HexWitness

Traverse structured reads, writes, loads, stores, definitions, uses, aliases, parameters, and return edges.

Search retained opt-in decompiler text and bounded IL/SSA/codec slices for an exact build.

Search the cross-record lexical retrieval index. Results are discovery-only candidates and include exact authoritative follow-up tools.

Retrieve a bounded discovery-only context with provenance and exact-query follow-ups. It never promotes retrieved text into evidence or claims.

Return vendor-neutral fields, provenance, privacy boundaries, and preferred adapters for a reverse-engineering objective.

Inventory exported relationship kinds and source/target coverage for an optional build.

List static, dynamic, capture, documentary, synthetic, or manually asserted evidence with provenance and confidence.

Deterministically gather supporting and opposing evidence, unsupported claims, contradictions, failed attempts, open gaps, and next actions. Never changes confidence or promotes a fact.

Return one evidence dossier: identity, signature, decompilation when retained, callers, callees, references, runtime hits, claims, and provenance.

Persist one exact-build failed attempt with expected/actual outcome, lesson, tool identity, and optional evidence links so future agents do not repeat it blindly.

List build-bound failed experiments with expected and actual outcomes, lessons, tools, versions, and linked evidence so agents do not repeat disproven work.

Inventory functions or methods for an exact build with optional name/signature filter.

Inspect one indexed entity and return the smallest missing static or runtime evidence needed for an investigation objective.

Check daemon health, build inventory, and indexed evidence counts.

Add a checklist, decision, note, or exact evidence/entity/claim/gap/capture reference to a durable investigation.

Create one exact-build investigation, optionally seeded by a deterministic playbook and explicit agent-operation budget.

Return one investigation, ordered checklist and reference items, failed attempts, usage ledger, progress, completion blockers, and budget state.

Charge explicit agent-operation units against an investigation budget. Units are operator-defined operations, not provider tokens or money.

Summarize active, blocked, stalled, complete, and completion-ready investigations for one build or the full local evidence database.

Set planned, active, blocked, complete, or abandoned. Completion fails unless required checks, proof links, and linked gaps satisfy the gate.

Set one investigation item to pending, in progress, done, blocked, or skipped. Required skipped items still block completion.

List persistent build-bound investigations with checklist progress, evidence links, gaps, stale state, and operation budget status.

Resolve agent-callable local reverse-engineering tools and show argv-only, workspace, timeout, output, and observation-authority policy.

Show what HexWitness retains, database size and counts, latest ingest/capture, privacy-preserving activity, and the query-before-live-tool reuse policy.

Generic metadata lookup for hashes, IDs, assets, resources, codecs, protocol fragments, or project-defined attributes without target-specific assumptions.

Query exported field offsets by exact build, owner class/type, field name, or signature.

Find a bounded shortest path between two build-scoped entities using optional edge-kind filtering.

List deterministic binary, firmware, network, protocol, and runtime investigation playbooks. Playbooks define evidence gates, not LLM personas.

Structured cross-tool query over entities, optional edge kinds, evidence coverage, and runtime coverage. This is the safe generic replacement for arbitrary SQL.

Bounded incoming or outgoing graph traversal for calls, references, ownership, or arbitrary edge kinds.

Run one allowlisted or project-local tool without a shell, with a root-bounded working directory and timeout/output caps. The process is not OS-sandboxed. Returns a reproducible receipt and observation-only output; optional recording creates build-bound tool-observation evidence, never a claim.

Search functions, symbols, strings, types, classes, imports, and runtime objects.

Return retained decompiler, IL, SSA, basic-block, codec, or manually bounded slices for one entity.

Query types, classes, enums, vtables, and slots exported by any supported analysis tool.

Resolve a UUID/GUID across stable keys, names, and structured type metadata for an optional exact build.

Return one vtable or class and its slot-to-function relationships.

Return prioritized static/runtime evidence gaps without guessing missing behavior.