angr.mcp

angr MCP Server - Model Context Protocol interface for angr binary analysis.

This module provides an MCP server that exposes angr’s binary analysis capabilities through standardized tools accessible by LLM applications.

Usage:

# Run as module with stdio transport (for Claude Desktop, etc.) python -m angr.mcp

# Run with SSE transport python -m angr.mcp –transport sse –port 8080

# Run with HTTP transport python -m angr.mcp –transport http –host 0.0.0.0 –port 8080 –path /mcp

# Programmatic usage from angr.mcp import create_server server = create_server() server.run()

Available Tools:

  • load_binary: Load a binary file for analysis

  • get_cfg: Build the control flow graph

  • recover_calling_conventions: Recover calling conventions and prototypes

  • list_functions: List discovered functions

  • get_function_info: Get detailed function information

  • decompile_function: Decompile to pseudocode

  • get_xrefs: Get cross-references

  • get_strings: Extract strings from binary

  • get_imports: List imported symbols

  • get_exports: List exported symbols

  • get_basic_blocks: Get basic blocks with disassembly

  • get_callgraph: Get function call graph

  • find_functions_by_pattern: Search functions by name

  • list_projects: List active analysis sessions

  • close_project: Close a project session

Editing Tools (batch; see angr.mcp.edit_tools):

  • rename: Rename functions, decompilation variables, and globals

  • set_type: Set variable types, globals, return types, and function prototypes

  • set_comments: Set or clear comments at addresses

exception angr.mcp.CFGNotBuiltError

Bases: MCPAngrError

Raised when CFG is required but not built.

exception angr.mcp.DecompilationError

Bases: MCPAngrError

Raised when decompilation fails.

exception angr.mcp.FunctionNotFoundError

Bases: MCPAngrError

Raised when a function cannot be found.

exception angr.mcp.MCPAngrError

Bases: AngrError, ToolError

Base exception for MCP angr server errors.

Also a fastmcp ToolError: FastMCP masks the message of anything else, so a client would otherwise see a generic failure instead of the reason.

exception angr.mcp.ProjectNotFoundError

Bases: MCPAngrError

Raised when a project ID is not found.

class angr.mcp.ProjectSession

Bases: object

Represents a loaded angr project with its associated analyses.

project_id: str
project: Project
binary_path: str
cfg: CFGModel | None = None
sha256: str = ''
flavor: str = 'pseudocode'
lock: RLock
set_flavor(flavor)

Set the project-wide decompilation flavor and return the previous one.

Return type:

str

Parameters:

flavor (str)

property has_cfg: bool

Check if CFG has been built for this project.

exclusive()

Serialize access to this project.

FastMCP runs synchronous tools on worker threads, so two calls can reach the same Project and KnowledgeBase at once. Neither is thread-safe, and the decompilation and variable caches spill to LMDB, where a concurrent eviction and reload can hand back a half-imported object. Read-only tools are not exempt: a read racing an eviction is exactly that hazard.

Return type:

Iterator[ProjectSession]

__init__(project_id, project, binary_path, cfg=None, sha256='', flavor=Flavors.DEFAULT_FLAVOR, lock=<factory>)
Parameters:
Return type:

None

class angr.mcp.SessionManager

Bases: object

Manages multiple angr project sessions.

This class maintains state across MCP tool invocations, allowing projects to persist between calls.

__init__()
Return type:

None

create_session(binary_path, **kwargs)

Load a binary and create a new project session.

Parameters:

  • binary_path (str) – Path to the binary to analyze

  • kwargs (Any) – Additional arguments passed to angr.Project

Return type:

ProjectSession

Returns:

The created ProjectSession with unique ID

get_session(project_id)

Get an existing session by ID.

Parameters:

project_id (str) – The project ID to look up

Return type:

ProjectSession

Returns:

The ProjectSession

Raises:

KeyError – If no project with that ID exists

list_sessions()

List all active sessions.

Return type:

list[dict[str, Any]]

Returns:

List of session metadata dictionaries

close_session(project_id)

Close and remove a session.

Parameters:

project_id (str) – The project ID to close

Return type:

bool

Returns:

True if closed, False if not found

angr.mcp.create_server()

Create and return the configured MCP server instance.

Return type:

FastMCP

angr.mcp.get_session_manager()

Get or create the global session manager.

Return type:

SessionManager

Submodules

edit_tools

Batch edit tools: rename, set_type, and set_comments.

errors

serializers

server

Main MCP server for angr binary analysis.

session

Session management for angr MCP server.