MCP missing bn_code_xrefs_* #8647

Version and Platform (required):

• Binary Ninja Version: 6.0.10601 Personal (87066bd6)
• Edition: Personal (1 User)
• OS: Windows
• OS Version: Windows 11 24H2
• CPU Architecture: x64

Bug Description:
When analyzing a binary with Intermediate analysis, the Binary Ninja GUI correctly shows Code References to a string, but the MCP tool bn_data_xrefs_to returns no results for that same string address.

This appears to be because those references are code xrefs (LEAs / string uses), not data xrefs, and MCP currently exposes only bn_data_xrefs_to / bn_data_xrefs_from at the address level. There is no MCP equivalent of the GUI’s reverse code-xref query for an arbitrary address/string (e.g. bn_code_xrefs_to).

With Full analysis, this works as expected. With Intermediate analysis, the GUI still shows the code xrefs, but MCP cannot recover them via bn_data_xrefs_to.

bn_function_xrefs_from can still surface the string as a target, but only if the referring function is already known. That is not a substitute for reverse-querying xrefs to a string/address the way the GUI Cross References panel does.

Steps To Reproduce:

1. Open a binary in Binary Ninja and set analysis to Intermediate.
2. Locate an ASCII string that is referenced by code via LEA/use. For example, any string used by a function like:

   lea rdx, [SomeExampleString]
   call SomeHelper

3. In the GUI, select the string and open Cross References.
4. Observe that Code References are listed under the referring function.
5. Through MCP, call bn_data_xrefs_to on the same string address.
6. Observe that MCP returns count=0 / empty results.
7. Optionally switch analysis to Full and repeat; the expected MCP behavior then works.
8. Optionally call bn_function_xrefs_from on the known referring function; the string address appears as a target, confirming analysis knows the xref even when reverse address-level MCP lookup fails.

Expected Behavior:
MCP should be able to reverse-query the same xrefs the GUI shows for a string/address under Intermediate analysis. Either:

1. bn_data_xrefs_to should include code-to-data refs for strings (matching GUI string xref behavior), or
2. MCP should expose a dedicated tool such as bn_code_xrefs_to(address) / full xrefs-to-address that matches the GUI Cross References panel.

Selecting a string and querying xrefs via MCP should not require already knowing the referring function.

Screenshots/Video Recording:
GUI Cross References for an example string under Intermediate analysis shows Code References like:

• 0x...AAAA — partial SSE/string start use
• 0x...BBBB — continued string walk / use
• 0x...CCCC — final LEA + call using the full string

MCP bn_data_xrefs_to(<string_address>) returns empty for the same address.

Additional Information:

• MCP tools available for xrefs today:
  • bn_data_xrefs_to / bn_data_xrefs_from -> data refs only
  • bn_function_xrefs_to / bn_function_xrefs_from -> function-scoped code refs
• Missing: address-level code xref reverse lookup equivalent to the GUI panel
• Workaround today: find the string with bn_string_list, then probe candidate functions with bn_function_xrefs_from / decompile until the string address appears
• This is especially painful for string-driven RE workflows, where the GUI workflow is “click string -> jump to xrefs,” but MCP cannot do that reverse step under Intermediate analysis