r2ai

Radare2 AI plugin using local or remote LLMs for decompilation, function explanation, vulnerability detection, renaming, and scripted reverse engineering.

• r2mcp - the official radare2 mcp
• r2copilot - the mcp with focus on CTF r2copilot

If you are looking for a radare2 focused autonomous agent:

• r2agent - automate radare2 workflows through autonomous agents. r2agent

Features

• Configure different roles and customize prompts
• Scriptable via r2pipe via the r2ai command
• Live with repl and batch mode from cli or r2 prompt
• Support Automatic (ReAct) mode to solve tasks using function calling
• Use local and remote language models (ollama, openai, grok, anthropic, ..)
• RAG markdown, code or textfiles using its native vector database
• Embed the output of an r2 command and resolve questions on the given data

User defined Prompts

Installation

The recommended way to install any of the r2ai components is via r2pm:

Using r2ai

• Adds the r2ai command to the radare2 shell: r2 -qc r2ai
• You can also run the wrapper in $PATH: r2pm -r r2ai

Drop your API keys in environment variables or use the configuration file:

Or edit the api keys file ~/.config/r2ai/apikeys.txt run:

Saving settings

You may customize and save your configuration settings using your OS's default settings file (e.g ~/.radare2rc on Linux). For example, the following configuration sets Claude 3.7 by default, with max output tokens to 64000.

then you can type the commands you want to run when the r2ai plugin is loaded:

Further Reading

• There's a chapter in the official r2book
• Cryptax on lmstudio+gptoss blog post
• Malware analysis with r2ai by Cryptax and Daniel Nakov
• Analysis of Linux/Trigona ransomware, Linux/Prometei botnet and W32/SkyAI with r2ai

Videos

• Solving a crackme
• De-obfuscation of malware Linux/Ladvix
• Analysis of the /fast option inside Linux/Trigona ransomware