Optional LLM workflows
glaurung ask
Ask a bounded natural-language question about a binary.
use it for
--route chooses a small tool set from the question. Use --show-routing to inspect that choice and --max-cost-usd to stop further model calls after the budget is reached.
Run glaurung ask --help on your installed version before putting the command in a script.
Glaurung is still pre-1.0.
- input
- A binary, one or more questions, configured model credentials, and a budget you are willing to spend.
- output
- A model answer plus optional tool calls, plan, routing decision, usage log, or structured finding report.
- mode
- model + local tools. Writes one JSONL usage record per model call under ~/.cache/glaurung/usage by default. --findings-json writes a findings report when requested.
command shape
syntax
$ glaurung ask PATH --route -a QUESTION [--max-cost-usd USD]
The installed parser is authoritative: glaurung ask --help
run it
examples
Route one narrow question
Show the deterministic routing choice and set both time and cost ceilings.
run
$ glaurung ask samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --route --show-routing --max-cost-usd 0.25 --timeout 60 -a "Which calls should I inspect first?" output
Analyzing hello-c-clang-debug...
L5 routing: intent=broad_discovery tools=15
analyze_recursively, annotate_binary, decompile_function,
describe_call_site, detect_packer, extract_strings...
Processing question 1/1... captured pre-answer routing output, 2026-08-31.
Read the result: The tool list is reproducible for the same routing rules. The answer is model output; verify any cited VA with view or disasm.
Request a structured finding
Write JSON to stdout, skip the extra critique call, and ask one narrow question with explicit time and cost ceilings.
run
$ glaurung ask samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --route --findings-json - --skip-critique --max-cost-usd 1.00 --timeout 180 --usage-log - -a "Report only evidence-backed memory-safety findings." output
Question: Report only evidence-backed memory-safety findings.
Answer:
No evidence-backed memory-safety findings.
{
"findings": [
{
"cwe": "CWE-134",
"function": {"name":"main","va":4432},
"bug_site": {"va":4464},
"confidence": "low",
"evidence_supports_claim": "false",
"critique": "The decompiled body shows only constant format strings, so there is no confirmed caller-controlled format-string bug."
}
]
} captured with openai:gpt-5.4-mini, 2026-08-31; selected fields.
Read the result: The prose says there is no evidence-backed bug, while the structured pass still retains a low-confidence candidate and marks its evidence support false. Downstream code must check the verification fields instead of counting every findings row.
used above
important options
These are the flags used by the examples. Run glaurung ask --help for the complete parser help.
before you rely on it
checks
- Treat the answer as a lead. Check cited addresses and instructions.
keep working