angr.mcp.server

Main MCP server for angr binary analysis.

angr.mcp.server.load_binary(binary_path, auto_load_libs=False)

Load a binary file as an angr Project for analysis.

This is typically the first tool to call. It creates a new analysis session and returns a project_id that must be used for subsequent operations.

Parameters:

  • binary_path (str) – Absolute path to the binary file to analyze

  • auto_load_libs (bool) – Whether to automatically load shared libraries (default: False)

Return type:

dict[str, Any]

Returns:

Project information including project_id, architecture, and entry point

angr.mcp.server.get_cfg(project_id, normalize=True, data_references=True)

Build or retrieve the Control Flow Graph (CFG) for a project.

The CFG is required for most analysis operations including function discovery, decompilation, and cross-reference analysis.

Parameters:

  • project_id (str) – The project ID returned by load_binary

  • normalize (bool) – Whether to normalize the CFG (recommended: True)

  • data_references (bool) – Whether to collect data references (for string analysis)

Return type:

dict[str, Any]

Returns:

CFG statistics including node/edge counts and functions discovered

angr.mcp.server.list_functions(project_id, filter_plt=None, filter_syscall=None, name_pattern=None, limit=100, offset=0)

List all functions discovered in the binary.

Requires CFG to be built first via get_cfg.

Parameters:

  • project_id (str) – The project ID

  • filter_plt (bool | None) – If True, only show PLT stubs; if False, exclude them

  • filter_syscall (bool | None) – If True, only show syscalls; if False, exclude them

  • name_pattern (str | None) – Filter functions by name substring (case-insensitive)

  • limit (int) – Maximum number of functions to return (default: 100)

  • offset (int) – Number of functions to skip (for pagination)

Return type:

dict[str, Any]

Returns:

List of function summaries with addresses and names

angr.mcp.server.get_function_info(project_id, address=None, name=None, include_blocks=False)

Get detailed information about a specific function.

Specify either address (hex string like “0x401000”) or function name.

Parameters:

  • project_id (str) – The project ID

  • address (str | None) – Function address as hex string (e.g., “0x401000”)

  • name (str | None) – Function name to look up

  • include_blocks (bool) – Whether to include list of basic block addresses

Return type:

dict[str, Any]

Returns:

Detailed function information including size, complexity, etc.

angr.mcp.server.decompile_function(project_id, address=None, name=None)

Decompile a function to C-like pseudocode.

Specify either address (hex string) or function name.

Parameters:

  • project_id (str) – The project ID

  • address (str | None) – Function address as hex string (e.g., “0x401000”)

  • name (str | None) – Function name to decompile

Return type:

dict[str, Any]

Returns:

Decompiled pseudocode and function metadata

angr.mcp.server.get_xrefs(project_id, address, direction='to')

Get cross-references to or from a specific address.

Parameters:

  • project_id (str) – The project ID

  • address (str) – The address to query (hex string, e.g., “0x401000”)

  • direction (str) – “to” for references TO this address, “from” for references FROM this address

Return type:

dict[str, Any]

Returns:

List of cross-references with source/destination and type

angr.mcp.server.get_strings(project_id, min_length=4, limit=100)

Extract strings from the binary.

Requires CFG with data_references=True.

Parameters:

  • project_id (str) – The project ID

  • min_length (int) – Minimum string length to include (default: 4)

  • limit (int) – Maximum number of strings to return (default: 100)

Return type:

dict[str, Any]

Returns:

List of strings with their addresses

angr.mcp.server.get_imports(project_id)

List imported symbols (external functions/variables the binary depends on).

Parameters:

project_id (str) – The project ID

Return type:

dict[str, Any]

Returns:

List of imported symbols with their names and addresses

angr.mcp.server.get_exports(project_id)

List exported symbols (functions/variables this binary provides).

Parameters:

project_id (str) – The project ID

Return type:

dict[str, Any]

Returns:

List of exported symbols with their names and addresses

angr.mcp.server.get_basic_blocks(project_id, function_address, include_disasm=True)

Get all basic blocks for a function.

Parameters:

  • project_id (str) – The project ID

  • function_address (str) – Function address as hex string

  • include_disasm (bool) – Whether to include disassembly for each block

Return type:

dict[str, Any]

Returns:

List of basic blocks with their instructions

angr.mcp.server.get_callgraph(project_id, max_depth=None, root_address=None)

Get the function call graph.

Parameters:

  • project_id (str) – The project ID

  • max_depth (int | None) – Maximum depth from root (None for full graph)

  • root_address (str | None) – Optional starting function address for subgraph

Return type:

dict[str, Any]

Returns:

Call graph as nodes and edges

angr.mcp.server.find_functions_by_pattern(project_id, pattern, search_type='contains')

Search for functions by name pattern.

Parameters:

  • project_id (str) – The project ID

  • pattern (str) – Search pattern (depends on search_type)

  • search_type (str) – “contains”, “startswith”, “endswith”, or “regex”

Return type:

dict[str, Any]

Returns:

List of matching functions

angr.mcp.server.list_projects()

List all currently loaded projects/sessions.

Return type:

dict[str, Any]

Returns:

List of active project sessions with their IDs and metadata

angr.mcp.server.close_project(project_id)

Close a project and free its resources.

Parameters:

project_id (str) – The project ID to close

Return type:

dict[str, Any]

Returns:

Confirmation of closure

angr.mcp.server.create_server()

Create and return the configured MCP server instance.

Return type:

FastMCP