In-depth architectural comparison of the MCP Dolphin and MCP Bizhawk MCP servers. Compare execution transports, security boundaries, tool capabilities, quality scores, and ready-to-paste client installation snippets for Claude, Cursor, Windsurf, and VS Code.
At a Glance & Executive Verdict
MCP Dolphin
Gaming · Local stdio
Quality: 63/100 (Good) | Auth: No auth required
MCP Bizhawk
Gaming · Local stdio
Quality: 61/100 (Good) | Auth: No auth required
Verdict Summary: Choose MCP Dolphin if you need specialized Gaming tools running via a local process. Choose MCP Bizhawk if your workspace requires Gaming integration with local subprocess execution. Both servers can be configured concurrently in your client's mcpServers manifest.
Which MCP Server Should You Choose?
Choose MCP Dolphin when:
You need dedicated capabilities in the Gaming domain.
You prefer local stdio subprocess transport architecture.
Your security boundary fits: No auth required (Free / Open Source).
You have access to required keys: DOLPHIN_BRIDGE_HOST, DOLPHIN_BRIDGE_PORT, DOLPHIN_TIMEOUT_MS, MCP_DOLPHIN_DEBUG.
Drive the Dolphin GameCube/Wii emulator from any MCP client: read/write PowerPC memory (MEM1/MEM2), GameCube + Wii Remote input (buttons, IR pointer, accelerometer, MotionPlus), reset, save/load state, and frame advance. Python bridge inside Felk's scripting fork + Node MCP server.
Drive the BizHawk multi-system emulator from any MCP client. Memory r/w across named domains, joypad input, frame-advance, screenshot, save/load state. One bridge unlocks NES, SNES, GB/GBC/GBA, Genesis, N64, PSX, Saturn, and more.
Category & Scope
Tools & Capabilities Breakdown
MCP Dolphin Tools (21)
dolphin_ping
PURPOSE: Verify the Dolphin Python bridge is reachable and responding. USAGE: Call once at session start before other tool calls. Issues the bridge's `bridge.ping` method — doubles as a liveness probe and bridge-version sniff. BEHAVIOR: No side effects. mcp-dolphin connects to the bridge on demand (TCP 127.0.0.1:55355 by default). The bridge must be loaded inside Dolphin via Scripting → Add New Script → mcp_bridge.py. 10-second timeout if the bridge isn't running, Dolphin isn't running, or the port is wrong. RETURNS: Single line 'OK — bridge vBRIDGE_VERSION (DOLPHIN_LABEL)'.
dolphin_get_info
PURPOSE: Report what the bridge knows about its environment (bridge version, Dolphin label). v0.1.0 doesn't query game metadata — Felk's API doesn't expose disc ID / title directly, those have to be read from OS_GLOBALS at 0x80000020 yourself via dolphin_read_range. USAGE: Diagnostic. For game state, use dolphin_read_range(0x80000000, 32) and decode: bytes 0-3 are the disc ID (4-char ASCII), 4-5 are maker code, 6 is disc number, 7 is disc version. BEHAVIOR: No side effects. Same underlying call as dolphin_ping but presents fields explicitly. RETURNS: Multi-line text — Bridge version, Dolphin label.
dolphin_read8
PURPOSE: Read an unsigned 8-bit byte from PowerPC memory at the given absolute address. USAGE: Use for single-byte fields — flags, counters, small enums. For 16/32/64-bit values use dolphin_read16/read32/read64. For spans of more than ~4 bytes use dolphin_read_range. PowerPC is big-endian — so for multi-byte values you almost always want the dedicated width tool, not this one. BEHAVIOR: No side effects — pure read. No alignment requirement. Returns an error on unmapped address, bridge disconnect, or bridge FAIL.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: Single line 'ADDR_HEX: VAL_DEC (0xVAL_HEX)', e.g. '0x80003000: 99 (0x63)'.
Ready-to-Paste Client Configurations
Paste either (or both) of these JSON server blocks into your client config file (e.g. claude_desktop_config.json or ~/.cursor/mcp.json).
MCP Dolphin is categorized under Gaming and uses a local stdio subprocess. In contrast, MCP Bizhawk belongs to Gaming using local stdio subprocess. Select MCP Dolphin when you need capabilities focused on gaming and MCP Bizhawk when you require tools for gaming.
