MCP Directory

IDA Pro MCP

AI-powered reverse engineering: bridge IDA Pro to LLMs for vibe reversing via MCP.

Unverified
HTTP (remote)
No auth
Python
View repo 9.7k Website

Add to your client

Copy the config for your MCP client and paste it into its config file.

Install / run
pip install https://github.com/mrexodia/ida-pro-mcp/archive/refs/heads/main.zip && ida-pro-mcp --install

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "http://127.0.0.1:13337/mcp"
      ]
    }
  }
}

Claude Desktop connects to remote servers through the `mcp-remote` proxy (installed on first run via npx). Restart Claude Desktop after saving.

Step-by-step guides: Add to Claude Desktop · Add to Cursor · Add to Windsurf

Before you start

  • Python 3.11 or higher (use idapyswitch to select the newest Python)
  • IDA Pro 8.3 or higher (9 recommended); IDA Free is not supported
  • A supported MCP client (Claude, Claude Code, Cursor, VS Code, Windsurf, Cline, etc.)
  • For headless mode: idalib activated globally (py-activate-idalib.py) and uv installed

About IDA Pro MCP

An MCP server that connects IDA Pro to LLM clients so an AI agent can analyze binaries: decompile and disassemble functions, read and rewrite comments, rename variables/functions, recover and apply types and structures, read memory, inspect stack frames, search for bytes/instructions/strings, build call graphs, export functions, run arbitrary Python in IDA, and optionally drive the debugger. It offers a GUI plugin exposing an HTTP/SSE endpoint on port 13337, plus a headless idalib supervisor (idalib-mcp) with persistent per-database worker processes that can run over stdio or HTTP. The Claude Code install path uses the author's plugin marketplace; manual install configures any supported MCP client via 'ida-pro-mcp --install' or prints config with 'ida-pro-mcp --config'.

Tools & capabilities (51)

lookup_funcs

Get function(s) by address or name (auto-detects; accepts a list or comma-separated string).

int_convert

Convert numbers between formats (decimal, hex, bytes, ASCII, binary).

list_funcs

List functions (paginated, filtered).

list_globals

List global variables (paginated, filtered).

imports

List all imported symbols with module names (paginated).

decompile

Decompile the function at the given address.

disasm

Disassemble a function with full details (arguments, stack frame, etc.).

xrefs_to

Get all cross-references to address(es).

xrefs_to_field

Get cross-references to specific struct field(s).

callees

Get functions called by function(s) at address(es).

add_bookmark

Add or replace the IDA bookmark at an address.

set_comments

Set comments at address(es) in both disassembly and decompiler views.

patch_asm

Patch assembly instructions at address(es).

declare_type

Declare C type(s) in the local type library.

define_func

Define function(s) at address(es), optionally with explicit end bounds.

define_code

Convert bytes to code instruction(s) at address(es).

undefine

Undefine item(s) at address(es), converting back to raw bytes.

get_bytes

Read raw bytes at address(es).

get_int

Read integer values using a type (i8/u64/i16le/i16be/etc.).

get_string

Read null-terminated string(s).

get_global_value

Read global variable value(s) by address or name (compile-time values).

stack_frame

Get stack frame variables for function(s).

declare_stack

Create stack variable(s) at specified offset(s).

delete_stack

Delete stack variable(s) by name.

read_struct

Read structure field values at specific address(es).

search_structs

Search structures by name pattern.

py_eval

Execute arbitrary Python code in IDA context (returns result/stdout/stderr, Jupyter-style).

analyze_funcs

Comprehensive function analysis: decompilation, assembly, xrefs, callees, callers, strings, constants, basic blocks.

find_regex

Search strings with case-insensitive regex (paginated).

find_bytes

Find byte pattern(s) in the binary (e.g. '48 8B ?? ??').

find_insns

Find instruction sequence(s) in code.

find

Advanced search for immediate values, strings, and data/code references.

basic_blocks

Get basic blocks with successors and predecessors.

set_type

Apply type(s) to functions, globals, locals, or stack variables.

infer_types

Infer types at address(es) using Hex-Rays or heuristics.

