# IDA Pro MCP [Health: Active] **Category:** πŸ’» Developer Tools **Repository:** https://github.com/GrecAndrei/ida-pro-mcp **GitHub Stars:** 10 **Views:** 0 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/ida-pro-mcp ## Description Deterministic, local-first MCP server for IDA Pro and IDA Home with 109 strict-schema reverse-engineering operations, policy-gated mutations, and evidence tracking. ## Claude Desktop Quick Installation Heuristic fallback β€” verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low): ```json "mcpServers": { "ida-pro-mcp": { "command": "npx", "args": ["-y","ida-pro-mcp"] } } ``` ## Documentation & README

IDA Pro 9.0+ Python 3.11+ MCP 2.0 40 Tools Session Support


πŸ”¬ IDA Pro MCP Server
Standalone Model Context Protocol for IDA Pro

AI-powered reverse engineering without launching IDA Pro GUI.
40 comprehensive tools for binary analysis, decompilation, and annotation.
Multi-session support - multiple LLMs can analyze the same binary simultaneously.
Works with Claude, Gemini, Cursor, VS Code, and any MCP-compatible client.

--- ## ⚑ Quick Start ### 1. Install for Google Antigravity / IDE Integration ```bash cd ida-pro-mcp python install_antigravity.py ``` This adds the MCP server to your IDE's `mcp_config.json`. Restart your IDE. ### 2. Or Add Manually to MCP Config ```json { "mcpServers": { "ida-pro-mcp": { "type": "stdio", "command": "python", "args": ["C:/path/to/ida-pro-mcp/ida_mcp_stdio.py"], "env": { "IDADIR": "C:/Program Files/IDA Professional 9.2" } } } } ``` ### 3. Use It ```python # Get IDB metadata idb(idb="C:/samples/malware.exe.i64", action="meta") # List all functions data(idb="C:/samples/malware.exe.i64", action="functions", count=50) # Decompile a function code(idb="C:/samples/malware.exe.i64", action="decompile", addrs="0x401000") # Search for patterns search(idb="C:/samples/malware.exe.i64", action="bytes", pattern="48 83 EC ?? 48 8B") ``` --- ## 🎯 Architecture ``` β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” MCP Protocol β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ AI Client │◄────────────────────►│ ida_mcp_stdio β”‚ β”‚ (Claude, Gemini)β”‚ stdio β”‚ (Python) β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β”‚ spawns β–Ό β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ idat.exe β”‚ β”‚ (Headless IDA) β”‚ β”‚ per-request β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β”‚ IDAPython β–Ό β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ api_consolidatedβ”‚ β”‚ 23 tools β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ ``` **Key Features:** - **Fully Standalone**: No IDA GUI required - uses headless `idat.exe` - **MCP Stdio Protocol**: Works with any MCP-compatible client - **40 Comprehensive Tools**: Covers all reverse engineering needs - **Session Management**: Multiple LLMs can analyze the same binary with separate IDBs - **File Locking**: Automatic lock detection prevents conflicts - **Structured Errors**: Clear error codes for LLM understanding --- ## πŸ“¦ Complete Tool Reference ### Session Management | Tool | Description | Key Actions | | --------- | ------------------------- | ----------------------------------------------- | | `session` | Multi-file/multi-LLM mgmt | `discover`, `create`, `list`, `switch`, `close` | > **Sessions enable:** > > - Multiple LLMs analyzing the same binary with separate IDBs > - Seamless switching between multiple open files > - Automatic file locking to prevent conflicts > - IDB discovery with "in use" status ### Static Analysis Tools | Tool | Description | Key Actions | | -------- | --------------------------- | ------------------------------------------------------------- | | `idb` | Database metadata | `meta`, `segments`, `cursor`, `entrypoints` | | `code` | Decompilation & disassembly | `decompile`, `disassemble`, `xrefs_to`, `xrefs_from`, `graph` | | `data` | Data enumeration | `functions`, `globals`, `strings`, `imports`, `exports` | | `search` | Pattern search | `bytes`, `string`, `immediate`, `name`, `pattern` | | `types` | Type management | `list`, `get`, `define`, `apply`, `get_members` | ### Modification Tools | Tool | Description | Key Actions | | ------------- | ---------------------- | ------------------------------------------------------------- | | `modify` | Rename, comment, patch | `rename`, `comment`, `set_type`, `patch` | | `funcs` | Function management | `create`, `delete`, `set_flags`, `add_comment` | | `segments` | Segment management | `list`, `add`, `delete`, `set_attr` | | `bulk` | Batch operations | `rename`, `comment`, `set_type`, `import_json`, `export_json` | | `comments_ai` | AI-optimized