PURPOSE: Read an unsigned 16-bit big-endian value from PowerPC memory at the given absolute address. USAGE: For 16-bit fields — HP, score, coordinates on many GC/Wii titles. For single bytes use dolphin_read8; for 32/64-bit use dolphin_read32/read64. Value is interpreted big-endian (PowerPC native); the byte at `address` is the high byte. BEHAVIOR: No side effects — pure read. Address MUST be 2-byte aligned. Returns an error on unmapped address, bridge disconnect, or FAIL.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: Single line 'ADDR_HEX: VAL_DEC (0xVAL_HEX)'.
dolphin_read32
PURPOSE: Read an unsigned 32-bit big-endian value from PowerPC memory at the given absolute address. USAGE: The workhorse — most game state and pointers are 32-bit. Use for timestamps, large counters, RGBA colors, full pointers (PowerPC is a 32-bit ISA so pointers fit here). For 8/16/64-bit values use the corresponding sibling. BEHAVIOR: No side effects — pure read. Address MUST be 4-byte aligned. Returns an error on unmapped address, bridge disconnect, or FAIL.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: Single line 'ADDR_HEX: VAL_DEC (0xVAL_HEX)'.
dolphin_read64
PURPOSE: Read an unsigned 64-bit big-endian value from PowerPC memory at the given absolute address. USAGE: For paired 32-bit slots, doubles, packed flags. PowerPC is 32-bit so true 64-bit fields are less common than on PS2 — usually game state is 32-bit. Use this when you actually have a 64-bit field, not as a convenience for two 32-bit reads. BEHAVIOR: No side effects — pure read. Address MUST be 8-byte aligned. The result is returned as a decimal STRING (not a JSON number) to preserve precision past 2^53. Returns an error on unmapped address, bridge disconnect, or FAIL.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: Single line 'ADDR_HEX: VAL_DEC (0xVAL_HEX)' — VAL_DEC is a decimal string that may exceed 2^53.
dolphin_read_range
PURPOSE: Read a contiguous range of bytes from PowerPC memory as a hex dump. USAGE: For >4 bytes — far cheaper than looping dolphin_read8 (one bridge round-trip vs N). Max 65536 bytes/call; chunk larger reads in 64 KiB. Powers snapshot-diff RAM hunting, unknown-struct inspection, and region capture. BEHAVIOR: No side effects. The bridge reads byte-by-byte via Felk's memory.read_u8 then returns hex over the wire. No alignment requirement.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: 'ADDR_HEX [N bytes]:' header + space-separated 2-digit uppercase hex bytes.
dolphin_write8
PURPOSE: Write a single unsigned byte (0-255) to PowerPC memory at the given absolute address. USAGE: Use for single-byte cheats, debug pokes, and game-state mutations. For 16/32/64-bit values prefer dolphin_write16/write32/write64 (atomic from the game's perspective). To roll back, dolphin_save_state BEFORE the write and dolphin_load_state to restore. BEHAVIOR: DESTRUCTIVE: overwrites with no undo. Direct memory access — bypasses PowerPC MMU translation and any DMA semantics. Writes to read-only regions (boot ROM at 0xFFF00000, certain I/O ranges) are silently dropped by Dolphin. The write takes effect immediately, but visible effects appear only when the emulator next ticks. No alignment requirement for byte access.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: 'Wrote VAL_DEC (0xVAL_HEX) → ADDR_HEX'.
dolphin_write16
PURPOSE: Write an unsigned 16-bit big-endian value to PowerPC memory. USAGE: For 16-bit cheats/pokes (HP, score, coordinates). For single bytes use dolphin_write8; for 32/64-bit use dolphin_write32/write64. The value is byte-swapped to big-endian by Felk's bridge — pass the value the game logically sees, not its byte order. BEHAVIOR: DESTRUCTIVE: overwrites two bytes with no undo. Address MUST be 2-byte aligned. Returns an error on bridge disconnect or FAIL.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: 'Wrote VAL_DEC (0xVAL_HEX) → ADDR_HEX'.
dolphin_write32
PURPOSE: Write an unsigned 32-bit big-endian value to PowerPC memory at the given absolute address. USAGE: The workhorse for cheats — most game state is 32-bit. For 8/16-bit values use dolphin_write8/write16; for true 64-bit fields use dolphin_write64 (atomic, vs two non-atomic write32s). For floats, reinterpret the IEEE-754 bits as an integer first. BEHAVIOR: DESTRUCTIVE: overwrites four bytes with no undo. Address MUST be 4-byte aligned. Writes to read-only regions are silently dropped.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: 'Wrote VAL_DEC (0xVAL_HEX) → ADDR_HEX'.
dolphin_write64
PURPOSE: Write an unsigned 64-bit big-endian value to PowerPC memory. USAGE: For paired 32-bit slots, doubles, packed flags. Atomic from the game's perspective; preferred over chaining two write32s when ordering matters. BEHAVIOR: DESTRUCTIVE: overwrites eight bytes with no undo. Address MUST be 8-byte aligned. `value` is a DECIMAL STRING (0..18446744073709551615) to preserve precision past JS's 2^53 number limit.
