> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/add-ons/assist/reference/tool-catalog.md).

# Tool Catalog

This page is the per-tool reference for Assist's built-in tool surface. For each tool, the tables below list its required capability group in **Settings → Permissions → Assist** (`/permissions`), whether it requires a **Hex-Rays decompiler license** for the target architecture, whether it modifies database or host state, and what it does.

## How to read this catalog

* **Availability depends on the connection and host.** Not every tool is advertised on every connection:
  * **Runtime Z3 tools** (`solve_constraint`, `check_reachability`) are registered only when the connected IDA host detects a compatible Z3 library.
  * **Memory tools** (`remember`, `recall`, `revise_memory`, `forget_memory`, `propagate_memory`, `knowledge_stats`) are registered once the database's knowledge store opens.
  * **Assist Mesh & routing tools** (`list_databases`, `use_database`, `mesh_fanout_fetch`, `mesh_script_fanout`) are registered when the Assist Mesh is active.
  * **Agent-session tools** (`expand_tool_result`, `propose_followups`) are session-scaffolding tools (`propose_followups` is an internal agent-loop tool for proposing suggestion pills, not an analyst database operation).
* **Dynamic per-call capability gates.** Several tools evaluate their required capability per call based on arguments:
  * `read_file`, `list_dir`, `find_files`, and `search_files` require **Read files** (`read_files`) inside the database's folder or Assist's profile, and upgrade to **Read files outside the project** (`read_files_outside`) for any external path.
  * `emulate_process` requires **Read files** (`read_files`) when opening host files inside the project and **Read files outside the project** (`read_files_outside`) for external host paths or when `options.native_runtime: true` is enabled.
  * `database_state` requires **Write files** (`write_files`) for `save` and **Modify this IDA database** (`modify_database`) for `undo` and `redo`.
* **Mutation & undo semantics.** Tools marked **IDB** in the **Mutates** column set `modifies_database: true` in the registry, require **Modify this IDA database** (`modify_database`), and are grouped into IDA undo steps (`Ctrl+Z`) when IDA's undo facility is available (`verify_prototype_convergence` also requires **Modify this IDA database** during `dry_run: true` because it temporarily applies and restores the candidate prototype in IDA). Memory tools (`remember`, `revise_memory`, `forget_memory`, `propagate_memory`) modify the per-binary SQLite knowledge base under **Share confirmed findings** (`knowledge_write`), while filesystem and process tools (`write_file`, `edit_file`, `create_directory`, `move_path`, `delete_path`, `python`, `execute_command`) modify host files or spawn processes outside IDA's undo stack.

***

## Decompilation, disassembly & graphs

| Tool                          | Capability gate | Decompiler | Mutates | Purpose                                                                                                                                          |
| ----------------------------- | --------------- | ---------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `decompile`                   | None            | Yes        | No      | Decompile one or more functions to Hex-Rays C pseudocode (batched).                                                                              |
| `disassemble`                 | None            | No         | No      | Disassemble instructions at one or more addresses or functions (batched).                                                                        |
| `read_and_disassemble_memory` | None            | No         | No      | Read raw bytes and decode instructions over one or more address ranges (batched).                                                                |
| `scan_disasm`                 | None            | No         | No      | Scan disassembled instructions across an address range with a regex or mnemonic filter.                                                          |
| `get_cfg`                     | None            | No         | No      | Return the basic-block control-flow graph (CFG) for one or more functions (batched).                                                             |
| `get_call_graph`              | None            | No         | No      | Return callers and callees for one or more functions up to a configurable depth (batched).                                                       |
| `get_ctree`                   | None            | Yes        | No      | Return the Hex-Rays [ctree](/add-ons/assist/reference/glossary.md#ctree) representation for one or more functions (batched).                     |
| `get_ctree_calls`             | None            | Yes        | No      | Extract call expressions and argument trees from the Hex-Rays ctree (batched).                                                                   |
| `get_microcode`               | None            | Yes        | No      | Return Hex-Rays [microcode](/add-ons/assist/reference/glossary.md#microcode) at a selectable maturity level for one or more functions (batched). |
| `get_local_variables`         | None            | Yes        | No      | List Hex-Rays local variables and parameters for one or more functions (batched).                                                                |

