ida-pro-mcp

Overview

IDA Pro MCP is a sophisticated MCP server that bridges IDA Pro, the industry-standard binary analysis tool, with language models through the Model Context Protocol. It provides both GUI and headless modes, allowing AI assistants to interact with disassembled code, decompilation results, and binary analysis data. The server exposes numerous tools for decompilation, disassembly, cross-referencing, and metadata extraction, making it ideal for automated reverse engineering tasks and malware analysis workflows.

Try asking AI

After installing, here are 4 things you can ask your AI assistant:

• lookup_funcslookup_funcs(queries)

  Get function(s) by address or name (auto-detects, accepts list or comma-separated string).

  Try:Find the main functionTry:Look up functions at address 0x401000
• int_convertint_convert(inputs)

  Convert numbers to different formats (decimal, hex, bytes, ASCII, binary).

  Try:Convert 0x42 to decimalTry:Convert 255 to bytes
• list_funcslist_funcs(queries)

  List functions (paginated, filtered).

  Try:List all functionsTry:List functions containing 'password'
• list_globalslist_globals(queries)

  List global variables (paginated, filtered).

  Try:Show global variablesTry:List globals in the data section
• importsimports(offset, count)

  List all imported symbols with module names (paginated).

  Try:List imports from kernel32Try:Show all imported functions
• decompiledecompile(addr)

  Decompile function at the given address.

  Try:Decompile function at 0x401000Try:Show decompilation of main
• disasmdisasm(addr)

  Disassemble function with full details (arguments, stack frame, etc).

  Try:Disassemble the function at 0x401000Try:Show assembly of main
• xrefs_toxrefs_to(addrs)

  Get all cross-references to address(es).

  Try:Find references to this functionTry:Show what calls this address
• xrefs_to_fieldxrefs_to_field(queries)

  Get cross-references to specific struct field(s).

  Try:Find references to this struct fieldTry:Show who uses this field
• calleescallees(addrs)

  Get functions called by function(s) at address(es).

  Try:Show functions called by mainTry:List callees at 0x401000
• get_bytesget_bytes(addrs)

  Read raw bytes at address(es).

  Try:Get bytes at 0x401000Try:Read memory at this address
• get_stringget_string(addrs)

  Read null-terminated string(s).

  Try:Get string at 0x401000Try:Read the string at this address

Comparable tools

Installation

claude plugin marketplace add mrexodia/claude-marketplace
claude plugin install ida-pro-mcp@mrexodia

claude plugin update ida-pro-mcp@mrexodia

pip install https://github.com/mrexodia/ida-pro-mcp/archive/refs/heads/main.zip
ida-pro-mcp --install

FAQ

What version of IDA Pro is required?

IDA Pro 8.3 or higher (9 recommended). IDA Free is not supported.

What Python version is required?

Python 3.11 or higher. Use idapyswitch to switch to the newest Python version.

On Hacker News

Recent discussion from the developer community.

• Ida Pro MCP – Simple MCP Server to Allow Vibe Reversing in Ida Pro▲ 1
  Story by g-mork · 2025-03-26

Compare ida-pro-mcp with