Attach to a Running Process

Use attach flows when the target is already running and you want pwno-mcp to join that process instead of starting it with run.

Option 1: MCP tool attach

Create a debug session

{"tool":"create_debug_session","arguments":{"session_id":"chal-a"}}

Optionally load the binary first

{"tool":"set_file","arguments":{"binary_path":"/workspace/chal","session_id":"chal-a"}}

This helps when symbol loading matters before the attach.

Attach to the PID

{"tool":"attach","arguments":{"pid":31337,"session_id":"chal-a"}}

Inspect the attached process

{"tool":"get_context","arguments":{"context_type":"backtrace","session_id":"chal-a"}}

Option 2: Attach sidecar API

The local HTTP attach helper is useful for external scripts and wrappers. It is only started in HTTP mode.

{
  "pre": ["set pagination off"],
  "pid": 31337,
  "after": ["info threads"],
  "where": "/workspace/chal",
  "session_id": "chal-a"
}

from pwnomcp.cli import attach

response = attach(
    pid=31337,
    session_id="chal-a",
    gdbscript=["set pagination off"],
    artifact_path="/workspace/chal",
)
print(response.model_dump())

Attach flows still require the same ptrace-related Docker capabilities as normal debugger control.

When to use which path

use the MCP attach tool inside normal agent flows
use the attach sidecar API when you already have a local helper script or external integration that wants a simple HTTP entrypoint

See Attach API Reference for the full request and response contract.

​Option 1: MCP tool attach

​Option 2: Attach sidecar API

​When to use which path

Option 1: MCP tool attach

Option 2: Attach sidecar API

When to use which path