IDA Pro MCP server for AI agents

This MCP server enables AI-assisted reverse engineering in IDA Pro by connecting your disassembler to AI assistants through the Model Context Protocol.

Installation

To install the IDA Pro MCP server, you need to meet the following prerequisites:

Python 3.11 or higher (use idapyswitch to upgrade if needed)
IDA Pro 8.3 or higher (version 9 recommended, IDA Free is not supported)
A compatible MCP Client such as Cline, Claude, Cursor, or VSCode Agent Mode

Follow these installation steps:

pip uninstall ida-pro-mcp
pip install https://github.com/mrexodia/ida-pro-mcp/archive/refs/heads/main.zip
ida-pro-mcp --install

Important: Completely restart IDA Pro and your MCP client (such as Claude, VSCode, etc.) after installation. If using Claude, remember to quit it from the system tray.

Using MCP Resources

MCP Resources provide read-only access to IDB state through REST-like URI patterns:

Core IDB Information

ida://idb/metadata - Get IDB file info including path, architecture, base address
ida://idb/segments - View memory segments with permissions
ida://idb/entrypoints - See all entry points (main, TLS callbacks, etc.)

Code Navigation

ida://functions - List all functions (paginated, filterable)
ida://function/{addr} - View function details at specific address
ida://globals - Browse global variables
ida://global/{name_or_addr} - View global variable details

Data Exploration

ida://strings - View all strings in the binary
ida://string/{addr} - Get string details at specific address
ida://imports - See imported functions
ida://exports - See exported functions

Type Information

ida://types - Browse all local types
ida://structs - View all structures/unions
ida://struct/{name} - See structure definition with fields

Using MCP Functions

The MCP server provides numerous functions to interact with IDA Pro:

Core Analysis Functions

idb_meta() - Get IDB metadata
lookup_funcs(queries) - Find functions by address or name
decompile(addrs) - Decompile functions
disasm(addrs) - Disassemble functions with full details
xrefs_to(addrs) - Get cross-references to addresses
callees(addrs) - Find functions called by specific functions
callers(addrs) - Find functions that call specific functions

Modifying the Database

set_comments(items) - Set comments in disassembly and decompiler views
patch_asm(items) - Patch assembly instructions
declare_type(decls) - Declare C types in the type library
rename(batch) - Batch rename functions, globals, locals, and stack variables

Memory Operations

get_bytes(addrs) - Read raw bytes
get_string(addrs) - Read null-terminated strings
get_u8/16/32/64(addrs) - Read integers of various sizes
get_global_value(queries) - Read global variable values

Debugger Operations

dbg_regs() - Get register values
dbg_callstack() - Get call stack with module information
dbg_list_bps() - List all breakpoints
dbg_start() - Start debugger
dbg_continue() - Continue execution
dbg_add_bp(addrs) - Add breakpoints
dbg_step_into/over() - Step through code

Search Operations

find_bytes(patterns, limit, offset) - Find byte patterns
find_insns(sequences, limit, offset) - Find instruction sequences
search(type, targets, limit, offset) - Perform advanced searches

Effective Prompting for Reverse Engineering

When using MCP with AI assistants for reverse engineering, consider the following prompt template:

Your task is to analyze a crackme in IDA Pro. You can use the MCP tools to retrieve information. In general use the following strategy:

- Inspect the decompilation and add comments with your findings
- Rename variables to more sensible names
- Change the variable and argument types if necessary (especially pointer and array types)
- Change function names to be more descriptive
- If more details are necessary, disassemble the function and add comments with your findings
- NEVER convert number bases yourself. Use the `int_convert` MCP tool if needed!
- Do not attempt brute forcing, derive any solutions purely from the disassembly and simple python scripts
- Create a report.md with your findings and steps taken at the end
- When you find a solution, prompt to user for feedback with the password you found

Headless MCP Server

You can run an SSE server to connect to the user interface:

uv run ida-pro-mcp --transport http://127.0.0.1:8744/sse

If you've installed idalib, you can also run a headless SSE server:

uv run idalib-mcp --host 127.0.0.1 --port 8745 path/to/executable

Tips for Better Results

For best results when using MCP with AI assistants:

Tell the AI to use int_convert for mathematical operations, especially for number base conversions
Remove obfuscation before analysis (string encryption, import hashing, control flow flattening)
Use Lumina or FLIRT to identify standard library code
Provide clear, specific instructions in your prompts
Restart IDA Pro and your MCP client if you encounter connectivity issues

How to install this MCP server

For Claude Code

To add this MCP server to Claude Code, run this command in your terminal:

claude mcp add-json "github-com-mrexodia-ida-pro-mcp" '{"command":"uv","args":["run","ida-pro-mcp","--install-plugin"],"timeout":1800}'

See the official Claude Code MCP documentation for more details.

For Cursor

There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.

If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.

Adding an MCP server to Cursor globally

To add a global MCP server go to Cursor Settings > Tools & Integrations and click "New MCP Server".

When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:

{
    "mcpServers": {
        "github.com/mrexodia/ida-pro-mcp": {
            "command": "uv",
            "args": [
                "run",
                "ida-pro-mcp",
                "--install-plugin"
            ],
            "timeout": 1800
        }
    }
}

Adding an MCP server to a project

To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.

How to use the MCP server

Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.

The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.

You can also explicitly ask the agent to use the tool by mentioning the tool name and describing what the function does.

For Claude Desktop

To add this MCP server to Claude Desktop:

1. Find your configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

2. Add this to your configuration file:

{
    "mcpServers": {
        "github.com/mrexodia/ida-pro-mcp": {
            "command": "uv",
            "args": [
                "run",
                "ida-pro-mcp",
                "--install-plugin"
            ],
            "timeout": 1800
        }
    }
}

3. Restart Claude Desktop for the changes to take effect