rbinr2

rbinr2 is a Model Context Protocol server for radare2-backed binary analysis.

It runs as a stdio MCP server, opens binaries in persistent radare2 sessions, and exposes named tools for metadata, disassembly, search, xrefs, byte extraction, graphing, and static triage.

The target use case is repeatable static analysis from an MCP client. Give the tools an absolute binary path and an address, symbol, flag, or search pattern. rbinr2 keeps the radare2 session open until you close it or the server exits.

• Rust 1.88 or newer
• radare2 5.9 or newer on PATH
• An MCP client that can run stdio servers

Check the runtime dependency:

r2 -v

Optional decompiler support for r2_decompile mode=code requires an r2 decompiler plugin such as r2ghidra or r2dec. mode=meta works without those plugins.

From a local checkout:

git clone https://github.com/kirkderp/rbinr2
cd rbinr2
cargo install --path crates/rbm-server --locked

From git:

cargo install --git https://github.com/kirkderp/rbinr2 --package rbm-server --locked

The installed executable is named rbinr2.

Run it directly:

RBM_CACHE_DIR=./rbinr2-cache rbinr2

The process waits for MCP JSON-RPC messages on stdin and writes responses to stdout.

Example stdio server configuration:

{
  "mcpServers": {
    "rbinr2": {
      "command": "/absolute/path/to/rbinr2",
      "args": [],
      "env": {
        "RBM_CACHE_DIR": "/absolute/path/to/rbinr2-cache"
      }
    }
  }
}

Use an absolute path for command. Use an absolute path for RBM_CACHE_DIR when the client may start the server from different working directories.

MCP client
  -> stdio JSON-RPC
  -> rbinr2
  -> one persistent radare2 process per binary
  -> bounded r2 commands
  -> JSON/text tool responses

rbinr2 canonicalizes binary paths and reuses the same radare2 session for later calls. The first call for a binary performs radare2 startup analysis. Later calls use the existing session.

Use r2_close to close one binary session. Use r2_sessions to list open sessions.

MCP clients call tools by name. These examples show the tool arguments.

Open a binary with r2_open:

{
  "binary_path": "/absolute/path/to/sample.exe"
}

Read binary metadata with r2_metadata:

{
  "binary_path": "/absolute/path/to/sample.exe",
  "mode": "info"
}

List functions with r2_metadata:

{
  "binary_path": "/absolute/path/to/sample.exe",
  "mode": "functions",
  "limit": 25
}

Inspect a function with r2_function_view:

{
  "binary_path": "/absolute/path/to/sample.exe",
  "addr": "entry0",
  "mode": "profile"
}

Extract bytes without writing files with r2_extract_bytes:

{
  "binary_path": "/absolute/path/to/sample.exe",
  "addr": "entry0",
  "count": 256
}

Close the session with r2_close:

{
  "binary_path": "/absolute/path/to/sample.exe"
}

rbinr2 exposes 39 MCP tools.

r2_cmd rejects command separators, shell escapes, writes, seeks, and eval-setting mutations. Prefer named tools when one exists.

• binary_path must be an absolute path.
• Address arguments accept numeric addresses, symbols, and r2 flags.
• Most tools clamp counts and limits before calling r2.
• r2_extract_bytes returns bytes, hashes, previews, and mapping data. It does not write extracted bytes to disk.
• r2_decompile mode=code depends on installed r2 decompiler plugins. Use mode=meta for plugin-independent metadata.
• r2_cmd is for read-only queries. Use named tools for normal workflows.

Build and test:

cargo fmt --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked

Run from source:

RBM_CACHE_DIR=./rbinr2-cache cargo run --bin rbinr2

Fresh local install:

cargo install --path crates/rbm-server --locked

crates/
  rbm-server/    MCP server, radare2 session management, and tool implementations

MIT. See LICENSE.