## Function, variable & prototype editing

| Tool                           | Capability gate              | Decompiler | Mutates | Purpose                                                                                                                               |
| ------------------------------ | ---------------------------- | ---------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `get_function_info`            | None                         | No         | No      | Inspect bounds, flags, prototype, and frame metadata for one or more functions (batched).                                             |
| `list_functions`               | None                         | No         | No      | List functions in address order, optionally filtered by name or address range.                                                        |
| `get_stack_frame`              | None                         | No         | No      | Inspect the stack-frame layout and frame members of one or more functions (batched).                                                  |
| `analyze_function_bounds`      | None                         | No         | No      | Read-only inspection of function chunks, decoded control flow, incoming xrefs, and shared chunk ownership.                            |
| `apply_function_bounds`        | **Modify this IDA database** | No         | IDB     | Update a function's start/end bounds or chunk membership.                                                                             |
| `create_function`              | **Modify this IDA database** | No         | IDB     | Create one or more functions at start addresses (batched).                                                                            |
| `delete_function`              | **Modify this IDA database** | No         | IDB     | Delete (undefine) one or more functions without erasing underlying instructions (batched).                                            |
| `set_function_flags`           | **Modify this IDA database** | No         | IDB     | Set or clear whitelisted core function flags (such as `FUNC_THUNK`, `FUNC_NORET`, and `FUNC_FRAME`, batched).                         |
| `set_function_prototype`       | **Modify this IDA database** | No         | IDB     | Set the C prototype (signature) of one or more functions (batched).                                                                   |
| `verify_prototype_convergence` | **Modify this IDA database** | Yes        | IDB¹    | Preview (`dry_run: true`) or apply a candidate function prototype across direct callers and report decompiler diagnostic convergence. |
| `rename`                       | **Modify this IDA database** | No         | IDB     | Rename one or more global symbols, functions, or labels (batched).                                                                    |
| `rename_lvar`                  | **Modify this IDA database** | Yes        | IDB     | Rename one or more local variables or parameters in a decompiled function (batched).                                                  |
| `set_lvar_type`                | **Modify this IDA database** | Yes        | IDB     | Set the C type of one or more local variables or parameters in decompiled functions (batched).                                        |
| `set_lvar_comment`             | **Modify this IDA database** | Yes        | IDB     | Set a comment on one or more local variables or parameters in decompiled functions (batched).                                         |
| `hide_lvar`                    | **Modify this IDA database** | Yes        | IDB     | Hide or unhide one or more Hex-Rays local variables or arguments (batched).                                                           |
| `remap_lvar_storage`           | **Modify this IDA database** | Yes        | IDB     | Map one Hex-Rays local variable onto another local variable's storage (batched).                                                      |
| `reset_decompiler_information` | **Modify this IDA database** | Yes        | IDB     | Clear selected cached Hex-Rays decompiler state for one or more functions (batched).                                                  |

*¹ `verify_prototype_convergence` temporarily applies and restores the candidate prototype in IDA even when `dry_run: true`, so it always requires **Modify this IDA database**.*

