cheatengine 5.8.13 → 5.8.15

package/ce_mcp_server.py

@@ -1,2509 +0,0 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-"""Cheat Engine MCP Server - Named pipe bridge to Cheat Engine"""
-
-import concurrent.futures
-import io
-import json
-import os
-import struct
-import sys
-import threading
-import time
-import traceback
-from dataclasses import dataclass, field
-from enum import Enum
-from typing import Any, Dict, List, Optional
-
-try:
-    import pywintypes
-    import win32file
-    import win32pipe
-    import winerror
-except ImportError:
-    print(
-        "Error: 'pywin32' module is missing. Please run: pip install pywin32",
-        file=sys.stderr,
-    )
-    sys.exit(1)
-
-
-# ============ Timeout Error ============
-class TimeoutError(Exception):
-    """Tool execution timeout exception"""
-
-    def __init__(self, tool_name: str, params: dict, elapsed_time: float, timeout: int):
-        self.tool_name = tool_name
-        self.params = params
-        self.elapsed_time = elapsed_time
-        self.timeout = timeout
-        super().__init__(
-            f"Tool '{tool_name}' timed out after {elapsed_time:.2f}s (timeout: {timeout}s)"
-        )
-
-
-# ============ Connection Health Monitoring ============
-@dataclass
-class ConnectionHealth:
-    """Connection health status"""
-
-    last_success_time: float = 0.0
-    connection_attempts: int = 0
-    consecutive_errors: int = 0
-    total_errors: int = 0
-    last_error: Optional[str] = None
-    is_connected: bool = False
-
-
-class HealthMonitor:
-    """Connection health monitor
-
-    Tracks connection state, records success/failure, triggers reconnect on consecutive errors.
-    """
-
-    def __init__(self, error_threshold: int = 5):
-        """Initialize health monitor
-
-        Args:
-            error_threshold: Consecutive error threshold for reconnect (default: 5)
-        """
-        self.health = ConnectionHealth()
-        self.error_threshold = error_threshold
-
-    def record_success(self) -> None:
-        """Record successful communication"""
-        self.health.last_success_time = time.time()
-        self.health.consecutive_errors = 0
-        self.health.is_connected = True
-
-    def record_error(self, error: str) -> bool:
-        """Record communication error
-
-        Args:
-            error: Error message
-
-        Returns:
-            bool: Whether reconnect is needed (consecutive_errors >= error_threshold)
-        """
-        self.health.consecutive_errors += 1
-        self.health.total_errors += 1
-        self.health.last_error = error
-        self.health.is_connected = False
-        return self.health.consecutive_errors >= self.error_threshold
-
-    def record_connection_attempt(self) -> None:
-        """Record connection attempt"""
-        self.health.connection_attempts += 1
-
-    def get_metrics(self) -> dict:
-        """Get health metrics"""
-        return {
-            "last_success_time": self.health.last_success_time,
-            "connection_attempts": self.health.connection_attempts,
-            "consecutive_errors": self.health.consecutive_errors,
-            "total_errors": self.health.total_errors,
-            "last_error": self.health.last_error,
-            "is_connected": self.health.is_connected,
-        }
-
-    def reset(self) -> None:
-        """Reset health state"""
-        self.health = ConnectionHealth()
-
-
-# ============ Timeout Manager ============
-class TimeoutManager:
-    """Tool execution timeout manager
-
-    Manages timeout configuration for different tools.
-
-    **Validates: Requirements 2.1, 2.4**
-    """
-
-    # Default timeout (seconds)
-    DEFAULT_TIMEOUT = 30
-
-    # Tool-specific timeouts (seconds) for long-running operations
-    TOOL_TIMEOUTS = {
-        "ce_find_pointer_path": 60,
-        "ce_break_and_trace": 60,
-        "ce_find_what_accesses": 30,
-        "ce_find_what_writes": 30,
-        "ce_aob_scan": 30,
-        "ce_value_scan": 30,
-        "ce_scan_new": 30,
-        "ce_scan_next": 30,
-        "ce_build_cfg": 45,
-        "ce_symbolic_trace": 45,
-        "ce_call_function": 30,
-    }
-
-    def __init__(self, default_timeout: int = None, tool_timeouts: dict = None):
-        """Initialize timeout manager
-
-        Args:
-            default_timeout: Custom default timeout (seconds), None uses DEFAULT_TIMEOUT
-            tool_timeouts: Custom tool timeouts, merged with defaults
-        """
-        self.default_timeout = (
-            default_timeout if default_timeout is not None else self.DEFAULT_TIMEOUT
-        )
-        self.tool_timeouts = dict(self.TOOL_TIMEOUTS)
-        if tool_timeouts:
-            self.tool_timeouts.update(tool_timeouts)
-
-    def get_timeout(self, tool_name: str) -> int:
-        """Get tool timeout
-
-        Args:
-            tool_name: Tool name (e.g., 'ce_find_pointer_path')
-
-        Returns:
-            int: Timeout in seconds
-        """
-        return self.tool_timeouts.get(tool_name, self.default_timeout)
-
-    def set_timeout(self, tool_name: str, timeout: int) -> None:
-        """Set tool-specific timeout
-
-        Args:
-            tool_name: Tool name
-            timeout: Timeout in seconds
-        """
-        self.tool_timeouts[tool_name] = timeout
-
-    def get_all_timeouts(self) -> dict:
-        """Get all timeout configurations"""
-        return {
-            "default_timeout": self.default_timeout,
-            "tool_timeouts": dict(self.tool_timeouts),
-        }
-
-
-# ============ Metrics Collector ============
-@dataclass
-class ToolMetrics:
-    """Tool execution metrics
-
-    **Validates: Requirements 4.4**
-    """
-
-    call_count: int = 0
-    total_time: float = 0.0
-    error_count: int = 0
-    last_call_time: float = 0.0
-
-
-class MetricsCollector:
-    """Metrics collector for tracking tool calls, execution time and error rates.
-
-    **Validates: Requirements 4.4**
-    """
-
-    def __init__(self):
-        """Initialize metrics collector"""
-        self.tool_metrics: Dict[str, ToolMetrics] = {}
-        self.start_time = time.time()
-
-    def record_call(
-        self, tool_name: str, duration: float, is_error: bool = False
-    ) -> None:
-        """Record tool call
-
-        Args:
-            tool_name: Tool name
-            duration: Execution time (seconds)
-            is_error: Whether call resulted in error
-        """
-        if tool_name not in self.tool_metrics:
-            self.tool_metrics[tool_name] = ToolMetrics()
-
-        metrics = self.tool_metrics[tool_name]
-        metrics.call_count += 1
-        metrics.total_time += duration
-        metrics.last_call_time = time.time()
-        if is_error:
-            metrics.error_count += 1
-
-    def get_tool_metrics(self, tool_name: str) -> Optional[dict]:
-        """Get metrics for specific tool"""
-        metrics = self.tool_metrics.get(tool_name)
-        if not metrics:
-            return None
-        return {
-            "calls": metrics.call_count,
-            "total_time": metrics.total_time,
-            "avg_time": metrics.total_time / metrics.call_count
-            if metrics.call_count > 0
-            else 0,
-            "errors": metrics.error_count,
-            "error_rate": metrics.error_count / metrics.call_count
-            if metrics.call_count > 0
-            else 0,
-            "last_call_time": metrics.last_call_time,
-        }
-
-    def get_summary(self) -> dict:
-        """Get metrics summary"""
-        total_calls = sum(m.call_count for m in self.tool_metrics.values())
-        total_errors = sum(m.error_count for m in self.tool_metrics.values())
-
-        return {
-            "uptime": time.time() - self.start_time,
-            "total_calls": total_calls,
-            "total_errors": total_errors,
-            "error_rate": total_errors / total_calls if total_calls > 0 else 0,
-            "tools": {
-                name: {
-                    "calls": m.call_count,
-                    "avg_time": m.total_time / m.call_count if m.call_count > 0 else 0,
-                    "errors": m.error_count,
-                    "error_rate": m.error_count / m.call_count
-                    if m.call_count > 0
-                    else 0,
-                }
-                for name, m in self.tool_metrics.items()
-            },
-        }
-
-    def reset(self) -> None:
-        """Reset all metrics"""
-        self.tool_metrics.clear()
-        self.start_time = time.time()
-
-
-# ============ Config ============
-class Config:
-    PIPE_NAME = r"\\.\pipe\{}".format(
-        os.environ.get("CE_MCP_PIPE_NAME", "ce_mcp_bridge")
-    )
-    AUTH_TOKEN = os.environ.get("CE_MCP_AUTH_TOKEN")
-    MAX_RETRIES = 3
-    CHUNK_SIZE = 1024 * 1024
-    MAX_RESPONSE_SIZE = 10 * 1024 * 1024
-    DEBUG = False
-
-
-sys.stdin = io.TextIOWrapper(sys.stdin.buffer, encoding="utf-8")
-sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding="utf-8", newline="\n")
-sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8")
-
-
-# ============ Logger ============
-class Logger:
-    @staticmethod
-    def log(msg: str, level: str = "INFO"):
-        if level == "DEBUG" and not Config.DEBUG:
-            return
-        sys.stderr.write(f"[CheatEngine-MCP-{level}] {msg}\n")
-        sys.stderr.flush()
-
-    @staticmethod
-    def info(msg: str):
-        Logger.log(msg, "INFO")
-
-    @staticmethod
-    def debug(msg: str):
-        Logger.log(msg, "DEBUG")
-
-    @staticmethod
-    def error(msg: str):
-        Logger.log(msg, "ERROR")
-
-
-log = Logger()
-
-
-# ============ Pipe Client ============
-class PipeClient:
-    """Named pipe client with persistent connection and background reconnection"""
-
-    def __init__(self, pipe_name: str = Config.PIPE_NAME, error_threshold: int = 5):
-        self.pipe_name = pipe_name
-        self.pipe = None
-        self.health_monitor = HealthMonitor(error_threshold=error_threshold)
-        self._lock = threading.Lock()
-        self._reconnect_thread = None
-        self._stop_reconnect = threading.Event()
-        self._connected = threading.Event()
-        # Legacy attributes
-        self.connection_attempts = 0
-        self.last_error: Optional[str] = None
-        self._last_connect_error_code = None
-        self.last_success_time = 0
-
-    def is_valid(self) -> bool:
-        if not self.pipe:
-            return False
-        try:
-            win32pipe.GetNamedPipeInfo(self.pipe)
-            return True
-        except:
-            return False
-
-    def _try_connect_once(self) -> bool:
-        """Single connection attempt, returns True on success"""
-        try:
-            pipe = win32file.CreateFile(
-                self.pipe_name,
-                win32file.GENERIC_READ | win32file.GENERIC_WRITE,
-                0,
-                None,
-                win32file.OPEN_EXISTING,
-                0,
-                None,
-            )
-            win32pipe.SetNamedPipeHandleState(
-                pipe, win32pipe.PIPE_READMODE_BYTE, None, None
-            )
-
-            with self._lock:
-                self._close_unlocked()
-                self.pipe = pipe
-                self.last_error = None
-                self._last_connect_error_code = None
-                self.last_success_time = time.time()
-                self._connected.set()
-
-            log.info("Connected to Cheat Engine Pipe")
-            self.health_monitor.record_success()
-            return True
-
-        except pywintypes.error as e:
-            self._last_connect_error_code = e.winerror
-            self.last_error = str(e)
-
-            # If pipe busy, wait and retry once
-            if e.winerror == winerror.ERROR_PIPE_BUSY:
-                try:
-                    win32pipe.WaitNamedPipe(self.pipe_name, 2000)
