Return angr-cli + angr package version + Python import probe.

Reports WARN (not ERROR) when the helper or the Python module is not importable. The fallback chain for the CLI binary: $RE_ANGR_CLI_PATH -> <server>/bin/angr-cli -> PATH. The Python import probe (added in v2.9.1 to fix Gap 23) runs import angr; import cle in a subprocess using the same Python interpreter the MCP server runs under. The CLI check alone is insufficient: the CLI can be installed while the server's interpreter lacks the angr package, which causes downstream tools (build_cfg, symbolic_exec, reaching_definitions) to emit No module named 'angr'.

Status is OK only when BOTH the CLI is present AND the Python import probe succeeds. Otherwise status is WARN with a concrete install hint.

Build a control-flow graph of path (optionally one function).

Args: path: PE / ELF / MachO to analyze function: optional function name (e.g. "main") — when given, only the CFG of that function is returned; when None, the full program CFG is returned.

Returns::

{"path": "...",
 "function": "..." | null,
 "nodes": [{"addr": N, "size": M, "successors": [...]}],
 "edges": [{"src": N, "dst": M, "kind": "fall-through|jmp|call|ret"}]}

The CFG is the first thing an analyst needs for VM detection (high incoming-edge count on a single block = dispatcher candidate) and for binary comprehension in general.

Run angr symbolic execution starting at address.

Args: path: PE / ELF / MachO to analyze address: entry point as a hex string (e.g. "0x401000") args: optional list of symbolic-arg names (default: none — angr marks stdin / argv as symbolic depending on the binary's entry point conventions)

Returns::

{"path": "...",
 "address": "0x401000",
 "states_explored": N,
 "constraints": [{"path": [...], "expr": "..."}],
 "dead_ends": N}

The output is a partial trace — angr explores until either all paths are explored or the timeout is hit. The result is useful for cross-validation: "angr and Triton both find this MBA identity holds" is a much stronger signal than either alone.

Compute the reaching-definitions graph for function.

A reaching definition is "where was the value used at instruction X defined?" angr computes the dataflow analysis statically. The output is a def-use graph: every variable gets a list of definitions; every instruction that reads a variable gets the list of definitions that may reach it.

Useful for the re-mba-deobfuscate skill: the MBA identity x + y == (x & y) + (x | y) looks like arithmetic, but the reaching-defs graph reveals that (x & y) and (x | y) were both defined from the same source — the identity is a no-op substitution.

Args: path: PE / ELF / MachO function: function name (e.g. "main")

Returns::

{"path": "...", "function": "...",
 "defs": [{"variable": "...", "defined_at": "0x..."}],
 "uses": [{"at": "0x...", "reads": ["var1", "var2"]}]}