IDA Pro

You use the MCP server to connect your IDA Pro workflows to a remote or local MCP client, enabling scripted analysis, navigation, and automation for reverse engineering tasks. This setup makes it easier to load binaries, run analyses, rename variables, add comments, and run custom Python code across your IDA projects.

How to use

You interact with the MCP server through an MCP client of your choice. Start the server in a way that fits your workflow (headless or with a live IDA session), then connect the client to the server. Typical usage patterns include loading a binary into a headless session, performing repetitive analysis tasks via the client, and saving analyses for future sessions. You can switch between binaries in a single session, persist your analysis to disk, and execute arbitrary IDAPython code to automate tasks such as decompilation, comment insertion, and variable renaming.

How to install

# Prerequisites
# - Python 3.11 or higher
# - A modern MCP client (e.g., idalib, VSCode integration, or other supported clients)
# - A compatible environment for running the MCP server

# Install the MCP package
pip uninstall ida-pro-mcp
pip install https://github.com/icryo/ida-pro-mcp/archive/refs/heads/main.zip

# Install the MCP server plugin for your environment
ida-pro-mcp --install

# Important: completely restart the application(s) after installation to ensure the plugin and server are wired up correctly. If you use Claude, quit it from the tray icon as needed.

The next steps depend on whether you want a remote HTTP transport or a local, headless server. You can also load and switch binaries dynamically in a headless session. A typical flow is to start a headless server, load a binary, perform analyses, save the database, and then switch to another binary if needed.

Additional sections

Configuration and transport options include an HTTP-based transport for an SSE server and a headless local server via a command-line tool. For remote UI transport, you can run an SSE server and connect with your frontend client, for example via a transport URL such as a local SSE endpoint.

Headless MCP server with dynamic database loading lets you start without a binary and load or switch binaries on demand. You can load a binary with load_database("/path/to/binary.exe"), inspect, rename, and annotate, then save the analysis with save_database("/path/to/backup.i64"). You can also check current status with get_database_status() and close the database with close_database().

If you want to run a local MCP server alongside IDA, you can start the server in a headless mode using a command such as uv run idalib-mcp --host 127.0.0.1 --port 8745, optionally providing the path to a binary to load at startup. Use get_database_status() to verify the current state of the loaded database.

Notes and tips

Make sure to restart tools after installation to ensure plugins and servers are loaded correctly. For Windows environments, verify that the plugin appears under the appropriate Plugins menu once the MCP server starts.

If you encounter connection issues, confirm that the MCP client is running and that you are pointing to the correct transport URL or stdio command. Use the available tooling to check the server status and to load/save databases as needed.

Example configuration snippets

{
  "mcpServers": {
    "ida_http_transport": {
      "type": "http",
      "name": "ida_http_transport",
      "url": "http://127.0.0.1:8744/sse",
      "args": []
    },
    "idalib_stdio_local": {
      "type": "stdio",
      "name": "idalib_stdio_local",
      "command": "uv",
      "args": ["run", "idalib-mcp", "--host", "127.0.0.1", "--port", "8745", "path/to/executable"]
    },
    "idalib_stdio_no_binary": {
      "type": "stdio",
      "name": "idalib_stdio_no_binary",
      "command": "uv",
      "args": ["run", "idalib-mcp", "--host", "127.0.0.1", "--port", "8745"]
    }
  }
}

Available tools

check_connection

Check if the IDA Pro MCP plugin is currently running and able to communicate with the server.

get_metadata

Retrieve metadata about the current IDA project and loaded data.

load_database

Load a binary or IDB into the headless server for analysis, enabling dynamic switching between binaries.

save_database

Persist the current analysis state to disk so you can resume later.

close_database

Close the currently loaded database without exiting the server.

get_database_status

Query the server to determine whether a database is loaded and what path it is using.

get_function_by_name

Retrieve information about a function by its name in the loaded database.

get_function_by_address

Retrieve information about a function by its starting address in the loaded database.

decompile_function

Decompile a function at a given address to obtain C-like pseudo-code.

disassemble_function

Disassemble a function to show raw assembly starting from a given address.

get_xrefs_to

Get all cross references to a specific address in the binary.

get_structure_info

Query information about user-defined structures or types.

rename_function

Rename a function to a more descriptive name.

set_function_prototype

Set or update a function's prototype signature.

add_comment

Add a comment at an address with a specified comment type.

get_comments

Retrieve all comments at a given address.

set_comment

Set or update a comment at an address in the function disassembly.

search_bytes

Search for a byte pattern, including wildcards, within the loaded binary.

get_function_cfg

Obtain the control flow graph for a function, including basic blocks and their relationships.

execute_script

Execute arbitrary IDAPython code with access to IDA modules.

get_stack_frame_variables

Retrieve the stack frame variables for a given function.

rename_local_variable

Rename a local variable within a function.

patch_address_assembles

Patch instructions at a given address with new assembly.

get_global_variable_value_by_name

Read a global variable's value if it is known at compile time.

get_global_variable_value_at_address

Read the value of a global variable by its address if known at compile time.

rename_global_variable

Rename a global variable to a more descriptive name.

set_global_variable_type

Set a global variable's type.