-                    return self._try_connect_once()
-                except:
-                    pass
-            return False
-
-    def _reconnect_loop(self):
-        """Background reconnection loop"""
-        backoff = 0.5
-        max_backoff = 10.0
-
-        while not self._stop_reconnect.is_set():
-            if not self.is_valid():
-                self.connection_attempts += 1
-                self.health_monitor.record_connection_attempt()
-
-                if self._try_connect_once():
-                    backoff = 0.5
-                else:
-                    backoff = min(backoff * 1.5, max_backoff)
-            else:
-                backoff = 0.5
-
-            self._stop_reconnect.wait(backoff)
-
-    def start_background_reconnect(self):
-        """Start background reconnection thread"""
-        if self._reconnect_thread and self._reconnect_thread.is_alive():
-            return
-        self._stop_reconnect.clear()
-        self._reconnect_thread = threading.Thread(
-            target=self._reconnect_loop, daemon=True
-        )
-        self._reconnect_thread.start()
-
-    def connect(self, force: bool = False, timeout: float = 3.0) -> bool:
-        """Connect to pipe with optional wait for background reconnect"""
-        if not force and self.is_valid():
-            return True
-
-        # Try immediate connection
-        self.connection_attempts += 1
-        self.health_monitor.record_connection_attempt()
-        if self._try_connect_once():
-            return True
-
-        # Start background reconnect and wait
-        self.start_background_reconnect()
-        if timeout > 0:
-            return self._connected.wait(timeout)
-        return False
-
-    def _close_unlocked(self):
-        """Close pipe without lock"""
-        if self.pipe:
-            try:
-                win32file.CloseHandle(self.pipe)
-            except:
-                pass
-            self.pipe = None
-            self._connected.clear()
-
-    def _close(self):
-        with self._lock:
-            self._close_unlocked()
-
-    def _get_connection_error_message(self, winerror_code: int, attempt: int) -> str:
-        """Get user-friendly error message based on Windows error code"""
-        messages = {
-            winerror.ERROR_FILE_NOT_FOUND: (
-                "Cheat Engine MCP Bridge not running. "
-                "Load 'ce_mcp_bridge.lua' in CE (Table -> Show Cheat Table Lua Script -> Execute)"
-            ),
-            winerror.ERROR_PIPE_BUSY: "Pipe busy - another client may be connected",
-            winerror.ERROR_ACCESS_DENIED: "Access denied - try running as administrator",
-            winerror.ERROR_BROKEN_PIPE: "Connection lost - restart bridge script in CE",
-        }
-        base_msg = messages.get(
-            winerror_code, f"Connection failed (error {winerror_code})"
-        )
-        return f"{base_msg} [attempt {attempt}/{Config.MAX_RETRIES}]"
-
-    def _do_send_receive(self, data: dict) -> dict:
-        """Execute send/receive operation with auto-reconnect"""
-        # Add authentication token if configured
-        if Config.AUTH_TOKEN:
-            data = {**data, "auth_token": Config.AUTH_TOKEN}
-
-        for retry in range(Config.MAX_RETRIES):
-            if not self.connect(force=retry > 0):
-                if self._last_connect_error_code:
-                    return {
-                        "error": self._get_connection_error_message(
-                            self._last_connect_error_code, retry + 1
-                        )
-                    }
-                return {
-                    "error": f"Cannot connect to CE (attempt {retry + 1}/{Config.MAX_RETRIES})"
-                }
-
-            try:
-                with self._lock:
-                    if not self.pipe:
-                        continue
-
-                    json_bytes = json.dumps(data, ensure_ascii=False).encode("utf-8")
-                    win32file.WriteFile(self.pipe, struct.pack("<I", len(json_bytes)))
-                    win32file.WriteFile(self.pipe, json_bytes)
-
-                    _, header = win32file.ReadFile(self.pipe, 4)
-                    if not header or len(header) < 4:
-                        raise Exception("Empty response header")
-
-                    resp_len = struct.unpack("<I", header)[0]
-                    if resp_len == 0 or resp_len > Config.MAX_RESPONSE_SIZE:
-                        raise Exception(f"Invalid response size: {resp_len}")
-
-                    resp_data = self._read_chunked(resp_len)
-
-                decoded = self._decode_response(resp_data)
-                self.last_success_time = time.time()
-                self.health_monitor.record_success()
-                return json.loads(decoded)
-
-            except pywintypes.error as e:
-                log.debug(f"Pipe error (attempt {retry + 1}): {e}")
-                self.health_monitor.record_error(str(e))
-                self._close()
-                time.sleep(0.1 * (retry + 1))
-
-            except Exception as e:
-                log.debug(f"Error (attempt {retry + 1}): {e}")
-                self.health_monitor.record_error(str(e))
-                self._close()
-
-        return {"error": self.last_error or "Connection failed after retries"}
-
-    def send_receive(
-        self, data: dict, timeout: int = 30000, tool_name: str = None
-    ) -> dict:
-        """Send request and receive response with timeout support
-
-        Args:
-            data: Data dictionary to send
-            timeout: Timeout in milliseconds, default 30000ms (30s)
-            tool_name: Tool name for timeout error reporting
-
-        Returns:
-            dict: Response data, or error dict on timeout
-
-        **Validates: Requirements 2.2, 2.3**
-        """
-        timeout_seconds = timeout / 1000.0
-        start_time = time.time()
-
-        with concurrent.futures.ThreadPoolExecutor(max_workers=1) as executor:
-            future = executor.submit(self._do_send_receive, data)
-            try:
-                result = future.result(timeout=timeout_seconds)
-                return result
-            except concurrent.futures.TimeoutError:
-                elapsed_time = time.time() - start_time
-                error_msg = f"Tool execution timed out after {elapsed_time:.2f}s (timeout: {timeout_seconds}s)"
-                log.error(
-                    f"Timeout: tool={tool_name or 'unknown'}, params={data.get('params', {})}, elapsed={elapsed_time:.2f}s"
-                )
-                self.health_monitor.record_error(error_msg)
-                return {
-                    "error": error_msg,
-                    "timeout_info": {
-                        "tool_name": tool_name or data.get("command", "unknown"),
-                        "params": data.get("params", {}),
-                        "elapsed_time": elapsed_time,
-                        "timeout_seconds": timeout_seconds,
-                    },
-                }
-
-    def get_health_metrics(self) -> dict:
-        """Get connection health metrics"""
-        return self.health_monitor.get_metrics()
-
-    def _read_chunked(self, total_size: int) -> bytes:
-        buffer = bytearray(total_size)
-        offset = 0
-        while offset < total_size:
-            chunk_size = min(total_size - offset, Config.CHUNK_SIZE)
-            _, chunk = win32file.ReadFile(self.pipe, chunk_size)
-            if not chunk:
-                raise Exception("Connection closed while reading response")
-            buffer[offset : offset + len(chunk)] = chunk
-            offset += len(chunk)
-        return bytes(buffer)
-
-    def _decode_response(self, data: bytes) -> str:
-        for encoding in ["utf-8", "gbk", "gb2312", "latin-1"]:
-            try:
-                return data.decode(encoding)
-            except UnicodeDecodeError:
-                continue
-        return data.decode("utf-8", errors="replace")
-
-    def stop(self):
-        """Stop the client and background threads"""
-        self._stop_reconnect.set()
-        if self._reconnect_thread:
-            self._reconnect_thread.join(timeout=1)
-        self._close()
-
-
-# ============ Tool Registry ============
-class ToolCategory(Enum):
-    SYSTEM = "system"
-    MEMORY = "memory"
-    SCANNING = "scanning"
-    SYMBOLS = "symbols"
-    DEBUG = "debug"
-    ANALYSIS = "analysis"
-
-
-@dataclass
-class ToolParam:
-    """Tool parameter definition"""
-
-    name: str
-    type: str
-    description: str = ""
-    required: bool = False
-    default: Any = None
-    enum: List[str] = field(default_factory=list)
-
-
-@dataclass
-class Tool:
-    """Tool definition"""
-
-    name: str
-    description: str
-    lua_command: str
-    category: ToolCategory
-    params: List[ToolParam] = field(default_factory=list)
-
-    def to_mcp_schema(self) -> dict:
-        """Convert to MCP tool schema format"""
-        properties = {}
-        required = []
-
-        for p in self.params:
-            prop = {"type": p.type}
-            if p.description:
-                prop["description"] = p.description
-            if p.default is not None:
-                prop["default"] = p.default
-            if p.enum:
-                prop["enum"] = p.enum
-            properties[p.name] = prop
-
-            if p.required:
-                required.append(p.name)
-
-        return {
-            "name": self.name,
-            "description": self.description,
-            "inputSchema": {
-                "type": "object",
-                "properties": properties,
-                "required": required,
-            },
-        }
-
-
-class ToolRegistry:
-    """Registry for all MCP tools"""
-
-    # Common parameter definitions
-    ADDR_PARAM = ToolParam(
-        "address",
-        "string",
-        "Address expression (e.g. 'game.exe+123' or '0x123456')",
-        True,
-    )
-
-    def __init__(self):
-        self.tools: Dict[str, Tool] = {}
-        self._register_all_tools()
-
-    def _register_all_tools(self):
-        """Register all available tools"""
-        self._register_system_tools()
-        self._register_memory_tools()
-        self._register_scanning_tools()
-        self._register_symbol_tools()
-        self._register_debug_tools()
-        self._register_analysis_tools()
-
-    def _register(self, tool: Tool):
-        """Register a single tool"""
-        self.tools[tool.name] = tool
-
-    def _register_system_tools(self):
-        """Register system/info tools"""
-        self._register(
-            Tool(
-                "ce_ping",
-                "Test connection to Cheat Engine and get bridge status. "
-                "If connection fails, automatically returns diagnostic info with troubleshooting suggestions. "
-                "Returns connection health metrics (last_success_time, connection_attempts, consecutive_errors, total_errors, is_connected) "
-                "and server metrics (uptime, total_calls, error_rate, per-tool statistics).",
-                "ping",
-                ToolCategory.SYSTEM,
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_process_info",
-                "[INIT] Get current attached process info and refresh symbols. CALL THIS FIRST in any session. "
-                "Returns: {name, pid, is64bit, ce_version, debugger: {active, interfaceName, canBreak}, "
-                "last_symbol_refresh (timestamp), symbol_refresh_count, module_count}. "
-                "Also triggers symbol handler refresh to ensure symbols are up-to-date after module loading.",
-                "get_process_info",
-                ToolCategory.SYSTEM,
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_execute_lua",
-                "Execute raw Lua code in CE",
-                "execute_lua",
-                ToolCategory.SYSTEM,
