r2http

Use radare2's HTTP server as a stateful command transport. The /cmd endpoint executes the HTTP POST body as a raw radare2 command in the running instance. Analysis data, flags, comments, config changes, and the HTTP session's seek state persist across requests.

Rules

• Prefer POST /cmd for all normal work. Do not use GET /cmd/<command> except for legacy diagnostics.
• Send the r2 command as the raw request body. Do not send cmd=..., JSON-RPC, or URL query parameters unless you intentionally use r2's {...} command wrapper.
• Use curl -sS --data-binary 'COMMAND' "$R2CMD" so curl does not form-encode or rewrite the command body.
• Serialize requests to the same endpoint. Do not run parallel POSTs against one r2/iaito instance because command order and state matter.
• Prefer one r2 command per POST. Use r2's normal ; separator for short compound commands, for example s main;pdfj.
• Treat empty output as normal for state-changing commands such as s, e, aa, comments, flags, and writes.
• Treat the endpoint as code execution in the target r2 instance. Avoid destructive commands, writes, debugging actions, or shell escapes unless the user asked for them.

Endpoint Setup

Normalize the endpoint before running commands: