Findings & checks · 1 flagged
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP Server for rr Reverse Debugging (karellen-rr-mcp)
Overview
karellen-rr-mcp is an MCP (Model Context Protocol) server that enables any MCP-compliant LLM client to use rr for reverse debugging. Instead of iteratively adding debug output and rebuilding, the LLM can record a failing test with rr, then replay it with full forward and reverse debugging via GDB/MI, inspecting program state without modifying source code.
Requirements
- Linux on x86-64 (rr only supports Linux; aarch64 is experimental)
- [rr](https://rr-project.org/) installed and on PATH
- [GDB](https://www.sourceware.org/gdb/) installed and on PATH (used by rr for debugging)
- Python >= 3.10
- `perf_event_paranoid` set to
1to allow recording:
sudo sysctl kernel.perf_event_paranoid=1Installing rr and GDB
Via pip (using karellen-rr):
pip install karellen-rr-mcp[rr]This installs rr as a pip package alongside karellen-rr-mcp. GDB must still be installed separately via your system package manager.
Fedora / RHEL / CentOS:
sudo dnf install rr gdbUbuntu / Debian:
sudo apt install rr gdbArch Linux:
sudo pacman -S rr gdbConfiguring perf_event_paranoid
rr requires access to hardware performance counters. Set perf_event_paranoid to 1:
sudo sysctl kernel.perf_event_paranoid=1To make this persistent across reboots:
echo 'kernel.perf_event_paranoid=1' | sudo tee /etc/sysctl.d/50-rr.confVerify the setup
rr record /bin/true && echo "rr is working"If this fails with a permissions error, check perf_event_paranoid. If it fails inside a container or VM, note that rr requires access to CPU performance counters — it does not work in most containers (Docker, Podman) or VMs unless hardware PMU passthrough is configured.
Installation
pip install karellen-rr-mcpOr with pipx for an isolated environment:
pipx install karellen-rr-mcpClaude Code Integration
Claude Code plugin (recommended)
The plugin automatically configures the MCP server and includes:
- Crash detection hook that suggests rr when a Bash command exits with a signal
(SIGSEGV, SIGABRT, SIGBUS, etc.) or output contains crash/sanitizer signatures
- `/karellen-rr-mcp:rr-debug` skill that walks through the full
record-replay-analyze workflow step by step
- `rr-investigator` agent that Claude can spawn to autonomously investigate
crashes using rr reverse execution
From the Karellen plugins marketplace:
claude plugin marketplace add karellen/claude-plugins
claude plugin install karellen-rr-mcp@karellen-pluginsOr from the official Anthropic marketplace (if accepted):
claude plugin install karellen-rr-mcp@claude-plugins-officialOr load directly from a local checkout for testing:
claude --plugin-dir /path/to/karellen-rr-mcpManual MCP server configuration
If you prefer not to use the plugin, you can configure the MCP server directly. This gives you the MCP tools but not the skill, agent, or crash detection hook.
Using the CLI:
claude mcp add --transport stdio karellen-rr-mcp -- karellen-rr-mcpOr manually add to ~/.claude.json (user scope) or .mcp.json in your project root (project scope, shared via version control):
{
"mcpServers": {
"karellen-rr-mcp": {
"type": "stdio",
"command": "karellen-rr-mcp"
}
}
}If installed with pipx:
claude mcp add --transport stdio karellen-rr-mcp -- pipx run karellen-rr-mcpor manually:
{
"mcpServers": {
"karellen-rr-mcp": {
"type": "stdio",
"command": "pipx",
"args": ["run", "karellen-rr-mcp"]
}
}
}Auto-approve rr tools
By default Claude Code will prompt for confirmation before each rr_* tool call. You can approve individually by selecting "Yes, and don't ask again" when prompted.
To auto-approve all tools upfront, add a permission rule to your user settings (~/.claude/settings.json):
{
"permissions": {
"allow": [
"mcp__plugin_karellen-rr-mcp_karellen-rr-mcp__*",
"mcp__karellen-rr-mcp__*"
]
}
}The first rule covers plugin-loaded tools, the second covers manual MCP configuration.
Or for a project-scoped setting, add the same rule to .claude/settings.json in your project root (this file can be committed to version control so all team members get it).