-                [ToolParam("code", "string", "Lua code to execute", True)],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_selected_address",
-                "Get the currently selected address in CE Memory View/Disassembler",
-                "get_selected_address",
-                ToolCategory.SYSTEM,
-            )
-        )
-
-        # ============ Logging Tools ============
-        self._register(
-            Tool(
-                "ce_get_logs",
-                "Get log entries from the Cheat Engine MCP Bridge Lua side. "
-                "Returns: {entries: [{timestamp, level, category, message, data}], count}. "
-                "Useful for debugging and monitoring bridge operations.",
-                "get_logs",
-                ToolCategory.SYSTEM,
-                [
-                    ToolParam(
-                        "count",
-                        "integer",
-                        "Maximum number of log entries to return (default: 100)",
-                        False,
-                        100,
-                    ),
-                    ToolParam(
-                        "min_level",
-                        "integer",
-                        "Minimum log level to include: 1=DEBUG, 2=INFO, 3=WARN, 4=ERROR (default: 1)",
-                        False,
-                        1,
-                    ),
-                ],
-            )
-        )
-
-        # ============ Process Automation Tools (NEW) ============
-        self._register(
-            Tool(
-                "ce_list_processes",
-                "List running processes. Use before ce_attach_process to find available targets. "
-                "Returns: {count, processes: [{pid, name}]}.",
-                "list_processes",
-                ToolCategory.SYSTEM,
-                [
-                    ToolParam(
-                        "filter",
-                        "string",
-                        "Filter processes by name (case-insensitive substring match)",
-                    ),
-                    ToolParam(
-                        "max_results",
-                        "integer",
-                        "Maximum results to return (default: 100)",
-                        False,
-                        100,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_attach_process",
-                "Attach to a process by PID or name. Clears caches and scan sessions after attaching. "
-                "Returns: {success, pid, name, is64bit}.",
-                "attach_process",
-                ToolCategory.SYSTEM,
-                [
-                    ToolParam(
-                        "target",
-                        "string",
-                        "Process ID (number) or process name (e.g. 'game.exe')",
-                        True,
-                    )
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_auto_assemble",
-                "Execute an Auto Assembler script. Supports enable/disable scripts, code injection, etc. "
-                "Returns: {success, target_self}.",
-                "auto_assemble",
-                ToolCategory.SYSTEM,
-                [
-                    ToolParam(
-                        "script", "string", "Auto Assembler script content", True
-                    ),
-                    ToolParam(
-                        "target_self",
-                        "boolean",
-                        "Target CE process itself (for internal scripts)",
-                        False,
-                        False,
-                    ),
-                ],
-            )
-        )
-
-    def _register_memory_tools(self):
-        """Register memory operation tools"""
-        mem_types = [
-            "byte",
-            "word",
-            "dword",
-            "qword",
-            "float",
-            "double",
-            "string",
-            "bytes",
-        ]
-
-        self._register(
-            Tool(
-                "ce_read_memory",
-                "Read a single memory value. Returns: {address, type, value}. "
-                "For reading multiple addresses, use ce_read_memory_batch instead for better performance.",
-                "read_memory",
-                ToolCategory.MEMORY,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam("type", "string", "Value type", True, enum=mem_types),
-                    ToolParam("size", "integer", "Size for string/bytes", False, 100),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_read_memory_batch",
-                "[PERFORMANCE] Read multiple memory addresses in ONE request. "
-                "ALWAYS prefer this over multiple ce_read_memory calls for better performance. "
-                'Example: [{"address": "game.exe+100", "type": "dword", "id": "hp"}, {"address": "game.exe+104", "type": "float", "id": "mp"}]. '
-                "Returns: {results: [{id, address, type, value, error?}]}.",
-                "read_memory_batch",
-                ToolCategory.MEMORY,
-                [
-                    ToolParam(
-                        "requests",
-                        "array",
-                        "Array of {address, type, id?, size?} objects",
-                        True,
-                    )
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_write_memory",
-                "Write memory value. Returns: {success: true, address, bytes_written}.",
-                "write_memory",
-                ToolCategory.MEMORY,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam("type", "string", "Value type", True, enum=mem_types),
-                    ToolParam(
-                        "value",
-                        "string",
-                        "Value to write (number, string, or byte array)",
-                        True,
-                    ),
-                ],
-            )
-        )
-
-    def _register_scanning_tools(self):
-        """Register scanning tools"""
-        self._register(
-            Tool(
-                "ce_aob_scan",
-                "Scan for byte pattern (AOB/signature) in memory. Supports ?? wildcards for variable bytes. "
-                "USE WHEN: Finding code by signature, locating functions, making version-independent scripts. "
-                "NOT FOR: Finding data values (use ce_scan_new or ce_value_scan). "
-                "Returns: {count, results: [addresses]}.",
-                "aob_scan",
-                ToolCategory.SCANNING,
-                [
-                    ToolParam(
-                        "aob_string",
-                        "string",
-                        "e.g. '48 89 5C 24 ?? 48 83 EC 20'",
-                        True,
-                    ),
-                    ToolParam(
-                        "module",
-                        "string",
-                        "Limit scan to specific module for better performance (e.g. 'game.exe', 'UnityPlayer.dll')",
-                    ),
-                    ToolParam("protection", "string", "Flags like -C+X", False, "-C+X"),
-                    ToolParam(
-                        "start",
-                        "string",
-                        "Start address (optional, use module instead for better performance)",
-                    ),
-                    ToolParam("stop", "string", "Stop address (optional)"),
-                    ToolParam("max_results", "integer", "Maximum results", False, 100),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_value_scan",
-                "[MANUAL POINTER TRACING - STEP 2] Scan memory for a specific value. "
-                "USE WHEN: After ce_find_what_accesses returns a register value, search for that value to find pointer storage. "
-                "Example: RBX=0x12345678 accessed your address -> scan for 0x12345678 (qword) -> find where pointer is stored. "
-                "NOT FOR: Finding game values like health/gold (use ce_scan_new for value hunting). "
-                "Returns: {count, results: [{address, symbol, isStatic}], value_searched, type, module}. "
-                "TIP: isStatic=true means the address is in a module (potential static base found!).",
-                "value_scan",
-                ToolCategory.SCANNING,
-                [
-                    ToolParam(
-                        "value",
-                        "string",
-                        "Value to search for (e.g. '0x255D5E758' or '12345')",
-                        True,
-                    ),
-                    ToolParam(
-                        "type",
-                        "string",
-                        "Value type",
-                        True,
-                        enum=[
-                            "byte",
-                            "word",
-                            "dword",
-                            "qword",
-                            "float",
-                            "double",
-                            "string",
-                        ],
-                    ),
-                    ToolParam(
-                        "module",
-                        "string",
-                        "Limit scan to specific module (e.g. 'game.exe')",
-                    ),
-                    ToolParam(
-                        "protection",
-                        "string",
-                        "Memory protection flags (default: '+W-C' for writable memory)",
-                        False,
-                        "+W-C",
-                    ),
-                    ToolParam("start", "string", "Start address (optional)"),
-                    ToolParam("stop", "string", "Stop address (optional)"),
-                    ToolParam("max_results", "integer", "Maximum results", False, 100),
-                    ToolParam(
-                        "is_hex",
-                        "boolean",
-                        "Treat value as hexadecimal (auto-detected if omitted)",
-                    ),
-                ],
-            )
-        )
-
-        # ============ Scan Session Tools (NEW) ============
-        self._register(
-            Tool(
-                "ce_scan_new",
-                "[VALUE HUNTING] Start scan session to find unknown addresses by observing value changes. "
-                "USE WHEN: You don't know the address but can observe changes (health 100->95). "
-                "WORKFLOW: ce_scan_new -> change value in game -> ce_scan_next('decreased') -> repeat until few results. "
-                "NOT FOR: Pointer tracing (use ce_value_scan). NOT FOR: Code patterns (use ce_aob_scan). "
-                "Returns: {session_id, count}. Use ce_scan_next to filter, ce_scan_results to get addresses.",
-                "scan_new",
-                ToolCategory.SCANNING,
-                [
-                    ToolParam(
-                        "value",
-                        "string",
-                        "Value to search for (e.g. '100' or '0x64')",
-                        True,
-                    ),
-                    ToolParam(
-                        "type",
-                        "string",
-                        "Value type",
-                        True,
-                        enum=[
-                            "byte",
-                            "word",
-                            "dword",
-                            "qword",
-                            "float",
-                            "double",
-                            "string",
-                        ],
-                    ),
-                    ToolParam(
-                        "module",
-                        "string",
-                        "Limit scan to specific module (e.g. 'game.exe')",
-                    ),
-                    ToolParam(
-                        "protection", "string", "Memory protection flags", False, "+W-C"
-                    ),