## Types, structs & enums

| Tool                            | Capability gate              | Decompiler | Mutates | Purpose                                                                                                                      |
| ------------------------------- | ---------------------------- | ---------- | ------- | ---------------------------------------------------------------------------------------------------------------------------- |
| `get_local_types`               | None                         | No         | No      | Enumerate types from the database's Local Types library.                                                                     |
| `find_type_by_name`             | None                         | No         | No      | Look up one or more named types in the Local Types library (batched).                                                        |
| `get_struct_info`               | None                         | No         | No      | Inspect field offsets, sizes, and types for one or more structures (batched).                                                |
| `declare_type`                  | **Modify this IDA database** | No         | IDB     | Parse C type declarations into Local Types or apply them at addresses (batched).                                             |
| `set_type`                      | **Modify this IDA database** | No         | IDB     | Apply a C type to one or more functions, globals, or data items (batched).                                                   |
| `define_local_struct`           | **Modify this IDA database** | No         | IDB     | Create or replace a struct or union in Local Types from a C declaration or field list.                                       |
| `rename_struct_field`           | **Modify this IDA database** | No         | IDB     | Rename one or more structure fields (batched).                                                                               |
| `set_struct_field_type`         | **Modify this IDA database** | No         | IDB     | Change the type of one or more structure fields (batched).                                                                   |
| `create_enum`                   | **Modify this IDA database** | No         | IDB     | Create a new enumeration type with named constants.                                                                          |
| `add_enum_member`               | **Modify this IDA database** | No         | IDB     | Add one or more members to existing enumeration types (batched).                                                             |
| `apply_enum`                    | **Modify this IDA database** | No         | IDB     | Apply an enumeration constant to instruction operands (batched).                                                             |
| `recover_struct_layout`         | None                         | Yes        | No      | Propose a candidate struct layout from caller ctree pointer dereferences (with optional callee propagation).                 |
| `recover_interface_layout`      | None                         | Yes        | No      | Propose candidate interface/vtable layouts from microcode indirect-call and constant-slot patterns.                          |
| `recover_multi_register_return` | None                         | Yes        | No      | Propose a candidate multi-register return (`__usercall` + `@<...>`) prototype from callee/caller microcode def/use analysis. |

## Dataflow, diagnostics & pattern analysis

| Tool                       | Capability gate | Decompiler | Mutates | Purpose                                                                                                                                                                     |
| -------------------------- | --------------- | ---------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `diagnose_function`        | None            | No         | No      | Run a diagnostic pass on one or more functions to detect decompiler, frame, or boundary issues (batched).                                                                   |
| `get_function_analysis`    | None            | No         | No      | Return bounded static and concrete micro-emulation observations for a function.                                                                                             |
| `compare_functions`        | None            | No         | No      | Compare between 2 and 8 functions and return a structural similarity and diff summary.                                                                                      |
| `rank_functions`           | None            | No         | No      | Score and rank functions across weighted analysis signals.                                                                                                                  |
| `trace_register_backward`  | None            | No         | No      | Slice backward from an instruction to the most recent write to a target register (batched).                                                                                 |
| `register_lifetime_table`  | None            | Yes        | No      | Emit an instruction-by-instruction register def/use/last-use table for a function.                                                                                          |
| `find_index_loops`         | None            | Yes        | No      | Find indexed loops with CFG back-edges, induction/modulo evidence, and store bounds.                                                                                        |
| `find_range_stores`        | None            | No         | No      | Find candidate store instructions whose target falls within an address range (including orphan code).                                                                       |
| `filter_conditional_sites` | None            | Yes        | No      | Evaluate an intra-function guard predicate over candidate sites (e.g., `find_range_stores` output) and emit validated `relation_proof` rows for `apply_to_validated_sites`. |