GameCube + Wii main address space landmarks (PowerPC, big-endian):
0x80000000-0x817FFFFF MEM1 main RAM (24 MiB) — GameCube + Wii game code & data
GameCube games stay entirely within MEM1.
Wii games use MEM1 for code and frequently-accessed data.
0x80000020 OS_GLOBALS — game-info struct (disc ID, FST, etc.)
0x80000034 OS_ARENA_LO (start of free MEM1 heap)
0x80003100 OS_REPORT (developer-console mirror, varies by SDK)
0x90000000-0x93FFFFFF MEM2 (64 MiB) — Wii ONLY. Larger texture/asset data,
IOS work areas. Reading MEM2 on a GameCube game
returns garbage / FAIL.
0xCC000000-0xCC00FFFF Hollywood I/O (Wii) / Flipper I/O (GameCube) — DMA,
GPU FIFO, AI, EXI registers. Reads are usually safe,
writes can wedge the emulator. Avoid.
0xCD000000-0xCD007FFF Wii-only Hollywood registers.
Notes:
• All multi-byte values are BIG-ENDIAN on the real hardware. Felk's
memory.read_u*/write_u* helpers handle the byte swap for you —
the value you see is the value the game sees as a u32.
• Addresses are 32-bit; Felk truncates the high bits of any u64
address argument.
• Pointers in MEM1 are often stored as 4-byte addresses with the
high bit set (e.g. 0x81234567). Dereferencing them requires no
masking — pass the raw value back into memory.read_*.
RETURNS: 'Wrote VAL_DEC (0xVAL_HEX) → ADDR_HEX'.
dolphin_press_gc_buttons
PURPOSE: Set GameCube controller state on a given port for one frame's worth of input. USAGE: Buttons supported: A, B, X, Y, Z, Start, L, R, Up, Down, Left, Right. Analog axes: StickX, StickY, CStickX, CStickY, TriggerLeft, TriggerRight. To 'hold' a button across multiple frames, call repeatedly — Dolphin's input is per-frame, not edge-triggered, so a button you don't include in this call's state is implicitly released. For TAS-style frame-perfect sequences, alternate set + dolphin_frame_advance(1) calls. BEHAVIOR: DESTRUCTIVE to controller state for the addressed port. Overwrites all input — anything you don't include is released. Felk's set_gc_buttons accepts a partial dict; unspecified buttons are false, unspecified analog axes are at neutral (0 for both sticks and triggers). RETURNS: 'Set GC port N: <state-summary>'.
+9 more tools listed on main page
MCP Bizhawk Tools (22)
bizhawk_ping
PURPOSE: Verify that the BizHawk Lua bridge is connected and responding to RPC over the TCP socket. USAGE: Call this once at start-of-session before issuing other tool calls; if it succeeds, every other tool will work. BEHAVIOR: No side effects — pure liveness probe. Times out after ~10 seconds with a clear error if BizHawk isn't running, isn't pointed at the right host:port, or hasn't loaded lua/bridge.lua via Tools → Lua Console. RETURNS: The literal string 'pong' on success.
bizhawk_get_info
PURPOSE: Get the loaded ROM's name and hash, current frame count, the list of available memory domains, the active default domain (the one used when 'domain' is omitted on read/write tool calls), and the bridge's capability map (which optional emu/client/savestate/joypad/memory methods this BizHawk build exposes). USAGE: Call after bizhawk_ping to learn what system is loaded and which optional features are available; before any memory tool call to confirm the active domain and avoid silent reads from the wrong address space; before pause / unpause / reset / screenshot / save_state to check the corresponding `capabilities.*` flag. BEHAVIOR: No side effects — pure read of emulator metadata. Returns 'unavailable' for fields the loaded core doesn't expose (rom_name when no ROM is loaded, framecount on cores without emu.framecount, etc.). RETURNS: Multi-line text with ROM, ROM hash, framecount, memory_domains list, active domain, and a list of any missing capabilities for this build.
