for clearing custom options. Call save_program to persist." }, { "path": "/remove_property", "method": "POST", "category": "program", "params": [ "map", "address", "program" ], "description": "Remove the value stored at a single address in a property map. Call save_program to persist." }, { "path": "/remove_reference", "method": "POST", "category": "xref", "params": [ "from_address", "to_address", "operand_index", "program" ], "description": "Remove memory cross-reference(s) from one address to another — the inverse of add_memory_reference. Removes every reference from_address -> to_address regardless of operand by default; pass operand_index >= 0 to remove only the reference on that operand. Removes both user-defined and analyzer-inferred references and reports each removed reference's source_type. Accepts space-prefixed addresses (mem:1000)." }, { "path": "/remove_struct_field", "method": "POST", "category": "datatype", "params": [ "struct_name", "field_name", "program" ], "description": "Remove struct field" }, { "path": "/rename_data_type", "method": "POST", "category": "datatype", "params": [ "old_name", "new_name", "program" ], "description": "Rename a data type (struct, union, enum, typedef) in place, preserving existing applications of it" }, { "path": "/rename_function", "method": "POST", "category": "rename", "params": [ "old_name", "new_name", "program", "strict_mode" ], "description": "Rename function by name" }, { "path": "/rename_symbol", "method": "POST", "category": "symbol", "params": [ "target", "new_name", "kind", "old_name", "program" ], "description": "Rename a symbol of any kind. kind=auto (default): an address target routes to rename-or-create-label (handles data/label/any symbol at the address); a name target routes to a global. Force with kind=data|global|label|external. For kind=label pass old_name (the current label). Replaces rename_data / rename_global_variable / rename_label / rename_or_label / rename_external_location." }, { "path": "/rename_variables", "method": "POST", "category": "rename", "params": [ "function_address", "variable_renames", "force_individual", "program" ], "description": "Batch rename variables" }, { "path": "/resize_struct", "method": "POST", "category": "datatype", "params": [ "name", "new_size", "preserve_fields", "force", "program" ], "description": "Grow or shrink an existing structure by total byte size. Defined fields whose end offset fits within new_size are preserved; growth pads with undefined filler. Refuses shrink that would clip defined fields unless force=true. See docs/STRUCT_RESIZE_WORKFLOW.md." }, { "path": "/resolve_duplicate_type", "method": "POST", "category": "datatype", "params": [ "type_name", "delete_demangler_stub", "program" ], "description": "Find duplicate data types by simple name; delete unused /Demangler size-1 stubs when a larger canonical type exists. Helps fix 'Can't resolve datatype' and create_struct already exists on placeholders." }, { "path": "/restore_project", "method": "POST", "category": "headless", "params": [ "gar_path", "parent_dir", "project_name" ], "description": "Restore a Ghidra .gar archive into a fresh on-disk project at `parent_dir/project_name`. Closes any currently-open project first. The restored project is NOT re-opened automatically; follow up with /open_project so owner reset and project bookkeeping run via the same code path as a user-driven open. Fails loudly if the destination project already exists." }, { "path": "/run_analysis", "method": "POST", "category": "analysis", "params": [ "program" ], "description": "Run auto-analysis on the current program" }, { "path": "/run_ghidra_script", "method": "POST", "category": "script", "params": [ "script_name", "args", "timeout_seconds", "capture_output", "program" ], "description": "Run script with output capture" }, { "path": "/run_script_inline", "method": "POST", "category": "script", "params": [ "code", "args", "program" ], "description": "Run inline script code" }, { "path": "/save_all_programs", "method": "GET", "category": "program", "params": [], "description": "Save all open programs" }, { "path": "/save_program", "method": "GET", "category": "program", "params": [ "program" ], "description": "Save current program" }, { "path": "/search_byte_patterns", "method": "GET", "category": "search", "params": [ "pattern", "mask", "program" ], "description": "Search for byte patterns" }, { "path": "/search_data_types", "method": "GET", "category": "search", "params": [ "pattern", "offset", "limit", "program" ], "description": "Search data types" }, { "path": "/search_functions", "method": "GET", "category": "search", "params": [ "name_pattern", "offset", "limit", "program" ], "description": "Search functions by name" }, { "path": "/search_functions_by_tag", "method": "GET", "category": "function", "params": [ "tag", "offset", "limit", "program" ], "description": "List all functions that have a specified tag attached. Returns name + entry address." }, { "path": "/search_functions_enhanced", "method": "GET", "category": "search", "params": [ "name_pattern", "min_xrefs", "max_xrefs", "calling_convention", "has_custom_name", "is_thunk", "is_external", "regex", "sort_by", "offset", "limit", "program" ], "description": "Advanced function search" }, { "path": "/search_instructions", "method": "GET", "category": "analysis", "params": [ "mnemonic", "operand_pattern", "function", "limit", "program" ], "description": "Search for instructions by mnemonic and/or operand substring. Complement to /search_byte_patterns (byte-level); this matches after Ghidra has parsed instructions, so you can search for 'mov' + '[ecx+0xD0]' without knowing the encoding. Case-insensitive substring match on both fields. Returns {address, function, mnemonic, operands, bytes} per match." }, { "path": "/search_strings", "method": "GET", "category": "search", "params": [ "search_term", "min_length", "encoding", "offset", "limit", "program" ], "description": "Search defined strings by a regex/substring pattern" }, { "path": "/server/admin/set_permissions", "method": "POST", "category": "server", "params": [ "repo", "user", "accessLevel" ], "description": "Set user permissions on a repository" }, { "path": "/server/admin/terminate_all_checkouts", "method": "POST", "category": "server", "params": [ "repo", "path" ], "description": "Terminate all checkouts in a folder recursively" }, { "path": "/server/admin/terminate_checkout", "method": "POST", "category": "server", "params": [ "repo", "path", "checkoutId", "checkout_id" ], "description": "Terminate all checkouts on a single file" }, { "path": "/server/admin/users", "method": "GET", "category": "server", "params": [], "description": "List all users on the server" }, { "path": "/server/authenticate", "method": "POST", "category": "server", "params": [ "username", "password" ], "description": "Register server credentials for programmatic authentication" }, { "path": "/server/checkouts", "method": "GET", "category": "server", "params": [ "path" ], "description": "List all checked-out files in a folder, including server-side checkouts" }, { "path": "/server/connect", "method": "POST", "category": "server", "params": [ "host", "port" ], "description": "Connect to a Ghidra server" }, { "path": "/server/disconnect", "method": "POST", "category": "server", "params": [], "description": "Disconnect from the Ghidra server" }, { "path": "/server/repositories", "method": "GET", "category": "server", "params": [], "description": "List repositories on the connected server" }, { "path": "/server/repository/create", "method": "POST", "category": "server", "params": [ "name" ], "description": "Create a new repository on the server" }, { "path": "/server/repository/file", "method": "GET", "category": "server", "params": [ "repo", "path" ], "description": "Get file info from a server repository" }, { "path": "/server/repository/files", "method": "GET", "category": "server", "params": [ "repo", "path" ], "description": "List files in a server repository folder" }, { "path": "/server/status", "method": "GET", "category": "headless", "params": [], "description": "Check headless server connection status" }, { "path": "/server/version_control/add", "method": "POST", "category": "server", "params": [ "repo", "path", "comment", "keepCheckedOut" ], "description": "Add a file to version control" }, { "path": "/server/version_control/checkin", "method": "POST", "category": "server", "params": [ "repo", "path", "comment", "keepCheckedOut" ], "description": "Check in a version-controlled file" }, { "path": "/server/version_control/checkout", "method": "POST", "category": "server", "params": [ "repo", "path" ], "description": "Check out a version-controlled file" }, { "path": "/server/version_control/undo_checkout", "method": "POST", "category": "server", "params": [ "repo", "path" ], "description": "Undo a file checkout" }, { "path": "/server/version_history", "method": "GET", "category": "server", "params": [ "repo", "path" ], "description": "Get version history for a file" }, { "path": "/set_bookmark", "method": "POST", "category": "comment", "params": [ "address", "category", "comment", "program" ], "description": "Set bookmark" }, { "path": "/set_comment", "method": "POST", "category": "comment", "params": [ "address", "comment", "type", "program" ], "description": "Set a listing comment of a given kind (plate/pre/eol/post/repeatable) at ANY address, including data addresses. Symmetric writer for get_comment; sets a PLATE comment on a function or a data global alike." }, { "path": "/set_function_no_return", "method": "POST", "category": "function", "params": [ "function_address", "no_return", "program" ], "description": "Set no-return attribute" }, { "path": "/set_function_prototype", "method": "POST", "category": "datatype", "params": [ "function_address", "prototype", "calling_convention", "program" ], "description": "Set function prototype (return type, param types, calling convention). NOTE: the function name in the prototype string does NOT rename the function — call rename_function separately if needed." }, { "path": "/set_function_tag_comment", "method": "POST", "category": "function", "params": [ "name", "comment", "program" ], "description": "Update the comment/description on an existing program-wide function tag." }, { "path": "/set_function_this_type", "method": "POST", "category": "function", "params": [ "function_address", "this_type", "program" ], "description": "Set the decompiler/database type of the implicit 'this' pointer (ECX on x86 __thiscall/__fastcall). Use after set_function_prototype when decompile still shows void* this or a wrong class. Accepts 'MyClass *' or 'MyClass'. On programs with multiple address spaces, prefix function_address with the space name (mem:1000)." }, { "path": "/set_global", "method": "POST", "category": "datatype", "params": [ "address", "name", "type_name", "array_length", "plate_comment", "program", "strict_mode", "allow_evict" ], "description": "Atomically apply name + type + plate-comment + array length to a global variable. Single-transaction; rejects on validation failure with no partial write. Replaces the 4-tool chain (apply_data_type → rename_data → batch_set_comments → create_label)." }, { "path": "/set_image_base", "method": "POST", "category": "program", "params": [ "address", "program" ], "description": "Set the base address of the program (rebases all addresses)" }, { "path": "/set_program_option", "method": "POST", "category": "program", "params": [ "group", "name", "value", "type", "program" ], "description": "Set a typed program option. If the option already exists its type is reused; otherwise pass type (string|int|long|double|float|boolean). New/custom options are created on demand. Call save_program to persist." }, { "path": "/set_property", "method": "POST", "category": "program", "params": [ "map", "address", "value", "program" ], "description": "Set a value at an address in a property map. The value is coerced to the map's type (int/long/string); 'void' maps ignore the value and just tag the address. Create the map first with create_property_map. Call save_program to persist." }, { "path": "/set_variable_storage", "method": "POST", "category": "datatype", "params": [ "function_address", "variable_name", "storage", "program" ], "description": "Set variable storage" }, { "path": "/set_variable_type", "method": "POST", "category": "function", "params": [ "function_address", "variable_name", "new_type", "program" ], "description": "Set the data type of a function variable (local OR parameter) by name at the decompiler (high-level) layer. Pass variable_name='this' to type a __thiscall/__fastcall implicit this. Replaces set_local_variable_type / set_parameter_type / set_decompiler_variable_type." }, { "path": "/set_variables", "method": "POST", "category": "function", "params": [ "function_address", "variables", "program" ], "description": "Set types and names for multiple variables atomically. Types are applied first, then renames, in a single transaction. Hungarian prefix validation is enforced: the new name's prefix must match the type. On programs with multiple address spaces, prefix addresses with the space name." }, { "path": "/suggest_field_names", "method": "POST", "category": "analysis", "params": [ "struct_address", "struct_size", "program" ], "description": "Suggest field names" }, { "path": "/switch_program", "method": "GET", "category": "program", "params": [ "program" ], "description": "Switch current program" }, { "path": "/tool/goto_address", "method": "POST", "category": "utility", "params": [ "address" ], "description": "Navigate CodeBrowser listing and decompiler to a specific address" }, { "path": "/tool/launch_codebrowser", "method": "POST", "category": "utility", "params": [ "path" ], "description": "Open a file in CodeBrowser, launching a new one if needed" }, { "path": "/tool/running_tools", "method": "GET", "category": "utility", "params": [], "description": "List all running Ghidra tool windows" }, { "path": "/validate_data_type", "method": "GET", "category": "datatype", "params": [ "address", "type_name", "program" ], "description": "Validate data type syntax" }, { "path": "/validate_function_prototype", "method": "GET", "category": "datatype", "params": [ "function_address", "prototype", "calling_convention", "program" ], "description": "Validate function prototype" } ] }