radareorg/r2mcp

An MCP server to use **radare2** with AI agents such as OpenCode, Mai, VSCode, Claude, CLION, ...
Features
This implementation provides:
- 💻 Fully written in C using the native r2 APIs
- 🧩 Works from the CLI, as an r2 plugin and as an MCP server
- 🔍 Seamless binary analysis with radare2
- 🔗 Connect to any local or remote r2/iaito session via r2pipe
- 🔒 Supports readonly mode, sandbox lock and restrict tools
- 🔩 Fine grained tools configuration
- 🔁 Direct stdin/stdout communication model
- 🌐 HTTP MCP server mode with optional X-Session-ID multiplexing
- 🛠️ Optional raw access to run r2 commands or r2js scripts
Installation
Using r2pm
The simplest way to install the package is by using r2pm:
The r2mcp executable will be copied into r2pm's bindir in your home directory. However, this binary is not supposed to be executed directly from the shell; it will only work when launched by the MCP service handler of your language model of choice.
That's the common mcpServer JSON configuration file:
Codex
To install the codex plugin just run the following command:
This will create a personal marketplace in your home and copy the files from dist/codex-plugin inside.
Using Docker
Alternatively, you can build the Docker image:
Update your MCP client configuration file (see below) to use the Docker image to use:
- "command": "docker"
- "args": ["run", "--rm", "-i", "-v", "/tmp/data:/data", "r2mcp"].
Configuration
HTTP Server Mode
Use -H [address:]port to run r2mcp as an HTTP MCP server instead of using
stdin/stdout. A bare port binds only to 127.0.0.1; use 0.0.0.0:port
explicitly to make the server reachable from the network:
Per-session HTTP state is enabled with -X max[:idle_seconds] and routed by
the X-Session-ID request header:
HTTP bearer authentication is enabled with -a . Clients must send
Authorization: Bearer on every GET and POST request:
Use -A or -a random to generate a random token at startup. The generated
token is printed once on stderr:
The same token setting can be supplied with R2MCP_AUTH_TOKEN; set it to
random to generate one.
-X requires radare2 ABI 91 or newer because older radare2 headers do not
expose the HTTP request header API. With older ABIs, -H still works as a
single shared HTTP server, but -X is ignored. Bearer authentication also
requires this header API.
r2 Core Plugin Mode
The r2 core plugin exposes the r2mcp command inside an existing radare2
session. Starting HTTP mode from r2 reuses the current RCore, so MCP tools
operate on the file and analysis state already loaded in that session:
Useful subcommands:
- r2mcp start or r2mcp http starts the HTTP MCP server in the background.
- r2mcp stop, r2mcp restart, and r2mcp status manage the background server.
- r2mcp logs on|off and r2mcp logs file control plugin debug logs.
- r2mcp approve on|off and r2mcp approve url control supervisor approvals.
- r2mcp yolo on|off disables approvals and exposes dangerous run tools.
- r2mcp config lists the r2mcp.* eval keys.
The plugin registers eval keys for the same server options exposed by the CLI:
r2mcp.port, r2mcp.log, r2mcp.logfile, r2mcp.auth, r2mcp.approve, r2mcp.svc,
r2mcp.yolo, r2mcp.mini, r2mcp.permissive, r2mcp.run,
r2mcp.readonly, r2mcp.ignore_analysis, r2mcp.prompts,