Available Tools
Session Lifecycle
| Tool | Description |
|---|---|
rr_record | Record a command with rr. Returns trace directory path. |
rr_replay_start | Start replay session (launches rr gdbserver + GDB/MI). |
rr_replay_stop | Stop current replay session, clean up. |
rr_list_recordings | List available rr trace recordings. |
rr_ps | List processes in a trace recording (PID, PPID, exit code, command). |
rr_traceinfo | Get trace metadata (header info in JSON format). |
rr_rm | Remove an rr trace recording. |
rr_when | Get current rr event number (position in trace). |
Breakpoints
| Tool | Description |
|---|---|
rr_breakpoint_set | Set breakpoint at function/file:line/address. |
rr_breakpoint_remove | Remove a breakpoint. |
rr_breakpoint_list | List all breakpoints. |
rr_watchpoint_set | Set hardware watchpoint (write/read/access). |
Execution Control
| Tool | Description |
|---|---|
rr_continue | Continue forward or backward. |
rr_step | Step into (forward or reverse). |
rr_next | Step over (forward or reverse). |
rr_finish | Run to function return (or call site if reverse). |
rr_run_to_event | Jump to specific rr event number. |
Thread and Frame Navigation
| Tool | Description |
|---|---|
rr_thread_list | List all threads with state and location. |
rr_thread_select | Switch to a different thread. |
rr_select_frame | Select a stack frame for inspection (locals/evaluate use that frame). |
State Inspection
| Tool | Description |
|---|---|
rr_backtrace | Get call stack. |
rr_evaluate | Evaluate C/C++ expression in current context. |
rr_locals | List local variables with values. |
rr_read_memory | Read raw memory bytes. |
rr_registers | Read CPU registers. |
rr_source_lines | List source code around current position. |
Checkpoints
| Tool | Description |
|---|---|
rr_checkpoint_save | Save checkpoint at current position. |
rr_checkpoint_restore | Restore to saved checkpoint. |
Configuration
Timeouts
All timeouts are configurable via environment variables (in seconds). Set them in your MCP server configuration:
{
"mcpServers": {
"karellen-rr-mcp": {
"type": "stdio",
"command": "karellen-rr-mcp",
"env": {
"RR_MCP_TIMEOUT_FORWARD": "300",
"RR_MCP_TIMEOUT_REVERSE": "600"
}
}
}
}| Variable | Default | Description |
|---|---|---|
RR_MCP_TIMEOUT_STARTUP | 30 | Waiting for rr gdbserver to start listening |
RR_MCP_TIMEOUT_CONNECT | 60 | GDB connecting to rr (includes symbol loading) |
RR_MCP_TIMEOUT_FORWARD | 120 | Forward execution (continue, step, next, finish) |
RR_MCP_TIMEOUT_REVERSE | 300 | Reverse execution |
RR_MCP_TIMEOUT_BREAKPOINT | 30 | Breakpoint/watchpoint operations |
RR_MCP_TIMEOUT_EVAL | 30 | State inspection (backtrace, evaluate, locals, etc.) |
For large binaries (e.g. MariaDB, Firefox), you may need to increase RR_MCP_TIMEOUT_CONNECT (symbol loading can take 20+ seconds) and RR_MCP_TIMEOUT_FORWARD (replaying to a breakpoint deep in execution can take minutes).
Troubleshooting
AMD Zen CPUs
rr does not work reliably on AMD Zen CPUs unless the hardware SpecLockMap optimization is disabled. When running rr on Zen you may see:
On Zen CPUs, rr will not work reliably unless you disable the hardware SpecLockMap optimization.
Workaround: run the zen_workaround.py script from the rr source tree as root:
sudo python3 scripts/zen_workaround.pyThis fix must be reapplied after each reboot or suspend. To make it persist, you must also stabilize the Speculative Store Bypass (SSB) mitigation by adding one of the following kernel command-line parameters:
spec_store_bypass_disable=on— fully enables SSB mitigation (has performance
implications)
nospec_store_bypass_disable— fully disables SSB mitigation (has security
implications)
Alternatively, build and load the zen_workaround.ko kernel module from the rr source tree, which prevents SSB mitigation from resetting the workaround without requiring kernel parameters.
See the rr Zen wiki page for full details.
MSR kernel module not loaded
The zen_workaround.py script accesses CPU model-specific registers via /dev/cpu/0/msr, which requires the msr kernel module. On many distributions this module is not loaded by default. If the script fails, load it manually:
sudo modprobe msrTo make this persistent across reboots:
echo 'msr' | sudo tee /etc/modules-load.d/msr.confNote: on systems with Secure Boot enabled, the msr module may fail to load because it is not signed. You may need to either disable Secure Boot in your UEFI/BIOS settings, or sign the module with your own Machine Owner Key (MOK).
MADV_GUARD_INSTALL crash on kernel 6.13+ with glibc 2.42+
Linux 6.13 introduced MADV_GUARD_INSTALL (madvise advice 102) for lightweight stack guard pages. glibc 2.42+ (e.g. Fedora 43) uses this in pthread_create. rr 5.9.0 (the latest release, from February 2025) does not recognize this madvise advice value and crashes with:
Assertion `t->regs().syscall_result_signed() == -syscall_state.expect_errno' failed to hold.
Expected EINVAL for 'madvise' but got result 0 (errno SUCCESS); unknown madvise(102)This was fixed in rr git master (commit 34ff3a7, August 2025) but has not been included in a release yet. You must build rr from source to get the fix:
git clone https://github.com/rr-debugger/rr.git
cd rr
mkdir build && cd build
cmake ..
make -j$(nproc)
sudo make installSee rr-debugger/rr#4044 and rr-debugger/rr#3995 for details.
License
Apache-2.0