## Database queries, navigation, bytes & patching

| Tool                         | Capability gate                                                          | Decompiler | Mutates    | Purpose                                                                                                                                                                                          |
| ---------------------------- | ------------------------------------------------------------------------ | ---------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `get_binary_type`            | None                                                                     | No         | No         | Classify the binary's file format, ABI, and architecture discriminators.                                                                                                                         |
| `get_segments`               | None                                                                     | No         | No         | List all segments in the database with bounds, permissions, and classes.                                                                                                                         |
| `get_imports`                | None                                                                     | No         | No         | List imported functions and modules, optionally filtered by pattern.                                                                                                                             |
| `get_exports`                | None                                                                     | No         | No         | List exported functions and entry points.                                                                                                                                                        |
| `search_strings`             | None                                                                     | No         | No         | Search or rank string literals in the binary (batched).                                                                                                                                          |
| `resolve_address`            | None                                                                     | No         | No         | Resolve addresses or symbol names to function context, type, and string/xref summary (batched).                                                                                                  |
| `get_xrefs`                  | None                                                                     | No         | No         | List cross-references to or from one or more addresses or symbols (batched).                                                                                                                     |
| `get_xref_context`           | None                                                                     | No         | No         | Return incoming cross-references together with surrounding instruction context (batched).                                                                                                        |
| `classify_global_refs`       | None                                                                     | No         | No         | Classify references to a global symbol or address, including subrange and indexed accesses.                                                                                                      |
| `idb_query`                  | None                                                                     | No         | No         | Run a read-only SQL query against the database mirror tables (`functions`, `chunks`, `names`, `types`, `strings`, `xrefs`, `segments`, `imports`, `exports`, `facts`).                           |
| `get_ui_focus`               | None                                                                     | No         | No         | Read the active IDA widget, cursor address, and selection for agent context.                                                                                                                     |
| `jump_to_address`            | None                                                                     | No²        | No         | Navigate the active IDA view to a target address.                                                                                                                                                |
| `list_bookmarks`             | None                                                                     | No         | No         | List all marked positions (bookmarks) in the database.                                                                                                                                           |
| `create_bookmark`            | **Modify this IDA database**                                             | No         | IDB        | Create one or more bookmarks at addresses in the database (batched).                                                                                                                             |
| `get_bytes`                  | None                                                                     | No         | No         | Read raw bytes from one or more addresses (batched).                                                                                                                                             |
| `find_bytes`                 | None                                                                     | No         | No         | Search loaded segments for a hex byte pattern with wildcards.                                                                                                                                    |
| `patch_bytes`                | **Modify this IDA database**                                             | No         | IDB        | Patch bytes at one or more addresses in the database (batched).                                                                                                                                  |
| `nop_range`                  | **Modify this IDA database**                                             | No         | IDB        | Overwrite one or more byte ranges with NOP instructions (falls back to `0x90` outside supported ISA NOP encodings; batched).                                                                     |
| `revert_patched_bytes`       | **Modify this IDA database**                                             | No         | IDB        | Restore original bytes across one or more patched ranges (batched).                                                                                                                              |
| `apply_to_validated_sites`   | **Modify this IDA database**                                             | No         | IDB        | Preview (`dry_run: true`) or apply `nop_range`, `patch_bytes`, or `add_comment` across up to 512 inline sites carrying validated `intra-function-v1` proof rows from `filter_conditional_sites`. |
| `add_comment`                | **Modify this IDA database**                                             | No         | IDB        | Set regular or repeatable comments at one or more addresses (batched).                                                                                                                           |
| `edit_extra_comment`         | **Modify this IDA database**                                             | No         | IDB        | Add, update, or clear anterior/posterior extra comment lines.                                                                                                                                    |
| `apply_operand_decoration`   | **Modify this IDA database**                                             | No         | IDB        | Apply number base, offset, struct-offset, or sign/bitwise operand display representations.                                                                                                       |
| `edit_xref`                  | **Modify this IDA database**                                             | No         | IDB        | Add or delete user-defined code or data cross-references.                                                                                                                                        |
| `edit_entry_point`           | **Modify this IDA database**                                             | No         | IDB        | Add or rename a program entry point or export.                                                                                                                                                   |
| `edit_segment`               | **Modify this IDA database**                                             | No         | IDB        | Create or update a segment's name, class, bounds, or permissions.                                                                                                                                |
| `set_segment_register_range` | **Modify this IDA database**                                             | No         | IDB        | Read or set a processor segment-register value over an address range.                                                                                                                            |
| `create_code`                | **Modify this IDA database**                                             | No         | IDB        | Convert undefined bytes into decoded instructions at one or more addresses or ranges (batched).                                                                                                  |
| `create_data`                | **Modify this IDA database**                                             | No         | IDB        | Define typed data items (integers, strings, pointers, structs, arrays) at one or more addresses (batched).                                                                                       |
| `undefine_range`             | **Modify this IDA database**                                             | No         | IDB        | Undefine code or data items across one or more ranges (batched).                                                                                                                                 |
| `reanalyze_range`            | **Modify this IDA database**                                             | No         | IDB        | Queue IDA auto-analysis across one or more address ranges (batched).                                                                                                                             |
| `repair_region`              | **Modify this IDA database**                                             | No         | IDB        | Run a guided repair sequence (`undefine` → `create_code` → `reanalyze` → `create_function`) on misanalyzed regions (batched).                                                                    |
| `database_state`             | **Write files** (`save`) / **Modify this IDA database** (`undo`, `redo`) | No         | Disk / IDB | Save the open database to disk (`save`; may refuse temporary or unsaved databases) or undo/redo 1–16 of Assist's own IDB steps (`undo`, `redo`).                                                 |

*² `jump_to_address` requires a decompiler only when explicitly targeting a Pseudocode view.*

## Signatures, YARA & provenance

| Tool                    | Capability gate              | Decompiler | Mutates | Purpose                                                                                                       |
| ----------------------- | ---------------------------- | ---------- | ------- | ------------------------------------------------------------------------------------------------------------- |
| `detect_toolchain`      | None                         | No         | No      | Infer the compiler and source language with concrete evidence anchors.                                        |
| `detect_libraries`      | None                         | No         | No      | Fingerprint linked libraries and language runtimes from imports, strings, and sections.                       |
| `detect_debug_info`     | None                         | No         | No      | Detect embedded or external debug symbols, build IDs, and PDB/DWARF references.                               |
| `apply_flirt_signature` | **Modify this IDA database** | No         | IDB     | Preview or apply a named [FLIRT](/add-ons/assist/reference/glossary.md#flirt) signature file to the database. |
| `apply_c_signature`     | **Modify this IDA database** | No         | IDB     | Apply C function signatures or type declarations at one or more addresses (batched).                          |
| `make_signature`        | None                         | No         | No      | Generate an IDA-style wildcard byte signature for a function or address range.                                |
| `search_signature`      | None                         | No         | No      | Search loaded segments for an IDA-style wildcard byte signature.                                              |
| `generate_yara`         | None                         | No         | No      | Generate a YARA rule from a function, byte pattern, or string selection.                                      |

## Emulation ([RAX](/add-ons/assist/reference/glossary.md#rax))

See [Emulation](/add-ons/assist/concepts/emulation.md) and [Requirements & Support → Emulation support](/add-ons/assist/reference/requirements.md#emulation-support) for architecture support (`x86-32`, `x86-64`, `ARM64`, `ARM32` for CPU sessions; `PE`, `ELF`, `Mach-O` for `emulate_process`).

| Tool                        | Capability gate                                      | Decompiler | Mutates | Purpose                                                                                                                                     |
| --------------------------- | ---------------------------------------------------- | ---------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `emulate`                   | None                                                 | No         | No      | Run a stateless code slice from an address in an isolated guest and return register/memory effects.                                         |
| `emulate_function`          | None                                                 | No         | No      | Emulate a function call with arguments placed according to the ABI (`x86-32`, `x86-64`, `ARM64`).                                           |
| `extract_strings`           | None                                                 | No         | No      | Emulate a function or range to reconstruct runtime-built stack strings (partial observation of the executed path).                          |
| `resolve_indirect_branches` | None                                                 | No         | No      | Emulate forward from an address and record resolved indirect-branch targets (`x86-32`, `x86-64`, `ARM64`).                                  |
| `emulate_recover_mmio`      | None                                                 | No         | No      | Emulate code with Port-IO and MMIO hooks armed to log peripheral register accesses.                                                         |
| `emulate_start`             | None                                                 | No         | No      | Create a stateful CPU emulation session (`system` or `user` mode) and return its `session_id`.                                              |
| `emulate_step`              | None                                                 | No         | No      | Execute up to `n` instructions in a stateful CPU session.                                                                                   |
| `emulate_run_until`         | None                                                 | No         | No      | Run a stateful CPU session until a target address, return, or instruction/time budget is reached.                                           |
| `emulate_watch`             | None                                                 | No         | No      | Run a stateful CPU session with read/write watch hooks over explicit address ranges.                                                        |
| `emulate_explore_branches`  | None                                                 | No         | No      | Explore both outcomes of conditional or indirect branches in a session (`x86-64`, `ARM64`).                                                 |
| `emulate_get_state`         | None                                                 | No         | No      | Inspect a session's registers, stop reason, trace, modelled calls, taint state, and symbolic expressions.                                   |
| `emulate_set_register`      | None                                                 | No         | No      | Set a register value in an active CPU emulation session.                                                                                    |
| `emulate_read_memory`       | None                                                 | No         | No      | Read bytes from guest physical/mapped memory in an active session.                                                                          |
| `emulate_write_memory`      | None                                                 | No         | No      | Write hex-encoded bytes into guest memory in an active session.                                                                             |
| `emulate_map_memory`        | None                                                 | No         | No      | Map a new non-overlapping guest memory region in an active session.                                                                         |
| `emulate_regions`           | None                                                 | No         | No      | List mapped memory regions and their `rwx` permissions in an active session.                                                                |
| `emulate_translate`         | None                                                 | No         | No      | Translate a guest virtual address through the session's current page tables.                                                                |
| `emulate_read_virtual`      | None                                                 | No         | No      | Read bytes from an MMU-translated guest virtual address in an active session.                                                               |
| `emulate_write_virtual`     | None                                                 | No         | No      | Write hex-encoded bytes to an MMU-translated guest virtual address in an active session.                                                    |
| `emulate_inject_interrupt`  | None                                                 | No         | No      | Inject a hardware interrupt vector or NMI into a `system`-mode session.                                                                     |
| `emulate_checkpoint`        | None                                                 | No         | No      | Save the current session state and return a checkpoint ID.                                                                                  |
| `emulate_snapshot`          | None                                                 | No         | No      | Save the current session state (like `emulate_checkpoint`) and report per-session snapshot budget usage.                                    |
| `emulate_restore`           | None                                                 | No         | No      | Rewind an active session to a previously saved checkpoint or snapshot ID.                                                                   |
| `emulate_diff`              | None                                                 | No         | No      | Compare register and memory deltas between two saved checkpoints/snapshots.                                                                 |
| `emulate_fork`              | None                                                 | No         | No      | Clone an active CPU session into a new, independent child session ID.                                                                       |
| `emulate_end`               | None                                                 | No         | No      | Close a CPU emulation session and release its guest memory.                                                                                 |
| `emulate_process`           | **Read files** / **Read files outside the project**³ | No         | No      | Open, run, and inspect a user-mode Windows PE, Linux ELF, or Darwin Mach-O guest process with captured stdio and thread/mapping inspection. |

