knewstimek/agent-tool

Quick Start

1. Download the binary for your OS below
2. Run agent-tool install (or agent-tool install claude)
3. Restart your IDE
4. Done -- all tools work immediately, no permission popups

Or just ask your AI agent:

"Download agent-tool from https://github.com/knewstimek/agent-tool/releases/latest and run agent-tool install"

Any capable AI coding agent (Claude Code, Codex, etc.) can handle the full download -> install -> restart flow automatically.

Tip: Add this to your CLAUDE.md or AGENTS.md so your agent prefers agent-tool over built-in tools:

Strict mode:

ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools. agent-tool preserves file encoding and respects .editorconfig indentation settings.

Soft mode:

Prefer agent-tool MCP tools (mcp__agent-tool__*) over built-in file tools when available.

What's New in v0.7.6

analyze tool: PE binary analysis enhancements

VA parameter for PE files -- Use va instead of offset+base_addr for automatic VA-to-offset conversion, correct address display, and symbol annotation:

• disassemble with va="0x140001000" -- auto-detects mode (32/64), sets base address, annotates known symbols
• function_at with va="0x140001000" -- finds function boundaries and auto-disassembles
• strings with va="0x140001000" -- shows VA addresses instead of file offsets
• pattern_search with va="0x140001000" -- shows VA addresses for pattern matches
• hexdump with va="0x140001000" -- reads from the correct file offset and displays VA addresses

xref -- Find all code references (CALL, JMP, Jcc, LEA, indirect) to a target address in PE executables. Supports both x86 and x64.

function_at -- Find function boundaries via PE .pdata (x64) or heuristic prologue/epilogue detection (x86/stripped binaries). Auto-disassembles the function body.

Heuristic function boundary detection -- When .pdata is unavailable (x86 PE, stripped/packed x64), falls back to prologue pattern matching (push rbp/ebp; mov rbp/ebp, rsp/esp) and epilogue detection (ret + int3/nop padding). Reports confidence level (high/medium/low).

pe_info enhancements:

• .text section auto-disassembly at entry point with correct VA display
• Imports table shows IAT VA addresses
• Symbol annotation in disassembly output (call/jmp targets resolved to function names)

Agent-friendly error messages -- All error messages now include what went wrong, why, and actionable suggestions for the agent to try next.

bash tool: heredoc EOF fix

• Fixed heredoc terminator not being recognized when sentinel was appended on same line with ;
• Changed command-sentinel separator from ; to newline across all shell backends (bash, git-bash, pwsh, PS 5.1)

Internal: shared VA resolver

• Extracted resolveVA() common helper for VA-to-file-offset conversion (prevents future VA bugs across operations)

Security fixes (from audit)

• PS 5.1 Write-Host quote injection prevention in Tokenize wrapper
• .pdata VirtualAddress bounds check before slicing
• .pdata entry count overflow prevention (uint32 -> int conversion)