-                    ToolParam("start", "string", "Start address (optional)"),
-                    ToolParam("stop", "string", "Stop address (optional)"),
-                    ToolParam(
-                        "is_hex",
-                        "boolean",
-                        "Treat value as hexadecimal (auto-detected if omitted)",
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_scan_next",
-                "Continue scanning (filter) an existing session. Supports various scan types. "
-                "Returns: {session_id, count, scan_number, scan_type}.",
-                "scan_next",
-                ToolCategory.SCANNING,
-                [
-                    ToolParam(
-                        "session_id", "string", "Session ID from ce_scan_new", True
-                    ),
-                    ToolParam("value", "string", "Value to search for", True),
-                    ToolParam(
-                        "scan_type",
-                        "string",
-                        "Scan type for filtering",
-                        False,
-                        "exact",
-                        enum=[
-                            "exact",
-                            "increased",
-                            "decreased",
-                            "changed",
-                            "unchanged",
-                            "increased_by",
-                            "decreased_by",
-                            "bigger_than",
-                            "smaller_than",
-                            "between",
-                        ],
-                    ),
-                    ToolParam(
-                        "value2", "string", "Second value for 'between' scan type"
-                    ),
-                    ToolParam("is_hex", "boolean", "Treat value as hexadecimal"),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_scan_results",
-                "Get paginated results from a scan session. "
-                "Returns: {session_id, total_count, start_index, returned_count, has_more, results: [{index, address, symbol, value, isStatic}]}.",
-                "scan_results",
-                ToolCategory.SCANNING,
-                [
-                    ToolParam(
-                        "session_id", "string", "Session ID from ce_scan_new", True
-                    ),
-                    ToolParam(
-                        "start_index",
-                        "integer",
-                        "Starting index for pagination",
-                        False,
-                        0,
-                    ),
-                    ToolParam(
-                        "limit",
-                        "integer",
-                        "Maximum results to return (max 1000)",
-                        False,
-                        100,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_scan_close",
-                "Close a scan session and release resources. "
-                "Returns: {session_id, closed, active_sessions}.",
-                "scan_close",
-                ToolCategory.SCANNING,
-                [ToolParam("session_id", "string", "Session ID to close", True)],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_scan_list",
-                "List all active scan sessions. "
-                "Returns: {active_sessions, max_sessions, sessions: [{session_id, count, scan_count, value_type, ...}]}.",
-                "scan_list",
-                ToolCategory.SCANNING,
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_enum_modules",
-                "List all loaded modules (DLLs). Returns: {count, modules: [{name, base, size}]}.",
-                "enum_modules",
-                ToolCategory.SCANNING,
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_address_list",
-                "Get all records from Cheat Table (address list)",
-                "get_address_list",
-                ToolCategory.SCANNING,
-                [
-                    ToolParam(
-                        "include_script",
-                        "boolean",
-                        "Include script content for AA script entries",
-                        False,
-                        False,
-                    )
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_add_address_record",
-                "Add a new record to Cheat Table",
-                "add_address_record",
-                ToolCategory.SCANNING,
-                [
-                    ToolParam("description", "string", "Record description/name", True),
-                    ToolParam("address", "string", "Address expression", True),
-                    ToolParam(
-                        "value_type",
-                        "string",
-                        "Value type",
-                        False,
-                        "dword",
-                        enum=[
-                            "byte",
-                            "word",
-                            "dword",
-                            "qword",
-                            "float",
-                            "double",
-                            "string",
-                            "bytes",
-                            "script",
-                        ],
-                    ),
-                    ToolParam(
-                        "script", "string", "AA script content (only for script type)"
-                    ),
-                ],
-            )
-        )
-
-    def _register_symbol_tools(self):
-        """Register symbol management tools"""
-        self._register(
-            Tool(
-                "ce_get_address",
-                "Resolve expression to address. Returns: {expression, address}. "
-                "Supports: 'game.exe+0x1234', '[[base]+10]+20', symbol names.",
-                "get_address",
-                ToolCategory.SYMBOLS,
-                [
-                    ToolParam(
-                        "expression", "string", "Address expression to resolve", True
-                    )
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_symbol",
-                "[SYMBOL LOOKUP] Get symbol name, RTTI class info, and module details for an address. "
-                "USE WHEN: Identifying what code/data an address belongs to, checking if address is in a module. "
-                "Returns: {address, symbol, hasSymbol, rttiClassName, hasRTTI, inModule, inSystemModule, "
-                "moduleInfo: {name, base, size, offset, is64bit, path}}. "
-                "TIP: inModule=true with symbol containing '.exe+' or '.dll+' indicates a static address.",
-                "get_symbol",
-                ToolCategory.SYMBOLS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "include_module",
-                        "boolean",
-                        "Include module name in symbol",
-                        False,
-                        True,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_region_info",
-                "Get memory region info (base, size, protection)",
-                "get_region_info",
-                ToolCategory.SYMBOLS,
-                [self.ADDR_PARAM],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_auto_guess",
-                "Guess the value type at an address (byte/word/dword/qword/float/double/string/pointer). "
-                "USE WHEN: Analyzing unknown memory, determining how to read a value. "
-                "Returns: {type_id, type_name, value}. Useful for structure field analysis.",
-                "auto_guess",
-                ToolCategory.SYMBOLS,
-                [self.ADDR_PARAM],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_resolve_pointer",
-                "[VERIFICATION] Resolve a KNOWN pointer chain to get final address and optionally read value. "
-                "USE WHEN: You already have base+offsets and want to verify the chain works or read the value. "
-                "Returns CE notation like '[[game.exe+123]+10]+20' for easy copy to CE. "
-                "NOT FOR: Discovering pointer paths (use ce_find_pointer_path for discovery). "
-                "Returns: {base, offsets, final_address, ceNotation, chain: [{level, address, value, symbol}]}.",
-                "resolve_pointer",
-                ToolCategory.SYMBOLS,
-                [
-                    ToolParam("base", "string", "Base address or symbol", True),
-                    ToolParam(
-                        "offsets",
-                        "array",
-                        "Array of offsets, e.g. [0x100, 0x20, 0x8]",
-                        True,
-                    ),
-                    ToolParam(
-                        "read_value",
-                        "boolean",
-                        "Read value at final address",
-                        False,
-                        False,
-                    ),
-                    ToolParam(
-                        "value_type",
-                        "string",
-                        "Value type to read if read_value=true",
-                        False,
-                        "dword",
-                        enum=[
-                            "byte",
-                            "word",
-                            "dword",
-                            "qword",
-                            "float",
-                            "double",
-                            "pointer",
-                        ],
-                    ),
-                ],
-            )
-        )
-
-    def _register_debug_tools(self):
-        """Register debugging tools"""
-        self._register(
-            Tool(
-                "ce_disassemble",
-                "Basic disassembly - get raw instructions at an address. "
-                "USE WHEN: You just need to see assembly code (opcodes, bytes). "
-                "FOR DEEPER ANALYSIS: Use ce_analyze_code (extracts calls/jumps) or ce_build_cfg (function-level CFG). "
-                "Returns: {instructions: [{address, opcode, bytes, size}], nextAddress}.",
-                "disassemble",
-                ToolCategory.DEBUG,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam("count", "integer", "Number of instructions", False, 10),
-                    ToolParam(
-                        "direction",
-                        "string",
-                        "Disassembly direction: forward (default) or backward using getPreviousOpcode",
-                        False,
-                        "forward",
-                        enum=["forward", "backward"],
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_instruction_info",
-                "Get detailed instruction info. Returns: {address, opcode, parameters, bytes, size, isCall, isJump, isRet, isConditionalJump, readsMemory, writesMemory}.",
-                "get_instruction_info",
-                ToolCategory.DEBUG,
-                [self.ADDR_PARAM],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_set_breakpoint",
-                "Set a hardware breakpoint. Returns: {success, address, type}. Use ce_remove_breakpoint to remove.",
-                "set_breakpoint",
-                ToolCategory.DEBUG,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "type",
-                        "string",
-                        "Breakpoint type",
-                        False,
-                        "execute",
-                        enum=["execute", "write", "access"],
-                    ),
-                    ToolParam(
-                        "size",
-                        "integer",
-                        "Size in bytes for write/access breakpoints",
-                        False,
-                        1,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_remove_breakpoint",
-                "Remove a debug breakpoint",
-                "remove_breakpoint",
-                ToolCategory.DEBUG,