*³ `emulate_process` requires **Read files** when reading project-local host files and **Read files outside the project** when reading external host files or when `options.native_runtime: true` is enabled.*

## Constraint solving (Z3)

Registered when the connected IDA host detects a compatible runtime Z3 library:

| Tool                 | Capability gate | Decompiler | Mutates | Purpose                                                                                                                                                                                                     |
| -------------------- | --------------- | ---------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `solve_constraint`   | None            | No         | No      | Solve symbolic bitvector/integer constraints with Z3 and return status (`sat`, `unsat`, `unknown`, `timeout`) and model assignments.                                                                        |
| `check_reachability` | None            | No         | No      | Test satisfiability of caller-supplied path conditions (collapses `unsat`, `unknown`, `timeout`, and parse errors into `reachable: false`; does not auto-translate a selected CFG into a complete formula). |

## Scripting, host files & shell

| Tool               | Capability gate                                      | Decompiler | Mutates    | Purpose                                                                                                |
| ------------------ | ---------------------------------------------------- | ---------- | ---------- | ------------------------------------------------------------------------------------------------------ |
| `idascript`        | **Run Python**                                       | No         | IDB / Host | Execute IDAPython inside IDA's process against the open database (unrestricted Python/IDA API access). |
| `python`           | **Run Python**                                       | No         | Host       | Execute standalone Python in a separate subprocess outside IDA.                                        |
| `execute_command`  | **Run shell commands**                               | No         | Host       | Execute a host shell command and return combined stdout/stderr and exit code.                          |
| `read_file`        | **Read files** / **Read files outside the project**⁴ | No         | No         | Read a text file from disk.                                                                            |
| `list_dir`         | **Read files** / **Read files outside the project**⁴ | No         | No         | List entries in a directory on disk.                                                                   |
| `find_files`       | **Read files** / **Read files outside the project**⁴ | No         | No         | Find files under a directory matching a glob pattern.                                                  |
| `search_files`     | **Read files** / **Read files outside the project**⁴ | No         | No         | Search file contents under a directory using a regular expression.                                     |
| `write_file`       | **Write files**                                      | No         | Disk       | Create, overwrite, or append to a file on disk.                                                        |
| `edit_file`        | **Write files**                                      | No         | Disk       | Replace text or line ranges in an existing file on disk.                                               |
| `create_directory` | **Write files**                                      | No         | Disk       | Create a directory (and any missing parent directories) on disk.                                       |
| `move_path`        | **Write files**                                      | No         | Disk       | Move or rename a file or directory on disk.                                                            |
| `delete_path`      | **Write files**                                      | No         | Disk       | Delete a file or directory on disk.                                                                    |