export_funcs

Export function(s) in json, c_header, or prototypes format.

callgraph

Build a call graph from root function(s) with configurable depth.

rename

Unified batch rename for functions, globals, locals, and stack variables.

patch

Patch multiple byte sequences at once.

put_int

Write integer values using a type (i8/u64/i16le/i16be/etc.).

idb_open

(idalib) Open a binary in a headless worker (or adopt a running instance) and return its session ID.

idb_list

(idalib) List open sessions and running GUI IDA instances with backend/active/PID info.

idb_save

(idalib) Save a session's IDB to disk.

server_health

(idalib) Report per-database health for a session.

dbg_start

(dbg extension) Start the debugger process.

dbg_run_to

(dbg extension) Run to an address.

dbg_add_bp

(dbg extension) Add breakpoint(s).

dbg_regs

(dbg extension) Read all registers for the current thread.

dbg_stacktrace

(dbg extension) Get the call stack with module/symbol info.

dbg_read

(dbg extension) Read memory from the debugged process.

dbg_write

(dbg extension) Write memory to the debugged process.

When to use it

  • Vibe-reversing crackmes and CTF binaries: let the LLM decompile, comment, rename, and derive the solution.
  • Malware analysis: drive systematic decompilation, type recovery, and documentation of unknown samples.
  • Headless/batch reverse engineering across many binaries using the idalib supervisor with persistent workers.
  • Interactive debugging from an agent (breakpoints, stepping, register/memory inspection) via the dbg extension.
  • Automated reporting: have the agent produce RE markdown reports of findings and methodology.

Security notes

The server runs locally and exposes IDA over an unauthenticated HTTP/SSE endpoint on 127.0.0.1:13337 (no auth tokens). The py_eval tool executes arbitrary Python in IDA's process context, and patch/define/undefine/dbg_* tools can modify the database and (with the dbg extension) control a debugged process — only point it at binaries and clients you trust. The debugger extension is hidden by default and must be explicitly enabled via the ?ext=dbg query parameter.

IDA Pro MCP FAQ

Does it work with IDA Free?

No. IDA Pro 8.3 or higher is required (version 9 recommended); IDA Free is not supported.

How do I install it for Claude Code?

Add the author's marketplace and install the plugin: 'claude plugin marketplace add mrexodia/claude-marketplace' then 'claude plugin install ida-pro-mcp@mrexodia'. This headless path requires idalib activated globally and uv installed.

What's the difference between the GUI plugin and idalib-mcp?

The GUI plugin exposes a running IDA instance over HTTP/SSE (port 13337). idalib-mcp is a headless supervisor that opens databases in detached idalib worker processes and supports stdio or HTTP; the README notes the GUI plugin is no longer recommended and idalib-mcp is preferred.

How do I enable the debugger tools?

Debugger tools are hidden by default. Append the ?ext=dbg query parameter to the endpoint, e.g. http://127.0.0.1:13337/mcp?ext=dbg.

Why does the LLM get math/number conversions wrong?

LLMs hallucinate on base conversions. Tell the model to use the int_convert tool and never convert bases itself; for heavier math you may also add math-mcp.

#reverse-engineering#ida-pro#binary-analysis#decompiler#disassembly#malware-analysis#debugging#ida-plugin

Alternatives to IDA Pro MCP

Compare all alternatives →
Playwright MCP Server
Developer Tools
24k

Microsoft's official browser-automation MCP using Playwright's accessibility tree (no vision model).

Featured
Verified
stdio (local)
No auth
TypeScript
12 tools
Updated 21 days agoRepo
Context7 MCP Server
Developer Tools
28k

Up-to-date, version-specific library documentation injected into your coding agent.

Verified
stdio (local)
API key
TypeScript
2 tools
Updated 25 days agoRepo
codebase-memory-mcp
Developer Tools
16k

Code intelligence engine that indexes repos into a persistent knowledge graph for AI coding agents.

Unverified
stdio (local)
No auth
C
14 tools
Updated 11 hours agoRepo

Compare IDA Pro MCP with:

vs Playwright MCP Servervs Context7 MCP Servervs codebase-memory-mcpvs Serena