Use it from an agent

A typical session:

1. load_binary
2. borer://triage (what the file is, how it is protected, where to start)
3. find_function_by_string, strings or symbols
4. function_summary, then decompile
5. xrefs, cfg or callgraph to go wider

Any address argument takes 0x hex, decimal, or a name.

Area	Tools
Load	load_binary, binary_info, fetch_pdb, reload
Find	functions, function, symbols, strings, search, find_function_by_string, find_crypto_constants, entropy
Read code	function_summary, function_strings, decompile, decompile_batch, disassemble, disassemble_function, cfg, callgraph, reaches, xrefs, class_layout
Read data	read, hexdump
Annotate	set_name, set_comment, set_type, types, annotations, save_project, load_project
Live process	live_attach, live_detach, live_modules, live_read, live_object, live_instances, live_watch
Anything else	query, script

Deeper analyses are borer:// resources: taint, struct layout, emulation, input solving, unpacking, flattening, VM dispatch, devirtualization, binary diff, stack strings, decoded strings and IOCs. borer://help lists all of them. A client without resource support passes the same URI to query.