-                [self.ADDR_PARAM],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_breakpoints",
-                "List all active breakpoints",
-                "get_breakpoints",
-                ToolCategory.DEBUG,
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_break_and_get_regs",
-                "[SINGLE CAPTURE] Set breakpoint and capture registers ONCE when hit. "
-                "USE WHEN: You need register values at ONE specific point (function args, pointer values). "
-                "Returns all registers + call stack at breakpoint hit. "
-                "FOR MULTI-STEP: Use ce_break_and_trace to trace execution flow. "
-                "Returns: {triggered, registers: {rax-r15, rip, rflags}, callStack, returnAddress}.",
-                "break_and_get_regs",
-                ToolCategory.DEBUG,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam("timeout", "integer", "Timeout in ms", False, 5000),
-                    ToolParam(
-                        "stack_depth",
-                        "integer",
-                        "Number of stack entries to read",
-                        False,
-                        16,
-                    ),
-                    ToolParam(
-                        "include_xmm",
-                        "boolean",
-                        "Include XMM registers (SSE/AVX) for floating point analysis",
-                        False,
-                        False,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_break_and_trace",
-                "[EXECUTION TRACE] Trace code execution step-by-step from breakpoint. Most powerful debugging tool. "
-                "USE WHEN: Understanding algorithm logic, following data transformations, debugging execution flow. "
-                "Captures FULL register state at EACH instruction. "
-                "FOR SINGLE SNAPSHOT: Use ce_break_and_get_regs instead. "
-                "Returns: {steps, stop_reason, trace: [{step, address, instruction, registers}]}. "
-                "Stop reasons: 'ret', 'end_address', 'max_steps', 'timeout'.",
-                "break_and_trace",
-                ToolCategory.DEBUG,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "max_steps",
-                        "integer",
-                        "Maximum instructions to trace",
-                        False,
-                        100,
-                    ),
-                    ToolParam("timeout", "integer", "Timeout in ms", False, 10000),
-                    ToolParam(
-                        "stop_on_ret",
-                        "boolean",
-                        "Stop tracing when ret is encountered",
-                        False,
-                        True,
-                    ),
-                    ToolParam(
-                        "trace_into_call",
-                        "boolean",
-                        "Trace into call instructions (step into vs step over)",
-                        False,
-                        False,
-                    ),
-                    ToolParam(
-                        "end_address",
-                        "string",
-                        "Stop tracing when this address is reached",
-                        False,
-                    ),
-                    ToolParam(
-                        "initial_regs",
-                        "object",
-                        "Set register values at first hit. "
-                        'Example: {"rcx": "0x12345", "rdx": 100}',
-                        False,
-                        {},
-                    ),
-                ],
-            )
-        )
-
-    def _register_analysis_tools(self):
-        """Register analysis tools"""
-        self._register(
-            Tool(
-                "ce_find_what_accesses",
-                "[MANUAL POINTER TRACING - STEP 1] Find code that reads/writes an address (like CE's F5 key). "
-                "This tool monitors for 10 seconds - user must trigger memory access during this time. "
-                "USE WHEN: ce_find_pointer_path failed and you need manual pointer tracing. "
-                "Returns register values (e.g., RBX=0x12345678) showing what pointer was used to access the address. "
-                "WORKFLOW: Take register value -> ce_value_scan to find where that pointer is stored -> repeat until static base.",
-                "find_what_accesses",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "user_prompted",
-                        "boolean",
-                        "REQUIRED: Set true ONLY after you told user 'I will monitor for 10 seconds, please change the value in game NOW'. You must prompt user BEFORE calling.",
-                        True,
-                    ),
-                    ToolParam(
-                        "size", "integer", "Size to monitor (1/2/4/8 bytes)", False, 4
-                    ),
-                    ToolParam(
-                        "duration_ms",
-                        "integer",
-                        "Monitoring duration in milliseconds (default 10000 = 10 seconds)",
-                        False,
-                        10000,
-                    ),
-                    ToolParam(
-                        "max_records",
-                        "integer",
-                        "Maximum hit records before stopping",
-                        False,
-                        1000,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_find_what_writes",
-                "Find code that WRITES to an address (like CE's F6 key). Monitors writes only, ignores reads. "
-                "This tool monitors for 10 seconds - user must trigger memory write during this time. "
-                "USE WHEN: Finding what MODIFIES a value (e.g., what decreases player health). "
-                "USE ce_find_what_accesses instead if you need both reads and writes for pointer tracing.",
-                "find_what_writes",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "user_prompted",
-                        "boolean",
-                        "REQUIRED: Set true ONLY after you told user 'I will monitor for 10 seconds, please trigger a write in game NOW'. You must prompt user BEFORE calling.",
-                        True,
-                    ),
-                    ToolParam(
-                        "size", "integer", "Size to monitor (1/2/4/8 bytes)", False, 4
-                    ),
-                    ToolParam(
-                        "duration_ms",
-                        "integer",
-                        "Monitoring duration in milliseconds (default 10000 = 10 seconds)",
-                        False,
-                        10000,
-                    ),
-                    ToolParam(
-                        "max_records",
-                        "integer",
-                        "Maximum hit records before stopping",
-                        False,
-                        1000,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_analyze_code",
-                "Static analysis of code block - disassembly PLUS extracted calls, jumps, memory references. "
-                "USE WHEN: Understanding what a code section does without execution. "
-                "Returns call targets, jump destinations, memory access patterns. "
-                "FOR FUNCTION-LEVEL: Use ce_build_cfg. FOR DYNAMIC ANALYSIS: Use ce_break_and_trace. "
-                "Returns: {instructions, calls, jumps, memory_refs}.",
-                "analyze_code",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "count",
-                        "integer",
-                        "Number of instructions to analyze",
-                        False,
-                        20,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_build_cfg",
-                "Build Control Flow Graph for an entire function. "
-                "USE WHEN: Analyzing function structure, finding loops, understanding complex branching. "
-                "Returns basic blocks, edges, loop detection, cyclomatic complexity. "
-                "TIP: Use ce_find_function_boundaries first if you don't know function start address. "
-                "Returns: {entry, blocks: [{id, start, end, successors, predecessors, isLoopHeader}], edges, loops, complexity}.",
-                "build_cfg",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "max_instructions",
-                        "integer",
-                        "Maximum instructions to analyze (default 500)",
-                        False,
-                        500,
-                    ),
-                    ToolParam(
-                        "max_blocks",
-                        "integer",
-                        "Maximum basic blocks (default 100)",
-                        False,
-                        100,
-                    ),
-                    ToolParam(
-                        "detect_loops",
-                        "boolean",
-                        "Detect and annotate loop structures",
-                        False,
-                        True,
-                    ),
-                    ToolParam(
-                        "include_disasm",
-                        "boolean",
-                        "Include disassembly in each block",
-                        False,
-                        True,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_detect_patterns",
-                "[PATTERN RECOGNITION] Detect common code patterns in a function. "
-                "USE WHEN: Quick function classification, finding crypto code, detecting anti-debug, locating string usage. "
-                "Detects: switch_tables (jump tables), virtual_calls (vtable calls), string_refs (string literals), "
-                "crypto_constants (MD5/SHA/TEA/Blowfish magic numbers), anti_debug (IsDebuggerPresent/rdtsc), "
-                "comparisons (cmp/test), memory_patterns (struct field access). "
-                "Returns: {patterns: {switch_tables, virtual_calls, string_refs, crypto_constants, anti_debug, comparisons, memory_patterns}, "
-                "summary: {has_switch, has_virtual_calls, has_strings, has_crypto, has_anti_debug, unique_offsets}}.",
-                "detect_patterns",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "max_instructions",
-                        "integer",
-                        "Maximum instructions to scan",
-                        False,
-                        200,
-                    ),
-                    ToolParam(
-                        "patterns",
-                        "array",
-                        "Specific patterns to detect (omit for all)",
-                        False,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_compare_functions",
-                "Compare two functions for similarity. Returns matching blocks, differing instructions, "
-                "and similarity score. Useful for patch analysis and finding similar code.",
-                "compare_functions",
-                ToolCategory.ANALYSIS,
-                [
-                    ToolParam("address1", "string", "First function address", True),
-                    ToolParam("address2", "string", "Second function address", True),
-                    ToolParam(
-                        "max_instructions",
-                        "integer",
-                        "Max instructions per function",
-                        False,
-                        200,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_trace_dataflow",
-                "Trace how a SINGLE register's value flows through code. "
-                "USE WHEN: 'Where does RAX get its value?' or 'Where is RCX used after this?'. "
-                "Tracks ONE register only. FOR CROSS-REGISTER: Use ce_program_slice which follows data across mov/xchg. "