comments | `get_context`, `set_structured`, `bulk_set`, `export_md` | ### Advanced Analysis Tools | Tool | Description | Key Actions | | ---------------- | -------------------------- | ----------------------------------------------------------------------- | | `agent` | High-level helpers | `analyze_function`, `explore_address`, `find_references`, `search_all` | | `microcode` | Hex-Rays IR | `get`, `blocks`, `instructions` | | `graph` | Graph export | `callgraph`, `cfg` | | `memory` | Memory read/write | `read`, `write` | | `ctree` | Hex-Rays AST access | `get`, `find_calls`, `find_vars`, `find_strings`, `find_conditions` | | `diff` | Binary diffing | `functions`, `bytes`, `signatures`, `names`, `summary` | | `lumina` | Cloud function recognition | `pull`, `push`, `status`, `history`, `search` | | `symbols` | Debug symbols (PDB/DWARF) | `load_pdb`, `load_dwarf`, `status`, `apply`, `export` | | `patterns` | FLIRT pattern matching | `generate`, `match`, `list_sigs`, `apply_sig`, `create_sig` | | `structs` | Struct recovery | `recover`, `analyze_usage`, `list`, `create`, `apply` | | `emulate` | Code emulation | `snippet`, `appcall`, `trace`, `decrypt_strings`, `eval_expr` | | `export` | Multi-format export | `listing`, `html`, `idc`, `json`, `binexport`, `headers` | | `history` | DB version control | `undo`, `redo`, `list`, `snapshot`, `restore`, `diff` | | `strings_xref` | Advanced string analysis | `analyze`, `xref_chain`, `detect_encoded`, `find_format`, `clusters` | | `entropy` | Entropy analysis | `section`, `region`, `packed_detect`, `crypto_detect`, `compare` | | `imports_deep` | Deep import analysis | `thunks`, `delay`, `forwarded`, `ordinal`, `api_sets`, `resolve` | | `trace_analysis` | Execution trace analysis | `import_trace`, `analyze_coverage`, `find_loops`, `extract_api_calls` | | `hooks` | Hook script generation | `suggest`, `generate_frida`, `generate_detours`, `find_targets` | | `taint` | Static taint analysis | `trace_arg`, `trace_return`, `find_sinks`, `data_flow`, `slice` | | `coverage` | Code coverage analysis | `import_drcov`, `import_lighthouse`, `highlight`, `report`, `uncovered` | ### Utility Tools | Tool | Description | Key Actions | | ---------- | ----------------------- | ---------------------------------------------------------- | | `misc` | Python exec, signatures | `python`, `idc`, `load_sig`, `bookmarks` | | `files` | Database I/O | `save`, `close`, `open`, `batch` | | `plugins` | Plugin management | `list`, `run` | | `trace` | Debugger traces | `get`, `clear`, `set_options` | | `fixups` | Relocations | `list`, `get`, `add`, `delete` | | `data_ops` | Data creation | `make_data`, `make_array`, `make_string`, `make_code` | | `debug` | Debugger control | `start`, `stop`, `continue`, `step`, `breakpoints`, `regs` | | `nav` | Navigation helpers | `bookmarks`, `goto`, `cursor`, `interesting` | | `colorize` | Code coloring | `set_func`, `set_range`, `get`, `clear`, `palette` | --- ## πŸ”Œ Supported MCP Clients | Client | Status | Notes | | ---------------------- | -------------- | ----------------------------------- | | **Google Antigravity** | βœ… Recommended | Use `install_antigravity.py` | | Claude Desktop | βœ… Full | Add to `claude_desktop_config.json` | | Cursor | βœ… Full | Add to settings.json | | VS Code | βœ… Full | MCP extension | | Gemini CLI | βœ… Full | Google's CLI | --- ## πŸ› οΈ Alternative: HTTP Daemon Mode For batch analysis or custom integrations, use the HTTP daemon: ```bash # Start daemon python ida_mcp_daemon.py --port 13338 # Call tools via HTTP curl -X POST http://127.0.0.1:13338 -d '{ "action": "tool", "tool": "data", "idb": "C:/samples/malware.exe.i64", "args": {"action": "functions", "count": 10} }' ``` --- ## πŸ“ Project Structure ``` ida-pro-mcp/ β”œβ”€β”€ ida_mcp_stdio.py # MCP stdio server (main entry point) β”œβ”€β”€ ida_mcp_daemon.py # HTTP daemon (alternative mode) β”œβ”€β”€ install_antigravity.py # IDE installer β”œβ”€β”€ src/ida_pro_mcp/ β”‚ └── ida_mcp/ β”‚ β”œβ”€β”€ api_consolidated.py # All 20 tool implementations β”‚ β”œβ”€β”€ utils.py # Helper functions β”‚ └── zeromcp/ # MCP protocol library β”œβ”€β”€ archive/ # Legacy files (tests, docs) └── README.md ``` --- ## πŸ›‘οΈ Requirements - **IDA Pro 9.0+** with Hex-Rays decompiler - **Python 3.11+** - **Windows** (Linux support planned) Set `IDADIR` environment variable to your IDA installation path: ```bash set IDADIR=C:\Program Files\IDA Professional 9.2 ``` --- ## πŸ“ License MIT License ---

Built for reverse engineers who prefer AI assistance over tedious clicking.