Reversecore MCP

Run binary analysis with optional depth level. Args: file_path: Path to the binary file level: Analysis depth as an INTEGER from 0 to 4 (default: 2). IMPORTANT: Must be an integer. Do NOT pass strings like "full", "deep", or "auto" — those will be rejected. 0 = aa (basic, fastest) 1 = aaa (auto) 2 = aaaa (experimental, recommended default) 3 = aaaaa (deep, slow) 4 = aaaaaa (very deep, very slow) arch: Optional architecture (e.g., 'mips', 'arm64', 'riscv', 'x86_64') bits: Optional architecture bits (e.g., 32, 64) Returns…

Evaluate a math expression using radare2's number parser. Useful for: 64-bit math, resolving addresses for symbols, avoiding hallucinated results. Args: file_path: Path to the binary file expression: Math expression to evaluate (e.g., "0x100 + sym.flag - 4") Returns: Calculated result in hex and decimal

Close the currently open radare2 session for a file. Args: file_path: Path to the file to close Returns: Status of the close operation

Show C-like pseudocode of the function at the given address. Use this to inspect code in a function. Do not run multiple times on the same offset. Includes smart line windowing and function summary header. Args: file_path: Path to the binary file address: Address of the function to decompile line_offset: Starting line offset for windowed pseudocode (default: 0) max_lines: Maximum lines of pseudocode per window (default: 200) cursor: Legacy pagination cursor (overridden by line_offset if provided) page_size: Legacy page size (overridden by max_lines if provided) Retur…

Disassemble a specific number of instructions from an address. Use this to inspect a portion of memory as code without depending on function analysis boundaries. Args: file_path: Path to the binary file address: Address to start disassembly num_instructions: Number of instructions to disassemble (default: 10, max: 1000) Returns: Disassembled instructions

Show assembly listing of the function at the specified address. Args: file_path: Path to the binary file address: Address OR symbol name of the function to disassemble. Accepts hex addresses (e.g. '0x401000', '0x8d4') as well as function/symbol names (e.g. 'main', 'sym.secret_backdoor', 'sym.process_request'). Symbol names are automatically resolved to their virtual address before disassembly. format: Output format - 'compact' (compact instruction tuples [addr, mnemonic, ops, comment]) or 'raw' (raw visual text output). Default: 'compact'. …

Show the current seek position and function name. Args: file_path: Path to the binary file Returns: Current address and function name

Retrieve the function signature at the specified address. Args: file_path: Path to the binary file address: Address of the function Returns: Function prototype/signature

Scan the entire binary for strings with optional regex filter. More thorough than list_strings, but slower. Args: file_path: Path to the binary file filter: Regular expression to filter results cursor: Pagination cursor page_size: Number of lines per page Returns: List of all strings with pagination

List class names from various languages (C++, ObjC, Swift, Java, Dalvik). Args: file_path: Path to the binary file filter: Regular expression to filter results Returns: List of classes

Show all available decompiler backends. Args: file_path: Path to the binary file Returns: List of available decompilers

Display program entrypoints, constructors and main function. Args: file_path: Path to the binary file Returns: Entrypoint information

List all functions discovered during analysis. Args: file_path: Path to the binary file only_named: If true, exclude functions with numeric suffixes filter: Regular expression to filter results Returns: List of functions with addresses and names

List functions and their successors (call tree). Args: file_path: Path to the binary file Returns: Function call tree

List imported symbols. Note: Use list_symbols for addresses with sym.imp. prefix. Args: file_path: Path to the binary file filter: Regular expression to filter results Returns: List of imports

List all shared libraries linked to the binary. Args: file_path: Path to the binary file Returns: List of linked libraries

List all methods belonging to the specified class. Args: file_path: Path to the binary file classname: Name of the class to list methods for Returns: List of methods in the class

Display memory sections and segments from the binary. Args: file_path: Path to the binary file Returns: Sections and segments information

List strings from data sections with optional regex filter. Args: file_path: Path to the binary file filter: Regular expression to filter results cursor: Pagination cursor (line number to start from) page_size: Number of lines per page (default: 1000, max: 10000) Returns: List of strings with pagination