*⁴ Paths inside the database's directory or Assist's profile require **Read files** (`read_files`); any other path requires **Read files outside the project** (`read_files_outside`).*

## Memory, Assist Mesh & multi-database routing

| Tool                 | Capability gate                   | Decompiler | Mutates           | Purpose                                                                                                                                                  |
| -------------------- | --------------------------------- | ---------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `remember`           | **Share confirmed findings**⁵     | No         | Memory DB         | Store a persistent global or local analytical finding in the binary's knowledge base.                                                                    |
| `recall`             | None⁵                             | No         | No                | Search accepted memories in the binary's knowledge base by query, scope, or anchor.                                                                      |
| `revise_memory`      | **Share confirmed findings**⁵     | No         | Memory DB         | Revise an existing memory by ID and expected revision (or queue a proposal when revising human/foreign notes).                                           |
| `forget_memory`      | **Share confirmed findings**⁵     | No         | Memory DB         | Retract a stored memory by ID and expected revision while preserving audit history.                                                                      |
| `propagate_memory`   | **Share confirmed findings**⁵     | No         | Peer Memory DB    | Send confirmed findings to linked IDA databases over the Assist Mesh (held in peer quarantine until accepted).                                           |
| `knowledge_stats`    | None                              | No         | No                | Return counts and statistics for the open binary's knowledge base.                                                                                       |
| `list_databases`     | Connection admission              | No         | No                | List reachable open IDA databases (`binary`, `hash`, `role`, `instance_id`, `database_id`, `selected`, `binary_version`, and optional `file_extension`). |
| `use_database`       | Connection admission              | No         | Connection state  | Select which open IDA database subsequent tool calls on this connection target.                                                                          |
| `mesh_fanout_fetch`  | None                              | No         | No                | Expand cached per-member detail from an earlier `scope: "mesh"` read fan-out call (15-minute TTL, up to 512 entries).                                    |
| `mesh_script_fanout` | **Run Python** (+ fleet approval) | No         | Peer IDBs / Hosts | Queue a fleet-scoped IDAPython (`idascript`) run across linked databases with a frozen destination roster (non-atomic per-destination execution).        |

*⁵ Memory writes also require **Allow memory writes** (on by default), and `recall` requires **Allow memory recall** (on by default) under **Settings → Preferences… → Advanced → Persistent memory**; see* [*Memory*](/add-ons/assist/concepts/memory.md)*.*

## Visuals, reporting & session scaffolding

| Tool                 | Capability gate | Decompiler | Mutates | Purpose                                                                                                                                                                                       |
| -------------------- | --------------- | ---------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `render_visual`      | None            | No         | No      | Render a structured JSON visual artifact (`graph`, `cfg_panel`, `call_path`, `table`, `byte_strip`, `memory_map`, `struct_layout`, `register_diff`, `patch_preview`, etc.) in the transcript. |
| `screenshot`         | None            | No         | No      | Capture an open IDA view as a PNG image (withheld from the model while any confidentiality rule is active; unsupported on managed Claude Code and Antigravity CLI backends).                  |
| `generate_report`    | None            | No         | No      | Generate a structured Markdown analysis report over 1 to 64 functions.                                                                                                                        |
| `expand_tool_result` | None            | No         | No      | Page through or search retained tool-result evidence for a summarized tool result handle in the current conversation branch.                                                                  |
| `propose_followups`  | None            | No         | No      | Internal agent-loop tool used to propose 1–3 follow-up suggestion pills at the end of a turn.                                                                                                 |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.hex-rays.com/add-ons/assist/reference/tool-catalog.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
