# R2xsql Connect > Connect to radare2 sessions via r2xsql and bootstrap analysis. Use when starting a new SQL session, routing to other skills, or setting up CLI/HTTP/MCP connections. - Skill: `netvar1337/r2xsql-connect` (Agent Skill, multi-file: 6 files) - Install (CLI): `npx skillmds@latest add netvar1337/r2xsql-connect` - Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/r2xsql-connect/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Data & Analytics - Author: netvar1337 (https://skillmd.com/u/netvar1337) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/netvar1337/r2xsql-connect --- ## Prerequisite: radare2 must be installed r2xsql does **not** bundle radare2 and does not install it. The default portable `r2xsql` binary spawns radare2 as a subprocess, so radare2 must exist on the machine before anything here works. ```bash r2pm -ci radare2 # radare2's own package manager git clone https://github.com/radareorg/radare2 && radare2/sys/install.sh sudo apt install radare2 # distro package (may lag) brew install radare2 # macOS ``` It is located **by name on `PATH`** — literally `radare2` (`radare2.exe` on Windows). r2xsql never looks for `r2`, never searches beside its own executable, and reads no environment variable. If radare2 is not on `PATH`, pass `--r2-exe /path/to/radare2`. Confirm what you actually connected to before trusting results: ```bash r2xsql -s -q "SELECT value FROM binary WHERE key='radare2_version'" ``` A too-old radare2 does not raise an error — r2xsql parses radare2's JSON by field name, so a renamed field just yields empty columns. Prefer a recent 6.x. ## CLI Help (verbatim `r2xsql --help`) ``` r2xsql 0.0.1 — SQL interface for radare2 (pipe-only) Copyright (c) 2024-2026 Elias Bachaalany Usage: r2xsql [options] -s open the given binary or r2 project -q "" run a single SQL statement ("." runs a raw r2 command) -f run a SQL script file -i interactive REPL -w, --write open in write mode (persist with `Ps` on exit) --no-analyze skip the implicit `aaa` at startup --project NAME r2 project name (reuses cached analysis; saves on exit if -w) --r2pipe use the r2pipe backend (spawn radare2) --r2-exe PATH path to radare2 executable for r2pipe --http [port] start HTTP REST server (default: random 8100-8999) --mcp [port] start MCP SSE server (default: random 9000-9999) --bind bind address for --http / --mcp (default: 127.0.0.1) --token require Bearer token on HTTP endpoints --version print version and exit -h, --help print this help and exit ``` r2xsql comes in two binaries with an identical CLI. The default **`r2xsql`** (pipe-only, portable) prints `r2xsql 0.0.1 — SQL interface for radare2 (pipe-only)`; **`r2xsql-full`** (in-process libr, ships the plugin) prints `r2xsql-full 0.0.1 — … (embedded radare2 / libr)`. Everything else is identical. **Key takeaway:** `-s` accepts any path radare2 itself would accept — a raw binary, an r2 project (`.r2/`), or a debugger/emulator URI (`dbg://`, `frida://`). r2xsql does **not** create the radare2 session type; it just speaks the same `-s` you would pass to `radare2` itself. --- ## Additional Resources - For canonical schema catalog: [references/schema-catalog.md](references/schema-catalog.md) - For CLI reference, REPL commands, server modes, and runtime controls: [references/cli-reference.md](references/cli-reference.md) - For HTTP server guide: [references/server-guide.md](references/server-guide.md) - For deployment (where on disk `r2xsql` / `r2xsql-full` and `core_r2xsql.dll` go): [references/deployment.md](references/deployment.md) --- ## Choosing a backend | Backend | When to use | |---|---| | **libr** (`r2xsql-full`) | In-process; links the radare2 C libraries directly and runs commands via `r_core_cmd_str`. Faster *per query on a long-lived session* — NOT faster end-to-end (analysis dominates equally). The backend used by the **`r2xsql-full`** binary (built with `-DR2XSQL_BUILD_FULL=ON`). **ABI-locked to the exact radare2 build it was compiled against** — never suggest pairing `r2xsql-full` or `core_r2xsql` with a different radare2; use the pipe binary for that. | | **r2pipe** (`r2xsql`, or `--r2pipe`) | **Launches and manages its own** `radare2 -q0 ` subprocess over stdio — there is NO attach-to-a-running-r2 mode; `--r2-exe ` only chooses which radare2 to launch. The **only** backend in the default portable **`r2xsql`** binary; also forceable in `r2xsql-full` with `--r2pipe` (e.g. an ABI mismatch you want to route around). | | **in-r2 plugin** (`core_r2xsql.dll`) | Already inside radare2 and want SQL access to *this* core. Load with `L core_r2xsql.dll`, then `sql ` / `sql.` (shorthand; bare `sql` or `sql.` prints help) / `sql.http [port]` / `sql.mcp [port]`. The plugin reuses the host `RCore *` — no second core is created. | | **mock** | `MockBackend` (public, in ``) accepts canned `{cmd → response}` and records every issued command — handy for embedding r2xsql without a live radare2. | ## REPL ``` r2xsql -s -i sql> SELECT name FROM funcs LIMIT 5; sql> .quit ``` The REPL is a thin wrapper around `Session::query`. Statements are terminated by newline; multi-statement scripts go through `-f` or `-q "...; ...; ..."` instead. A line that starts with `.` (other than `.quit`/`.exit`) runs a **raw r2 command** — e.g. `sql> .pdf @ entry0` prints disassembly straight from r2 (same as `-q "."`). ## Common bootstrap query ```sql SELECT key, value FROM binary ORDER BY key; ``` Gives you `bintype`, `arch`, `bits`, `os`, plus the `func_count`, `string_count`, `import_count`, `section_count` quick-counts before drilling in. ## Runtime settings Per-session runtime controls (query timeout, hints, a scoped-timeout stack) live in the writable `runtime_settings` table — read with `SELECT`, change with `UPDATE`: ```sql SELECT key, value, type, scope FROM runtime_settings; -- discover the surface UPDATE runtime_settings SET value='5000' WHERE key='query_timeout_ms'; -- raise the per-query timeout ``` Full key list and semantics in [references/cli-reference.md](references/cli-reference.md) and the schema catalog.