bizhawk_list_memory_domains
PURPOSE: List the memory domains available on the loaded core (e.g. 'WRAM', 'CARTRAM', 'VRAM', 'System Bus' on SNES; 'RAM', 'PPU', 'OAM' on NES). USAGE: Call before any memory r/w tool when you don't know the domain layout for the loaded system. The returned names are exactly what to pass as the `domain` parameter on bizhawk_read*/write* tools (case-sensitive). BEHAVIOR: No side effects — pure read. Returns an error if the loaded BizHawk core doesn't implement memory.getmemorydomainlist (extremely rare). RETURNS: Newline-formatted list of domain names, one per line.
bizhawk_read8
PURPOSE: Read an unsigned 8-bit byte from emulator memory at the given address. USAGE: Use for single-byte status flags, counters, and 8-bit fields. For 16- or 32-bit values use bizhawk_read16/read32 (one call instead of multi-byte assembly); for spans of more than ~4 bytes use bizhawk_read_range (one round-trip instead of N frame-latency hops). BEHAVIOR: No side effects — pure read. Reads work the same way whether emulation is paused or running. Returns an error if the named domain doesn't exist, the address is out of range for the domain, or the loaded core doesn't expose memory.read_u8. RETURNS: Single line 'ADDR_HEX: VAL_DEC (0xVAL_HEX)', e.g. '0x09C6: 99 (0x63)'.
bizhawk_read16
PURPOSE: Read an unsigned 16-bit little-endian value from emulator memory at the given address. USAGE: Use for 16-bit fields (most game-state values: HP, score, coordinates). For single bytes use bizhawk_read8; for 32-bit values use bizhawk_read32; for non-aligned spans or big-endian fields use bizhawk_read_range and decode the bytes yourself (this tool always interprets bytes as little-endian regardless of the target system's native endianness). BEHAVIOR: No side effects — pure read. Reads two consecutive bytes (low byte at `address`, high byte at `address+1`) and combines them as little-endian. Returns an error if the named domain doesn't exist, address+2 exceeds domain size, or the core doesn't expose memory.read_u16_le. RETURNS: Single line 'ADDR_HEX: VAL_DEC (0xVAL_HEX)'.
bizhawk_read32
PURPOSE: Read an unsigned 32-bit little-endian value from emulator memory at the given address. USAGE: Use for 32-bit fields (timestamps, large counters, pointers on 32-bit systems, RGBA colors). For 8/16-bit reads use bizhawk_read8/read16; for big-endian or unaligned multi-word reads use bizhawk_read_range and decode yourself. BEHAVIOR: No side effects — pure read. Reads four consecutive bytes starting at `address` and combines them as little-endian (LSB at `address`, MSB at `address+3`). Returns an error if the domain doesn't exist, address+4 exceeds the domain, or the core lacks memory.read_u32_le. RETURNS: Single line 'ADDR_HEX: VAL_DEC (0xVAL_HEX)'.
bizhawk_read_range
PURPOSE: Read a contiguous range of bytes from emulator memory as a hex dump. USAGE: Use for >4 bytes (one round-trip vs N frame-latency hops). Max 4096 bytes/call (BizHawk serialization limit); chunk larger reads in 4 KiB. Powers the two-snapshot RAM-hunt workflow (snapshot before/after a known change, diff for matching deltas). BEHAVIOR: No side effects — pure read. Returns an error if domain is unknown, length is out of 1-4096, or address+length exceeds the domain. RETURNS: 'ADDR_HEX [N bytes, DOMAIN]:' header + space-separated 2-digit uppercase hex bytes.
bizhawk_write8
PURPOSE: Write a single unsigned byte (0-255) to emulator memory at the given address. USAGE: Use for single-byte cheats, debug pokes, and game-state mutations (give a player N lives, unlock a flag, set a counter). For 16/32-bit values prefer bizhawk_write16/write32 (single call instead of byte-at-a-time); for spans use bizhawk_write_range. To seed cart save RAM realistically (with proper MBC behavior), prefer bizhawk_load_state with a pre-prepared .State file rather than poking SRAM bytes here. BEHAVIOR: DESTRUCTIVE: overwrites whatever was at `address` with no undo (snapshot via bizhawk_save_state first if you need rollback). The write is direct memory access — bypasses MBC bank switches, cartridge mapper side-effects, and DMA semantics — so it cannot be used to emulate cartridge hardware. Returns an error if the domain is unknown, address is out of range, value < 0 or > 255, or the core lacks memory.write_u8. Works whether emulation is paused or running. RETURNS: Single line 'Wrote VAL_DEC (0xVAL_HEX) → ADDR_HEX (DOMAIN)'.