-                "Returns: {definitions: [where value comes from], uses: [where value goes]}.",
-                "trace_dataflow",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "register",
-                        "string",
-                        "Register to trace (e.g. 'rax', 'rcx')",
-                        True,
-                    ),
-                    ToolParam(
-                        "max_instructions",
-                        "integer",
-                        "Max instructions to analyze",
-                        False,
-                        100,
-                    ),
-                    ToolParam(
-                        "direction",
-                        "string",
-                        "Trace direction: 'forward' (uses) or 'backward' (definitions)",
-                        False,
-                        "both",
-                        enum=["forward", "backward", "both"],
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_program_slice",
-                "[ADVANCED] Compute program slice - find ALL instructions affecting a value (backward) or affected by it (forward). "
-                "USE WHEN: Understanding 'how is this value computed' across multiple registers and memory operations. "
-                "Unlike ce_trace_dataflow, follows data through register transfers (mov rax,rbx). "
-                "Essential for complex algorithm reverse engineering. "
-                "Returns: {slice_instructions, dependencies}.",
-                "program_slice",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "criterion",
-                        "string",
-                        "Slicing criterion: register name (e.g. 'rax') or memory pattern (e.g. '[rbx+10]')",
-                        True,
-                    ),
-                    ToolParam(
-                        "direction",
-                        "string",
-                        "Slice direction: 'backward' (what affects this) or 'forward' (what this affects)",
-                        False,
-                        "backward",
-                        enum=["backward", "forward"],
-                    ),
-                    ToolParam(
-                        "max_instructions",
-                        "integer",
-                        "Max instructions to analyze",
-                        False,
-                        200,
-                    ),
-                    ToolParam(
-                        "follow_calls",
-                        "boolean",
-                        "Follow into called functions (increases depth but slower)",
-                        False,
-                        False,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_analyze_struct_access",
-                "Infer structure fields by scanning memory values at an address. "
-                "USE WHEN: Analyzing object/struct layout, finding field offsets. "
-                "Scans memory range and guesses field types. "
-                "FOR DYNAMIC ANALYSIS: Use ce_trace_struct_access to see what code accesses the struct.",
-                "analyze_struct_access",
-                ToolCategory.ANALYSIS,
-                [
-                    ToolParam(
-                        "base_address", "string", self.ADDR_PARAM.description, True
-                    ),
-                    ToolParam(
-                        "scan_range", "integer", "Range to scan in bytes", False, 512
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_trace_struct_access",
-                "Dynamic trace: Monitor what code accesses a memory region. "
-                "USE WHEN: Finding which code reads/writes struct fields, understanding object usage patterns. "
-                "FOR STATIC ANALYSIS: Use ce_analyze_struct_access to infer field types from values.",
-                "trace_struct_access",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam("size", "integer", "Size to monitor", False, 4),
-                    ToolParam(
-                        "mode",
-                        "string",
-                        "Trace mode",
-                        False,
-                        "read_write",
-                        enum=["read_write", "write"],
-                    ),
-                    ToolParam(
-                        "duration_ms",
-                        "integer",
-                        "Duration in milliseconds",
-                        False,
-                        1000,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_cleanup",
-                "Force remove ALL breakpoints and traces set by MCP tools. "
-                "USE WHEN: Game frozen due to stuck breakpoint, cleaning up after analysis, resetting debug state. "
-                "Safe to call anytime - cleans up zombie resources.",
-                "cleanup_breakpoints",
-                ToolCategory.ANALYSIS,
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_find_pointer_path",
-                "[RECOMMENDED FIRST] Automatically find static pointer path to a dynamic address. "
-                "This tool monitors memory access internally for ~10 seconds per level - user must trigger access during this time. "
-                "USE WHEN: You have a dynamic address and need a stable pointer chain (base+offsets). "
-                "Returns: {success, base_address, offsets, ce_pointer_notation, steps, suggestions}. "
-                "Strategies: 'hybrid' (recommended), 'f5', 'value_scan'. "
-                "NOT FOR: Addresses already static (module+offset format).",
-                "find_pointer_path",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "user_prompted",
-                        "boolean",
-                        "REQUIRED: Set true ONLY after you told user 'I will trace pointers, please interact with the value in game NOW (change it, take damage, use feature)'. You must prompt user BEFORE calling.",
-                        True,
-                    ),
-                    ToolParam(
-                        "max_depth",
-                        "integer",
-                        "Maximum pointer chain depth (1-10)",
-                        False,
-                        7,
-                    ),
-                    ToolParam(
-                        "duration_ms",
-                        "integer",
-                        "Monitoring duration per level in ms (default 10000)",
-                        False,
-                        10000,
-                    ),
-                    ToolParam(
-                        "max_results",
-                        "integer",
-                        "Maximum candidate pointers to evaluate per level",
-                        False,
-                        10,
-                    ),
-                    ToolParam(
-                        "strategy",
-                        "string",
-                        "Search strategy: 'hybrid' (recommended, F5 + value_scan + region-based scoring), 'f5' (pure F5 method), 'value_scan' (pure pointer search)",
-                        False,
-                        "hybrid",
-                        enum=["hybrid", "f5", "value_scan"],
-                    ),
-                ],
-            )
-        )
-
-        # New reference analysis tools
-        self._register(
-            Tool(
-                "ce_find_references",
-                "Find all code locations referencing an address. Returns: {address, count, references: [{address, instruction}]}.",
-                "find_references",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "limit", "integer", "Maximum results to return", False, 50
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_find_call_references",
-                "Find all CALL instructions targeting a function (who calls this function). "
-                "USE WHEN: Understanding function usage, finding entry points, tracing call hierarchy. "
-                "Auto-detects module from target address for better performance. "
-                "Returns: {count, callers: [{address, instruction, symbol}]}.",
-                "find_call_references",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "module",
-                        "string",
-                        "Limit scan to specific module (e.g. 'game.exe'). If omitted, auto-detects from target address.",
-                    ),
-                    ToolParam(
-                        "limit", "integer", "Maximum results to return", False, 100
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_find_function_boundaries",
-                "Find function start/end by prologue/epilogue patterns. "
-                "USE WHEN: You have an address inside a function and need to find where the function starts/ends. "
-                "WORKFLOW: Use this first, then ce_build_cfg for full function analysis. "
-                "Returns: {function_start, function_end, size}.",
-                "find_function_boundaries",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "max_search",
-                        "integer",
-                        "Maximum bytes to search for boundaries",
-                        False,
-                        4096,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_checksum_memory",
-                "Calculate MD5 hash of a memory region. Useful for detecting code modifications.",
-                "checksum_memory",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam("size", "integer", "Number of bytes to hash", False, 256),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_generate_signature",
-                "Generate unique AOB signature for code at an address. "
-                "USE WHEN: Creating version-independent scripts, documenting code locations for future game updates. "
-                "WORKFLOW: Generate signature here -> after game update, use ce_aob_scan to relocate. "
-                "Returns: {address, signature, mask, unique}.",
-                "generate_signature",
-                ToolCategory.ANALYSIS,
-                [self.ADDR_PARAM],
-            )
-        )
-
-        self._register_hook_tools()
-
-    def _register_hook_tools(self):
-        """Register function hooking tools"""
-        self._register(
-            Tool(
-                "ce_hook_function",
-                "[NON-BLOCKING] Hook a function to intercept calls and capture arguments automatically. "
-                "USE WHEN: Monitoring function calls without stopping execution (e.g., logging all damage events). "
-                "Captures first 4 args: x64 uses RCX/RDX/R8/R9, x32 uses stack. "
-                "WORKFLOW: ce_hook_function -> let game run -> ce_get_hook_log to retrieve captured data. "
-                "FOR SINGLE CAPTURE: Use ce_break_and_get_regs instead.",
-                "hook_function",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam("name", "string", "Hook identifier name", True),
-                    ToolParam(
-                        "capture_args",
-                        "integer",
-                        "Number of arguments to capture (0-4, default 4)",
-                        False,
-                        4,
-                    ),
-                    ToolParam(
-                        "capture_return",
-                        "boolean",
-                        "Reserved for future use (not implemented)",
-                        False,
-                        True,
-                    ),
-                    ToolParam(
-                        "max_records",
-                        "integer",
-                        "Fixed at 64 (circular buffer)",
-                        False,
-                        64,
-                    ),
-                    ToolParam(
-                        "calling_convention",
-                        "string",
-                        "Calling convention hint",
-                        False,
