LL

LLDB MCP Server Automated Buffer Overflow Debugging

Watch an MCP server automatically detect and debug a buffer overflow in action with live traces and reproducible fixes.

Quick Install
npx -y @stass/lldb-mcp

Overview

LLDB MCP Server connects the LLDB debugger to a Model Context Protocol (MCP) host so an LLM agent (for example, Anthropic Claude configured with MCP) can start and control live LLDB debugging sessions. The server exposes a set of RPC-style commands that let the model manage sessions, load binaries or core dumps, set breakpoints, step through code, inspect memory/registers, and run arbitrary LLDB commands — enabling AI-assisted, reproducible debugging workflows.

This is particularly useful for reproducing and iterating on hard-to-find issues like buffer overflows: the agent can run the target program, catch a crash, capture backtraces and memory dumps, and propose concrete fixes — while the server preserves logs and session state so every step is repeatable and auditable.

Features

  • Manage multiple concurrent LLDB sessions (start, list, terminate).
  • Load executables, attach to running processes, or open core dumps.
  • Set and list breakpoints and watchpoints.
  • Fine-grained execution control: run, continue, step, next, finish, kill.
  • Inspect process state: memory, registers, stack frames, threads, disassembly.
  • Execute arbitrary LLDB commands and evaluate expressions in the current frame.
  • Output traces and debug logs for reproducibility.
  • Optional debug mode for verbose server-side logging.

Installation / Configuration

Clone the repository and install the MCP dependency:

git clone https://github.com/stass/lldb-mcp.git
cd lldb-mcp
pip install mcp

Start the MCP server (example):

python3 lldb_mcp.py --host 127.0.0.1 --port 6000
# add --debug for verbose logs

Configure your MCP client (e.g., Claude desktop) to use the server. Example JSON entry for the MCP configuration:

"mcpServers": {
  "lldb-mcp": {
    "command": "python3",
    "args": ["/path/to/lldb-mcp/lldb_mcp.py", "--host", "127.0.0.1", "--port", "6000"],
    "disabled": false
  }
}

Requirements:

  • Python 3.7+
  • LLDB installed and reachable on the PATH
  • MCP-capable client (e.g., Claude desktop with MCP support)

Available Tools / Resources

The server exposes discrete commands (useful when driving LLDB from an LLM):

CategoryExample Commands
Session managementlldb_start, lldb_terminate, lldb_list_sessions
Program loadinglldb_load, lldb_attach, lldb_load_core
Execution controllldb_run, lldb_continue, lldb_step, lldb_next, lldb_finish, lldb_kill
Breakpoints / watchpointslldb_set_breakpoint, lldb_breakpoint_list, lldb_breakpoint_delete, lldb_watchpoint
Inspectionlldb_backtrace, lldb_print, lldb_examine, lldb_info_registers, lldb_frame_info, lldb_disassemble
Threadslldb_thread_list, lldb_thread_select
Misclldb_command, lldb_expression, lldb_help

Use lldb_command to run any LLDB command text that doesn’t have a dedicated wrapper.

Use Cases

  1. Reproducing and fixing a buffer overflow

    • Compile the example that demonstrates overflow:
      cc example/overflow.c -o a.out
      
    • Ask the MCP-enabled assistant: “Start a session, run a.out with argument ‘hello’, and debug the crash.”
    • The server will run the program under LLDB, capture the crash, produce a backtrace, dump relevant memory regions, and list suspicious stack frames and register values. The assistant can then suggest a fix (e.g., correcting a strncpy/memcpy size) and re-run the binary to verify the fix.
  2. Post-mortem analysis using core dumps

    • Load a core file with lldb_load_core to inspect the state at crash time without running the program.
  3. Attaching to a live process for intermittent bugs

    • Use lldb_attach to attach to a PID, set conditional breakpoints, and collect traces only when the condition triggers.
  4. Teaching/debugging sessions

    • Developers can use the server to produce reproducible transcripts of interactive debugging sessions for onboarding or bug reports.

Practical tips

  • When a command needs syntax not covered by the API, use lldb_command to send raw LLDB commands.
  • Use –debug on the server to capture full logs that can be attached to bug reports.
  • Each session has an ID; include the session ID when issuing follow-up commands so operations target the correct session.
  • If LLDB appears to hang or time out, confirm LLDB is installed and the server has permissions to debug/attach.

Repository and examples, including the overflow demo, are available at: https://github.com/stass/lldb-mcp.