bizhawk_write16
PURPOSE: Write an unsigned 16-bit little-endian value to emulator memory at the given address. USAGE: Use for 16-bit cheats and pokes (HP, score, coordinates). For single bytes use bizhawk_write8; for 32-bit use bizhawk_write32; for big-endian fields, byteswap and use bizhawk_write_range; for cart save RAM seeding, use bizhawk_load_state. BEHAVIOR: DESTRUCTIVE: overwrites two bytes (low byte at `address`, high byte at `address+1`) with no undo. Direct memory write — no MBC/mapper/DMA mediation, see bizhawk_write8 notes. Returns an error if the domain is unknown, address+2 exceeds the domain, value < 0 or > 65535, or the core lacks memory.write_u16_le. RETURNS: Single line 'Wrote VAL_DEC (0xVAL_HEX) → ADDR_HEX (DOMAIN)'.
bizhawk_write32
PURPOSE: Write an unsigned 32-bit little-endian value to emulator memory at the given address. USAGE: Use for 32-bit cheats and pokes (timestamps, large counters, pointers on 32-bit systems). For 8/16-bit values use bizhawk_write8/write16; for big-endian layouts byteswap and use bizhawk_write_range. BEHAVIOR: DESTRUCTIVE: overwrites four bytes starting at `address` with no undo (snapshot via bizhawk_save_state first if you need rollback). Direct memory write — bypasses MBC/mapper/DMA, see bizhawk_write8 notes. Returns an error if the domain is unknown, address+4 exceeds the domain, value < 0 or > 4294967295, or the core lacks memory.write_u32_le. RETURNS: Single line 'Wrote VAL_DEC (0xVAL_HEX) → ADDR_HEX (DOMAIN)'.
bizhawk_write_range
PURPOSE: Write a contiguous byte sequence to emulator memory starting at the given address. USAGE: Use whenever you're seeding more than ~4 bytes — one round-trip vs N frame-latency hops compared to looping bizhawk_write8. Maximum 4096 bytes per call (BizHawk serialization limit); for larger writes, batch in 4 KiB chunks. Useful for installing cheat tables, patching code blocks, restoring a captured byte window after experiments, and writing big-endian multi-byte values (byteswap them yourself first). For cart save RAM seeding with proper MBC semantics, use bizhawk_load_state instead. BEHAVIOR: DESTRUCTIVE: overwrites N bytes starting at `address` with no undo. Direct memory write — bypasses MBC/mapper/DMA, see bizhawk_write8 notes. Bytes are written sequentially address, address+1, ..., address+N-1. Returns an error if the domain is unknown, address+N exceeds the domain, the array contains a value outside 0-255, or the array length is < 1 or > 4096. RETURNS: Single line 'Wrote N bytes → ADDR_HEX (DOMAIN)'.
bizhawk_search_memory
PURPOSE: Find every address in a memory domain whose value equals a target — a Cheat-Engine-style value scan with iterative narrowing. USAGE: Two modes. FIRST scan — omit `addresses`: sweeps the whole domain (or the [start, start+length) window you give) and returns matching offsets. NEXT scan — pass `addresses` (the offsets a prior scan returned): keeps only those that STILL equal `value`, the classic 'the value changed to X — which of my candidates match now?' narrowing. Typical RAM hunt: search a known value (lives=3) → play until it changes → search the new value passing the prior addresses → repeat until a handful remain, then poke them with bizhawk_write*. Pick `width` to match the field size; leave `aligned` true (steps by the width — fast and standard) unless you suspect an unaligned value. BEHAVIOR: No side effects — pure read. A FIRST scan runs synchronously inside one bridge tick and briefly stalls the emulator: it bulk-reads the window in one engine call where the build supports it (cap 16 MiB per scan) and falls back to a byte-by-byte read otherwise (cap 256 KiB per scan — chunk larger windows with start+length). Results are capped at `max_results` (default 200); when more matched, `count` reports the true total and the result is flagged truncated — narrow with a more specific value or range. A NEXT scan is exact over whatever addresses you pass. Returns an error on unknown domain, a value out of range for the width, or a scan window over the cap. RETURNS: A summary line (match count, value, width, bytes scanned) followed by the matching offsets as per-domain hex (0-based — the same offsets the read/write tools take).