Skip to main content

MCP server for AI-assisted IDAPython scripting via idalib

Project description

ida-code

MCP server that lets AI coding agents interact with IDA Pro. Open binaries, decompile, run IDAPython, search the API docs — all through tool calls.

Built on idalib for headless in-process operation and fastmcp for the MCP transport.

Requires a licensed IDA Pro 9.2+ with idalib support. ida-code does not install or replace IDA Pro — it loads idapro from your existing install at startup.

Install

uv tool install ida-code

This puts the ida-code CLI on your PATH (via uv's tool dir) so MCP clients can launch it directly. Don't have uv? pip install ida-code works too.

Then point IDA_INSTALL_DIR at your IDA Pro install (the directory that contains idalib/python/):

OS Typical path
Linux /opt/ida-pro-9.3
macOS /Applications/IDA Professional 9.3.app/Contents/MacOS
Windows C:\Program Files\IDA Professional 9.3

Use with Claude Code

Add ida-code to your project's .mcp.json:

{
  "mcpServers": {
    "ida-code": {
      "command": "ida-code",
      "env": {
        "IDA_INSTALL_DIR": "/opt/ida-pro-9.3"
      }
    }
  }
}

Restart Claude Code; the server is picked up automatically. You can confirm it's wired up by asking Claude to open a binary — it should call open_database and report architecture, entry point, and load address.

For other MCP clients, run the server directly:

IDA_INSTALL_DIR=/opt/ida-pro-9.3 ida-code   # stdio transport

Tools (35)

Full parameter docs live in each tool's docstring — surfaced automatically to MCP clients via tools/list.

Domain Tools
Database open_database, close_database, get_database_info, list_architectures
Code execution execute, execute_file
Navigation list_functions, decompile, get_disassembly, get_xrefs_to, get_xrefs_from
Annotation rename_function, retype_function, get_comment, set_comment, delete_comment, get_variable, set_variable
Structures list_structures, get_structure, create_structure, edit_structure, delete_structure
Snapshots list_snapshots, create_snapshot, restore_snapshot, delete_snapshot
Undo/redo get_undo_status, perform_undo, perform_redo
Inventory get_strings, get_imports, get_exports
Search search_docs, search_examples

Resources & prompts

Type URI / name Purpose
Resource guidelines://standalone_script Boilerplate for standalone idalib scripts
Resource guidelines://plugin Boilerplate for IDA plugins (plugin_t)
Resource guidelines://idapython_script Boilerplate for IDAPython scripts run inside IDA GUI
Prompt reverse_engineer Five-phase RE workflow (recon, triage, analysis, annotation, iteration)
Prompt create_script Coding guidelines for a chosen target script type

Transport modes

ida-code                          # stdio (default)
ida-code --http                   # streamable-http on 127.0.0.1:8080
ida-code --http 0.0.0.0:9090      # custom host:port
ida-code --sse                    # SSE on 127.0.0.1:8080
ida-code --sse :9090              # SSE on 127.0.0.1:9090

HTTP/SSE require bearer token auth. Set MCP_AUTH_TOKEN or let the server generate one (printed to stderr on startup).

Environment variables

Variable Default Description
IDA_INSTALL_DIR /opt/ida-pro-9.3 IDA Pro installation directory (must contain idalib/python/)
LOG_LEVEL WARNING Logging verbosity (DEBUG, INFO, WARNING, ERROR)
MCP_AUTH_TOKEN (auto-generated) Bearer token for HTTP/SSE transports

Doc and example paths are derived from IDA_INSTALL_DIR (docs/, python/, python/examples/).

Install from source

git clone https://github.com/Dil4rd/ida-code
cd ida-code
uv sync
uv run ida-code

When wiring a source checkout into .mcp.json, use uv as the command:

{
  "mcpServers": {
    "ida-code": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/ida-code", "ida-code"],
      "env": { "IDA_INSTALL_DIR": "/opt/ida-pro-9.3" }
    }
  }
}

Note: the fastmcp dependency is the community fastmcp package, not the official mcp SDK. Don't install mcp by mistake.

Development

uv sync --extra dev
uv run pytest

The test suite covers the executor, doc/example search, comments, snapshots, structures, undo, variables, and Mach-O parsing. Tests that need idalib are skipped if it's not available.

Credits

Thanks to @p41l for ideas and for testing the tool across different LLMs.

License

MIT — see LICENSE.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ida_code-0.2.1.tar.gz (49.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

ida_code-0.2.1-py3-none-any.whl (43.1 kB view details)

Uploaded Python 3

File details

Details for the file ida_code-0.2.1.tar.gz.

File metadata

  • Download URL: ida_code-0.2.1.tar.gz
  • Upload date:
  • Size: 49.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ida_code-0.2.1.tar.gz
Algorithm Hash digest
SHA256 bc57d8ff65e852bcc897938ba882293ac7e11f56177a7841b534fa882fbdade3
MD5 0c98ae826d5a5db6880d3b1b6b9d97cd
BLAKE2b-256 c7e6904697e6d7ab8a652c2dde0a1b9e7514b5985400ee65425cc3372a088491

See more details on using hashes here.

Provenance

The following attestation bundles were made for ida_code-0.2.1.tar.gz:

Publisher: publish-pypi.yml on sploit00n/ida-code

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file ida_code-0.2.1-py3-none-any.whl.

File metadata

  • Download URL: ida_code-0.2.1-py3-none-any.whl
  • Upload date:
  • Size: 43.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ida_code-0.2.1-py3-none-any.whl
Algorithm Hash digest
SHA256 0864d844799d43219efd7bd785ea0139a2eaf3622208c10a0ce05384e1fbcfc6
MD5 550f3aa7533d4d1e45d5854966a7f289
BLAKE2b-256 82629e11fc3007760133c5e828cf6e1635f57e89cba5df784a5fc9609c07109c

See more details on using hashes here.

Provenance

The following attestation bundles were made for ida_code-0.2.1-py3-none-any.whl:

Publisher: publish-pypi.yml on sploit00n/ida-code

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page