r2-copilot
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| create_sessionC | Create a new Radare2 session. Args: file_path: Path to binary file to analyze pid: Process ID to attach to write_mode: Enable write mode debug_mode: Enable debugger mode session_name: Optional session name (auto-generated if not provided) Returns: Session information |
| list_sessionsB | List all active Radare2 sessions. |
| close_sessionC | Close a Radare2 session. |
| switch_sessionC | Switch to a different session. |
| analyze_allB | Perform complete analysis of the binary (aa). Analyzes functions, basic blocks, and cross-references. |
| analyze_functionC | Analyze function at current or specified address (af). Args: address: Address or symbol (e.g., "0x401000", "sym.main") session_id: Session to use |
| list_functionsC | List all analyzed functions (afl). |
| get_function_infoC | Get detailed information about a function (afi). |
| get_xrefs_toC | Get cross references to an address (axt). |
| get_xrefs_fromC | Get cross references from an address (axf). |
| get_binary_infoC | Get comprehensive binary information (iI). |
| get_sectionsD | Get binary sections (iS). |
| get_symbolsC | Get binary symbols (is). |
| get_stringsC | Get strings from binary (iz/izz). |
| get_importsC | Get imported functions (ii). |
| get_entrypointC | Get binary entrypoint (ie). |
| check_securityC | Check binary security features (NX, PIE, Canary, etc.). |
| disassembleB | Disassemble N instructions (pd). Args: count: Number of instructions to disassemble address: Starting address or symbol session_id: Session to use |
| disassemble_functionC | Disassemble entire function (pdf). |
| print_hexC | Print hexdump (px). |
| print_stringC | Print string at address (psz). |
| seekC | Seek to address or symbol (s). Returns new position. |
| seek_relativeC | Seek relative to current position. |
| get_current_addressD | Get current address. |
| set_block_sizeC | Set block size (b). |
| search_bytesC | Search for byte pattern (/x). Pattern should be hex string like "909090" or "\x90\x90" |
| search_stringD | Search for string (/). |
| search_rop_gadgetsC | Search for ROP gadgets (/R). Example: ["pop eax", "ret"] |
| write_hexC | Write hex values (wx). Data should be hex string like "909090" |
| write_assemblyC | Write assembly instruction (wa). Example: "jmp 0x401000" |
| write_nopD | Write NOP instructions. |
| continue_executionC | Continue program execution (dc). |
| step_intoD | Step into (single step) (ds). |
| step_overD | Step over (dso). |
| set_breakpointD | Set breakpoint (db). |
| list_breakpointsC | List all breakpoints. |
| get_registersC | Get register values (dr). |
| set_registerC | Set register value (dr reg=value). |
| list_flagsD | List flags/labels (f). |
| create_flagC | Create a flag/label at address (f name @ addr). |
| get_configD | Get configuration value(s) (e). |
| set_configC | Set configuration value (e key=value). |
| execute_commandB | Execute raw Radare2 command. Use this for commands not yet wrapped by specific tools. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 43 tools
Most tools target clearly distinct resources and actions, e.g. get_xrefs_to vs get_xrefs_from, search_bytes vs search_string vs search_rop_gadgets, and write_hex vs write_assembly vs write_nop. The generic execute_command overlaps with many specialized tools, and disassemble vs disassemble_function could be confused, but descriptions clarify scope.
All tool names use predictable snake_case, with a consistent verb_noun or verb_object pattern throughout (e.g. create_session, list_functions, set_register, search_bytes). Minor verb variety reflects domain actions rather than naming inconsistency.
At 43 tools, the surface is well above the typical 3-15 range and risks overwhelming an agent with many niche radare2 wrappers. Since execute_command already provides a raw fallback, some specific wrappers could likely be consolidated or omitted.
Core workflows are covered across sessions, analysis, disassembly, search, writes, and execution, but lifecycle gaps remain: no delete_breakpoint or disable_breakpoint, no delete_flag, and no call-stack/frame inspection. execute_command can work around these gaps, but the native tool surface is not fully complete.