IDA Pro MCP server

IDA Pro MCP serves as a Model Context Protocol (MCP) server that enables AI-assisted reverse engineering directly within IDA Pro. It connects your IDA instance to various AI assistants, allowing them to analyze and interact with your disassembled code.

Prerequisites

• Python (3.11 or higher)
  • Use idapyswitch to switch to the newest Python version
• IDA Pro (8.3 or higher, 9 recommended)
• Supported MCP Client:
  • Cline
  • Roo Code
  • Claude
  • Cursor
  • VSCode Agent Mode
  • Windsurf
  • Other MCP Clients: Run ida-pro-mcp --config to get the JSON config for your client

Installation

Install or upgrade the IDA Pro MCP package:

pip install --upgrade git+https://github.com/mrexodia/ida-pro-mcp

Configure the MCP servers and install the IDA Plugin:

ida-pro-mcp --install

Important: Completely restart IDA/Visual Studio Code/Claude for the installation to take effect. Claude runs in the background and needs to be quit from the tray icon.

Using with AI Assistants

When working with AI assistants, use specific prompting to avoid hallucinations. Here's a recommended prompt template:

Your task is to analyze a crackme in IDA Pro. You can use the MCP tools to retrieve information. In general use the following strategy:

• Inspect the decompilation and add comments with your findings
• Rename variables to more sensible names
• Change the variable and argument types if necessary (especially pointer and array types)
• Change function names to be more descriptive
• If more details are necessary, disassemble the function and add comments with your findings
• NEVER convert number bases yourself. Use the convert_number MCP tool if needed!
• Do not attempt brute forcing, derive any solutions purely from the disassembly and simple python scripts
• Create a report.md with your findings and steps taken at the end
• When you find a solution, prompt to user for feedback with the password you found

Available Functions

Basic Information

• check_connection(): Check if the IDA plugin is running
• get_metadata(): Get metadata about the current IDB
• get_current_address(): Get the address currently selected by the user
• get_current_function(): Get the function currently selected by the user
• convert_number(text, size): Convert a number to different representations

Function Operations

• get_function_by_name(name): Get a function by its name
• get_function_by_address(address): Get a function by its address
• decompile_function(address): Decompile a function at the given address
• disassemble_function(start_address): Get assembly code for a function
• rename_function(function_address, new_name): Rename a function
• set_function_prototype(function_address, prototype): Set a function's prototype

Database Navigation

• list_functions(offset, count): List all functions (paginated)
• list_globals(offset, count): List all globals (paginated)
• list_globals_filter(offset, count, filter): List matching globals (filtered)
• list_strings(offset, count): List all strings (paginated)
• list_strings_filter(offset, count, filter): List matching strings (filtered)
• get_xrefs_to(address): Get all cross references to an address
• get_xrefs_to_field(struct_name, field_name): Get all references to a struct field
• get_entry_points(): Get all entry points in the database

Modifications

• set_comment(address, comment): Set a comment for an address
• rename_local_variable(function_address, old_name, new_name): Rename a local variable
• rename_global_variable(old_name, new_name): Rename a global variable
• set_global_variable_type(variable_name, new_type): Set a global variable's type
• declare_c_type(c_declaration): Create or update a local type
• set_local_variable_type(function_address, variable_name, new_type): Set a local variable's type

Debugging Functions (require --unsafe flag)

• dbg_get_call_stack(): Get the current call stack
• dbg_get_registers(): Get all registers and their values
• dbg_run_to(address): Run the debugger to a specified address
• dbg_exit_process(): Exit the debugger
• dbg_continue_process(): Continue the debugger
• dbg_enable_breakpoint(address, enable): Enable/disable a breakpoint
• dbg_list_breakpoints(): List all breakpoints
• dbg_set_breakpoint(address): Set a breakpoint
• dbg_delete_breakpoint(address): Delete a breakpoint
• dbg_start_process(): Start the debugger

Headless Operation

You can run an SSE server to connect to the user interface:

uv run ida-pro-mcp --transport http://127.0.0.1:8744/sse

After installing idalib, you can run a headless SSE server:

uv run idalib-mcp --host 127.0.0.1 --port 8745 path/to/executable

Tips for Effective Use

When using AI assistants with IDA Pro:

1. Always instruct the AI to use the convert_number MCP function for number conversions
2. Consider using math-mcp for complex mathematical operations
3. Before using AI assistance, manually remove obfuscation such as:
   • String encryption
   • Import hashing
   • Control flow flattening
   • Code encryption
   • Anti-decompilation tricks
4. Use Lumina or FLIRT to resolve open source library code and C++ STL

How to add this MCP server to Cursor

There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.

If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.

Adding an MCP server to Cursor globally

To add a global MCP server go to Cursor Settings > MCP and click "Add new global MCP server".

When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:

{
    "mcpServers": {
        "cursor-rules-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "cursor-rules-mcp"
            ]
        }
    }
}

Adding an MCP server to a project

To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.

How to use the MCP server

Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.

The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.

You can also explictly ask the agent to use the tool by mentioning the tool name and describing what the function does.