-                        "auto",
-                        enum=["auto", "fastcall", "stdcall", "cdecl"],
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_unhook_function",
-                "Remove a function hook by name and restore original code. "
-                "Call this when finished analyzing to clean up resources and free memory.",
-                "unhook_function",
-                ToolCategory.ANALYSIS,
-                [ToolParam("name", "string", "Hook identifier name", True)],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_list_hooks",
-                "List all active function hooks with their status and call counts. "
-                "Use to check which hooks are currently installed before adding new ones.",
-                "list_hooks",
-                ToolCategory.ANALYSIS,
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_get_hook_log",
-                "Get captured function call arguments. Returns entries with args[1-4] containing: "
-                "x64: RCX(this/arg1), RDX(arg2), R8(arg3), R9(arg4); "
-                "x32: stack params [esp+10/14/18/1C]. "
-                "Values are hex addresses/integers. total_calls shows how many times function was called.",
-                "get_hook_log",
-                ToolCategory.ANALYSIS,
-                [
-                    ToolParam("name", "string", "Hook identifier name", True),
-                    ToolParam(
-                        "clear", "boolean", "Clear log after reading", False, False
-                    ),
-                    ToolParam(
-                        "limit",
-                        "integer",
-                        "Max records to return (1-64, default 50)",
-                        False,
-                        50,
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_clear_hook_log",
-                "Clear the call log and reset total_calls counter for a hook. "
-                "Use when: 1) Starting fresh measurement, 2) Log buffer full (64 entries max), "
-                "3) Want to count calls from a specific point. Omit name to clear all hooks.",
-                "clear_hook_log",
-                ToolCategory.ANALYSIS,
-                [ToolParam("name", "string", "Hook name (omit to clear all)")],
-            )
-        )
-
-        self._register_emulation_tools()
-
-    def _register_emulation_tools(self):
-        """Register code emulation and symbolic execution tools"""
-        self._register(
-            Tool(
-                "ce_call_function",
-                "[DANGEROUS] Call a function in target process - EXECUTES REAL CODE! "
-                "USE WHEN: Testing function behavior, calling game functions programmatically. "
-                "Uses x64 fastcall (RCX, RDX, R8, R9). May crash game if used incorrectly. "
-                "Returns: {success, return_value, return_type}.",
-                "call_function",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "args",
-                        "array",
-                        "Function arguments (up to 4 for fastcall). Can be integers or address expressions.",
-                        False,
-                        [],
-                    ),
-                    ToolParam(
-                        "timeout", "integer", "Timeout in milliseconds", False, 5000
-                    ),
-                    ToolParam(
-                        "return_type",
-                        "string",
-                        "How to interpret return value",
-                        False,
-                        "qword",
-                        enum=[
-                            "byte",
-                            "word",
-                            "dword",
-                            "qword",
-                            "float",
-                            "double",
-                            "pointer",
-                        ],
-                    ),
-                ],
-            )
-        )
-
-        self._register(
-            Tool(
-                "ce_symbolic_trace",
-                "[NO EXECUTION] Lightweight symbolic execution - interprets instructions WITHOUT running them. "
-                "USE WHEN: Understanding code logic safely, analyzing potentially dangerous code, static algorithm analysis. "
-                "Produces readable expressions like 'rax = ((arg0 + 5) << 2)'. "
-                "Supports: mov, movzx, movsxd, lea, add, sub, xor, and, or, shl, shr, imul, cmp, test, cmovxx. "
-                "FOR ACTUAL EXECUTION: Use ce_break_and_trace instead. "
-                "Returns: {trace: [{address, instruction, effects}], final_state: {reg: expression}, stop_reason}.",
-                "symbolic_trace",
-                ToolCategory.ANALYSIS,
-                [
-                    self.ADDR_PARAM,
-                    ToolParam(
-                        "count", "integer", "Number of instructions to trace", False, 30
-                    ),
-                    ToolParam(
-                        "initial_state",
-                        "object",
-                        "Initial register values as symbols or concrete values. "
-                        'Example: {"rcx": "this_ptr", "rdx": "arg1", "r8": 0}',
-                        False,
-                        {},
-                    ),
-                    ToolParam(
-                        "stop_on_call",
-                        "boolean",
-                        "Stop tracing when encountering a call instruction",
-                        False,
-                        True,
-                    ),
-                    ToolParam(
-                        "stop_on_ret",
-                        "boolean",
-                        "Stop tracing when encountering a ret instruction",
-                        False,
-                        True,
-                    ),
-                    ToolParam(
-                        "simplify",
-                        "boolean",
-                        "Simplify expressions (e.g., x^x=0, x+0=x)",
-                        False,
-                        True,
-                    ),
-                ],
-            )
-        )
-
-    def get_tool(self, name: str) -> Optional[Tool]:
-        """Get tool by name"""
-        return self.tools.get(name)
-
-    def get_all_schemas(self) -> List[dict]:
-        """Get all tool schemas for MCP"""
-        return [tool.to_mcp_schema() for tool in self.tools.values()]
-
-    def get_lua_command(self, tool_name: str) -> Optional[str]:
-        """Get Lua command for a tool"""
-        tool = self.tools.get(tool_name)
-        return tool.lua_command if tool else None
-
-
-# ============ MCP Server ============
-class CEMCPServer:
-    """Main MCP Server implementation"""
-
-    def __init__(self):
-        self.pipe_client = PipeClient()
-        self.pipe_client.start_background_reconnect()  # Always run background reconnect
-        self.tool_registry = ToolRegistry()
-        self.timeout_manager = TimeoutManager()
-        self.metrics_collector = MetricsCollector()
-        self.request_count = 0
-
-    def _diagnose_connection(self) -> dict:
-        """Diagnose connection issues without requiring CE connection"""
-        import subprocess
-
-        checks = []
-        suggestions = []
-        all_passed = True
-
-        # Check 1: Pipe existence
-        pipe_exists = False
-        try:
-            test_pipe = win32file.CreateFile(
-                self.pipe_client.pipe_name,
-                win32file.GENERIC_READ | win32file.GENERIC_WRITE,
-                0,
-                None,
-                win32file.OPEN_EXISTING,
-                0,
-                None,
-            )
-            win32file.CloseHandle(test_pipe)
-            pipe_exists = True
-            checks.append(
-                {
-                    "name": "pipe_exists",
-                    "passed": True,
-                    "message": f"Pipe '{Config.PIPE_NAME}' available",
-                }
-            )
-        except pywintypes.error as e:
-            all_passed = False
-            if e.winerror == winerror.ERROR_FILE_NOT_FOUND:
-                checks.append(
-                    {
-                        "name": "pipe_exists",
-                        "passed": False,
-                        "message": "Pipe not found - CE bridge not running",
-                    }
-                )
-                suggestions.extend(
-                    [
-                        "1. Open Cheat Engine",
-                        "2. Table -> Show Cheat Table Lua Script",
-                        "3. Paste ce_mcp_bridge.lua content and Execute",
-                        "4. Look for '[CheatEngine-MCP] Bridge started' message",
-                    ]
-                )
-            elif e.winerror == winerror.ERROR_PIPE_BUSY:
-                checks.append(
-                    {
-                        "name": "pipe_exists",
-                        "passed": True,
-                        "message": "Pipe busy - another client connected",
-                    }
-                )
-                suggestions.append("Close other MCP connections first")
-            elif e.winerror == winerror.ERROR_ACCESS_DENIED:
-                checks.append(
-                    {"name": "pipe_exists", "passed": False, "message": "Access denied"}
-                )
-                suggestions.append("Try running with administrator privileges")
-            else:
-                checks.append(
-                    {
-                        "name": "pipe_exists",
-                        "passed": False,
-                        "message": f"Pipe error: {e}",
-                    }
-                )
-
-        # Check 2: CE process
-        try:
-            result = subprocess.run(
-                ["tasklist", "/FI", "IMAGENAME eq cheatengine*", "/FO", "CSV", "/NH"],
-                capture_output=True,
-                text=True,
-                timeout=5,
-            )
-            ce_running = "cheatengine" in result.stdout.lower()
-            if ce_running:
-                checks.append(
-                    {
-                        "name": "ce_process",
-                        "passed": True,
-                        "message": "Cheat Engine is running",
-                    }
-                )
-            else:
-                all_passed = False
-                checks.append(
-                    {
-                        "name": "ce_process",
-                        "passed": False,
-                        "message": "Cheat Engine not found",
-                    }
-                )
-                suggestions.insert(0, "Start Cheat Engine first!")
-        except Exception as e:
-            checks.append(
-                {
-                    "name": "ce_process",
-                    "passed": None,
-                    "message": f"Could not check: {e}",
-                }
-            )
-
-        # Check 3: Custom pipe name
-        custom_pipe = os.environ.get("CE_MCP_PIPE_NAME")
-        if custom_pipe:
-            checks.append(
-                {
-                    "name": "custom_pipe",
-                    "passed": None,
-                    "message": f"Using custom pipe: {custom_pipe}",
-                }
-            )
-            suggestions.append(f"Ensure CE Lua also uses pipe name: {custom_pipe}")
-
-        return {
-            "status": "ok" if (all_passed and pipe_exists) else "failed",
-            "pipe_name": Config.PIPE_NAME,
-            "checks": checks,
-            "suggestions": suggestions or ["Connection should work - try again"],
-        }
-
-    def execute_tool(self, name: str, args: dict) -> dict:
-        """Execute a tool by sending command to Lua bridge
-
-        Uses TimeoutManager for tool-specific timeouts.