Show all symbols (functions, variables, imports) with addresses. Args: file_path: Path to the binary file filter: Regular expression to filter results Returns: List of symbols

Opens a binary file with radare2 for analysis. Call this tool before any other r2mcp tool. Use an absolute file_path. Args: file_path: Absolute path to the binary file to analyze Returns: Status of the file opening operation, including session_id

Rename a flag (variable or data reference) at the specified address. Args: file_path: Path to the binary file address: Address of the flag name: Current flag name new_name: New flag name Returns: Confirmation

Rename the function at the specified address. Args: file_path: Path to the binary file address: Address of the function to rename name: New function name Returns: Confirmation

Execute a raw radare2 command directly. NOTE: Only analysis commands are allowed. Write and shell commands are blocked. Args: file_path: Path to the binary file command: The radare2 command to execute Returns: Command output

Add a comment at the specified address. Args: file_path: Path to the binary file address: Address to add comment message: Comment text Returns: Confirmation

Set the function signature (return type, name, arguments). Args: file_path: Path to the binary file address: Address of the function prototype: Function signature in C-like syntax Returns: Confirmation

Display detailed information about a function. Args: file_path: Path to the binary file address: Function address (uses current if not specified) Returns: Detailed function information

Display binary headers and file information. Args: file_path: Path to the binary file Returns: Binary header information

Select which decompiler backend to use. Args: file_path: Path to the binary file name: Decompiler name (ghidra, r2dec, pdc) Returns: Confirmation or error

Find all code references TO the specified address. Args: file_path: Path to the binary file address: Address to check for cross-references (hex or symbol name) limit: Maximum number of xrefs to return (default: 50) Returns: Structured list of xrefs with callers_by_function and xref_count. xref_count=0 means NO callers exist (not an error). Each xref entry contains: from, type, opcode, ref.

Search and recall memories from past analyses. Use this when you need to remember something from earlier, or when the user asks about previous findings. Args: query: Search query (keywords or phrases) session_id: Limit search to specific session (optional) memory_type: Filter by type ('finding', 'pattern', 'instruction', 'context') limit: Maximum number of results (default 10) Returns: List of matching memories with context

Resume a previous analysis session with full context restoration. Use this when the user says "continue where we left off" or "resume yesterday's analysis". Args: session_id: Specific session ID to resume (optional) binary_name: Find latest session for this binary (optional) Returns: Full session context for resumption Note: If neither argument provided, resumes the most recent session.

Save important information to long-term memory. Use this to remember: - Function addresses and their purposes - Vulnerability patterns discovered - API call sequences - User instructions and preferences - Interesting strings or structures Args: session_id: Session ID from create_memory_session memory_type: Type of memory: - 'finding': Analysis discoveries - 'pattern': Code/behavior patterns - 'instruction': User preferences/instructions - 'context': General context information category: Optional category: - 'function': Function-related info…

Save a code/behavior pattern for cross-session similarity search. Use this when you discover a notable pattern that might appear in other samples. This enables "Hey, this looks similar to before!" Args: session_id: Current session ID pattern_type: Type of pattern: - 'api_sequence': Sequence of API calls - 'code_pattern': Assembly/code pattern - 'behavior': Behavioral pattern pattern_signature: Normalized pattern signature for matching Example: "VirtualAlloc,WriteProcessMemory,CreateRemoteThread" description: Human-readable description of the pa…

Update the cumulative analysis time for a session. Call this periodically to track how long an analysis takes. Args: session_id: Session ID duration_seconds: Additional time to add (in seconds) Returns: Confirmation

Run symbolic execution using angr to verify path reachability and extract inputs. Allows proving path reachability and verifying data-flow taint to a target instruction. Args: file_path: Workspace-relative or absolute path to the binary to analyze. target_addr: The target instruction address to reach (hex or integer). start_addr: Optional starting instruction address. If omitted, starts from entry point. avoid_addrs: Optional list of instruction addresses to avoid. source_addr: Optional source instruction address introducing user data. source_api: Optional name of the…