Optional LLM workflows

glaurung ask

Ask a bounded natural-language question about a binary.

writes files or project state model credentials 2 worked examples

use it for

--route chooses a small tool set from the question. Use --show-routing to inspect that choice and --max-cost-usd to stop further model calls after the budget is reached.

Run glaurung ask --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input
A binary, one or more questions, configured model credentials, and a budget you are willing to spend.
output
A model answer plus optional tool calls, plan, routing decision, usage log, or structured finding report.
mode
model + local tools. Writes one JSONL usage record per model call under ~/.cache/glaurung/usage by default. --findings-json writes a findings report when requested.

command shape

syntax

short form
$ glaurung ask PATH --route -a QUESTION [--max-cost-usd USD]

The installed parser is authoritative: glaurung ask --help

run it

examples

Route one narrow question

Show the deterministic routing choice and set both time and cost ceilings.

run

from the engine checkout
$ glaurung ask samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --route --show-routing --max-cost-usd 0.25 --timeout 60 -a "Which calls should I inspect first?"

output

captured result captured pre-answer routing output, 2026-08-31
Analyzing hello-c-clang-debug...
L5 routing: intent=broad_discovery tools=15
  analyze_recursively, annotate_binary, decompile_function,
  describe_call_site, detect_packer, extract_strings...
Processing question 1/1...

captured pre-answer routing output, 2026-08-31.

Read the result: The tool list is reproducible for the same routing rules. The answer is model output; verify any cited VA with view or disasm.

Request a structured finding

Write JSON to stdout, skip the extra critique call, and ask one narrow question with explicit time and cost ceilings.

run

from the engine checkout
$ glaurung ask samples/binaries/platforms/linux/amd64/export/native/clang/debug/hello-c-clang-debug --route --findings-json - --skip-critique --max-cost-usd 1.00 --timeout 180 --usage-log - -a "Report only evidence-backed memory-safety findings."

output

captured result captured with openai:gpt-5.4-mini, 2026-08-31; selected fields
Question: Report only evidence-backed memory-safety findings.

Answer:
No evidence-backed memory-safety findings.

{
  "findings": [
    {
      "cwe": "CWE-134",
      "function": {"name":"main","va":4432},
      "bug_site": {"va":4464},
      "confidence": "low",
      "evidence_supports_claim": "false",
      "critique": "The decompiled body shows only constant format strings, so there is no confirmed caller-controlled format-string bug."
    }
  ]
}

captured with openai:gpt-5.4-mini, 2026-08-31; selected fields.

Read the result: The prose says there is no evidence-backed bug, while the structured pass still retains a low-confidence candidate and marks its evidence support false. Downstream code must check the verification fields instead of counting every findings row.

used above

important options

--route
Select a focused tool set by deterministic question routing.
--show-routing
Print the selected intent and tool count.
--max-cost-usd USD
Stop new agent calls after this invocation crosses the budget.
--timeout SECONDS
Bound the whole run.
--usage-log PATH
Write one JSONL usage row per model call; dash disables disk logging.

These are the flags used by the examples. Run glaurung ask --help for the complete parser help.

before you rely on it

checks

  • Treat the answer as a lead. Check cited addresses and instructions.

keep working

related commands

← all 40 commands