-        Uses MetricsCollector to record call metrics.
-
-        **Validates: Requirements 2.1, 2.2, 2.3, 2.4, 4.4**
-        """
-        lua_cmd = self.tool_registry.get_lua_command(name)
-        if not lua_cmd:
-            return {"error": f"Unknown tool: {name}"}
-
-        timeout_seconds = self.timeout_manager.get_timeout(name)
-        timeout_ms = timeout_seconds * 1000
-        start_time = time.time()
-
-        response = self.pipe_client.send_receive(
-            {"command": lua_cmd, "params": args}, timeout=timeout_ms, tool_name=name
-        )
-
-        duration = time.time() - start_time
-        is_error = "error" in response
-        self.metrics_collector.record_call(name, duration, is_error)
-
-        if is_error:
-            # For ce_ping, return diagnostic info on connection failure
-            if name == "ce_ping":
-                diag = self._diagnose_connection()
-                return {"error": response["error"], "diagnostic": diag}
-            if "timeout_info" in response:
-                return {
-                    "error": response["error"],
-                    "timeout_info": response["timeout_info"],
-                }
-            return {"error": response["error"]}
-
-        result = response.get("result", response)
-
-        # Attach health and server metrics to ce_ping response
-        if name == "ce_ping":
-            health_metrics = self.pipe_client.get_health_metrics()
-            server_metrics = self.metrics_collector.get_summary()
-            if isinstance(result, dict):
-                result["connection_health"] = health_metrics
-                result["server_metrics"] = server_metrics
-            else:
-                result = {
-                    "result": result,
-                    "connection_health": health_metrics,
-                    "server_metrics": server_metrics,
-                }
-
-        return result
-
-    def handle_request(self, req: dict) -> Optional[dict]:
-        """Handle incoming MCP request"""
-        method = req.get("method", "")
-        req_id = req.get("id")
-        params = req.get("params", {})
-
-        if method == "initialize":
-            return self._handle_initialize(req_id)
-        elif method == "notifications/initialized":
-            return None
-        elif method == "tools/list":
-            return self._handle_tools_list(req_id)
-        elif method == "tools/call":
-            return self._handle_tools_call(req_id, params)
-        else:
-            return self._error_response(req_id, -32601, f"Method not found: {method}")
-
-    def _handle_initialize(self, req_id) -> dict:
-        """Handle initialize request"""
-        return {
-            "jsonrpc": "2.0",
-            "id": req_id,
-            "result": {
-                "protocolVersion": "2024-11-05",
-                "capabilities": {"tools": {}},
-                "serverInfo": {"name": "cheatengine-mcp-bridge", "version": "5.8.13"},
-                "instructions": (
-                    "# Cheat Engine MCP - AI Usage Guide\n\n"
-                    "## Tool Selection Decision Tree\n\n"
-                    "### Q: Do I know the address?\n"
-                    "- NO, but can observe value changes -> ce_scan_new workflow (value hunting)\n"
-                    "- YES, need stable pointer -> ce_find_pointer_path (auto) or manual F5+value_scan\n"
-                    "- YES, want to read/write -> ce_read_memory / ce_write_memory\n\n"
-                    "### Q: What am I searching for?\n"
-                    "- Game values (health, gold) -> ce_scan_new (NOT ce_value_scan!)\n"
-                    "- Code signatures -> ce_aob_scan (supports ?? wildcards)\n"
-                    "- Pointer storage locations -> ce_value_scan (after getting register value from F5)\n\n"
-                    "### Q: How to analyze code?\n"
-                    "- View execution flow -> ce_break_and_trace (dynamic, real execution)\n"
-                    "- Safely understand algorithm -> ce_symbolic_trace (static, no execution)\n"
-                    "- Function structure -> ce_build_cfg + ce_detect_patterns\n\n"
-                    "## Workflow Templates\n\n"
-                    "### 1. Value Hunting (find unknown address)\n"
-                    "1. ce_attach_process(target='game.exe')\n"
-                    "2. ce_scan_new(value='100', type='dword') -> returns session_id\n"
-                    "3. [Take damage in game, health becomes 95]\n"
-                    "4. ce_scan_next(session_id, value='95', scan_type='exact') -> count decreases\n"
-                    "5. Repeat steps 3-4 until count < 10\n"
-                    "6. ce_scan_results(session_id) -> get candidate addresses\n"
-                    "7. ce_read_memory(address, type='dword') -> verify correct address\n"
-                    "8. ce_scan_close(session_id) -> release resources (max 5 concurrent!)\n\n"
-                    "### 2. Pointer Tracing (make address stable)\n"
-                    "Method A (auto, try first): ce_find_pointer_path(address='0x12345678')\n"
-                    "Method B (manual, if A fails):\n"
-                    "1. ce_find_what_accesses(address='0x12345678', duration_ms=10000)\n"
-                    "2. Get register value from result (e.g., RBX=0x255D5E758)\n"
-                    "3. ce_value_scan(value='0x255D5E758', type='qword')\n"
-                    "4. Find result with isStatic=true -> that's your base pointer!\n\n"
-                    "### 3. Function Monitoring (non-blocking)\n"
-                    "1. ce_hook_function(address='game.exe+12345', name='damageHook')\n"
-                    "2. [Let game run, trigger events]\n"
-                    "3. ce_get_hook_log(name='damageHook') -> captured args (x64: RCX,RDX,R8,R9)\n"
-                    "4. ce_unhook_function(name='damageHook') -> cleanup when done\n\n"
-                    "## Tool Comparison (Correct vs Wrong)\n"
-                    "| Purpose | Correct | Wrong |\n"
-                    "| Find game values | ce_scan_new | ce_value_scan |\n"
-                    "| Find code signature | ce_aob_scan | ce_scan_new |\n"
-                    "| Batch read memory | ce_read_memory_batch | multiple ce_read_memory |\n"
-                    "| Monitor function | ce_hook_function | ce_break_and_get_regs |\n\n"
-                    "## System Limits\n"
-                    "- Scan sessions: max 5 (auto-expire after 5 min inactivity)\n"
-                    "- Hardware breakpoints: max 4 (shared by F5/F6/trace)\n"
-                    "- Hook buffer: 64 records (circular, oldest overwritten when full)\n"
-                    "- Pointer depth: max 10 levels\n"
-                    "- Message size: 10MB per request/response\n\n"
-                    "## Common Errors\n"
-                    "- 'Process not attached' -> call ce_attach_process first\n"
-                    "- 'Too many scan sessions' -> ce_scan_list() then ce_scan_close()\n"
-                    "- 'Hardware breakpoint limit' -> ce_cleanup() to clear all\n"
-                    "- 'Hook name already exists' -> ce_unhook_function(name) first"
-                ),
-            },
-        }
-
-    def _handle_tools_list(self, req_id) -> dict:
-        """Handle tools/list request"""
-        return {
-            "jsonrpc": "2.0",
-            "id": req_id,
-            "result": {"tools": self.tool_registry.get_all_schemas()},
-        }
-
-    def _handle_tools_call(self, req_id, params: dict) -> dict:
-        """Handle tools/call request"""
-        tool_name = params.get("name", "")
-        tool_args = params.get("arguments", {})
-
-        try:
-            result = self.execute_tool(tool_name, tool_args)
-
-            # Check if error: has error field, success=false, and no partial results
-            # For tools like resolve_pointer, return partial results even on failure
-            is_error = False
-            if isinstance(result, dict) and "error" in result:
-                has_partial_result = any(
-                    k in result
-                    for k in ["chain", "path", "partialCENotation", "finalAddress"]
-                )
-                is_error = result.get("success") == False and not has_partial_result
-
-            text = (
-                f"Error: {result['error']}"
-                if is_error
-                else json.dumps(result, ensure_ascii=False, indent=2)
-            )
-
-            return {
-                "jsonrpc": "2.0",
-                "id": req_id,
-                "result": {
-                    "content": [{"type": "text", "text": text}],
-                    "isError": is_error,
-                },
-            }
-        except Exception as e:
-            return self._error_response(req_id, -32603, str(e))
-
-    def _error_response(self, req_id, code: int, message: str) -> dict:
-        """Create error response"""
-        return {
-            "jsonrpc": "2.0",
-            "id": req_id,
-            "error": {"code": code, "message": message},
-        }
-
-    def run(self):
-        """Main server loop"""
-        log.info(f"Cheat Engine MCP Bridge Started. Waiting for input...")
-        log.info(f"Python version: {sys.version}")
-
-        try:
-            while True:
-                line = sys.stdin.readline()
-                if not line:
-                    break
-
-                self.request_count += 1
-
-                try:
-                    request = json.loads(line)
-                    response = self.handle_request(request)
-                    if response:
-                        sys.stdout.write(json.dumps(response) + "\n")
-                        sys.stdout.flush()
-                except json.JSONDecodeError as e:
-                    log.error(f"Failed to decode JSON: {e}")
-                except Exception as e:
-                    log.error(
-                        f"Critical Error (request #{self.request_count}): {traceback.format_exc()}"
-                    )
-
-        except KeyboardInterrupt:
-            log.info("Received interrupt signal")
-        finally:
-            self.pipe_client.stop()
-            log.info(f"Server Stopped (processed {self.request_count} requests)")
-
-
-# ============ Entry Point ============
-def main():
-    server = CEMCPServer()
-    server.run()
-
-
-if __name__ == "__main__":
-    main()