Skip to main content

MCP server for AI-assisted IDAPython scripting via idalib

Project description

ida-code

MCP server that lets AI coding agents interact with IDA Pro. Open binaries, decompile, run IDAPython, search the API docs — all through tool calls.

Built on idalib for headless in-process operation and fastmcp for the MCP transport.

Requires a licensed IDA Pro 9.2+ with idalib support. ida-code does not install or replace IDA Pro — it loads idapro from your existing install at startup.

Install

uv tool install ida-code

This puts the ida-code CLI on your PATH (via uv's tool dir) so MCP clients can launch it directly. Don't have uv? pip install ida-code works too.

Then point IDA_INSTALL_DIR at your IDA Pro install (the directory that contains idalib/python/):

OS Typical path
Linux /opt/ida-pro-9.3
macOS /Applications/IDA Professional 9.3.app/Contents/MacOS
Windows C:\Program Files\IDA Professional 9.3

Use with Claude Code

Add ida-code to your project's .mcp.json:

{
  "mcpServers": {
    "ida-code": {
      "command": "ida-code",
      "env": {
        "IDA_INSTALL_DIR": "/opt/ida-pro-9.3"
      }
    }
  }
}

Restart Claude Code; the server is picked up automatically. You can confirm it's wired up by asking Claude to open a binary — it should call open_database and report architecture, entry point, and load address.

For other MCP clients, run the server directly:

IDA_INSTALL_DIR=/opt/ida-pro-9.3 ida-code   # stdio transport

Tools (35)

Full parameter docs live in each tool's docstring — surfaced automatically to MCP clients via tools/list.

Domain Tools
Database open_database, close_database, get_database_info, list_architectures
Code execution execute, execute_file
Navigation list_functions, decompile, get_disassembly, get_xrefs_to, get_xrefs_from
Annotation rename_function, retype_function, get_comment, set_comment, delete_comment, get_variable, set_variable
Structures list_structures, get_structure, create_structure, edit_structure, delete_structure
Snapshots list_snapshots, create_snapshot, restore_snapshot, delete_snapshot
Undo/redo get_undo_status, perform_undo, perform_redo
Inventory get_strings, get_imports, get_exports
Search search_docs, search_examples

Resources & prompts

Type URI / name Purpose
Resource guidelines://standalone_script Boilerplate for standalone idalib scripts
Resource guidelines://plugin Boilerplate for IDA plugins (plugin_t)
Resource guidelines://idapython_script Boilerplate for IDAPython scripts run inside IDA GUI
Prompt reverse_engineer Five-phase RE workflow (recon, triage, analysis, annotation, iteration)
Prompt create_script Coding guidelines for a chosen target script type

Transport modes

ida-code                          # stdio (default)
ida-code --http                   # streamable-http on 127.0.0.1:8080
ida-code --http 0.0.0.0:9090      # custom host:port
ida-code --sse                    # SSE on 127.0.0.1:8080
ida-code --sse :9090              # SSE on 127.0.0.1:9090

HTTP/SSE require bearer token auth. Set MCP_AUTH_TOKEN or let the server generate one (printed to stderr on startup).

Environment variables

Variable Default Description
IDA_INSTALL_DIR /opt/ida-pro-9.3 IDA Pro installation directory (must contain idalib/python/)
LOG_LEVEL WARNING Logging verbosity (DEBUG, INFO, WARNING, ERROR)
MCP_AUTH_TOKEN (auto-generated) Bearer token for HTTP/SSE transports

Doc and example paths are derived from IDA_INSTALL_DIR (docs/, python/, python/examples/).

Install from source

git clone https://github.com/Dil4rd/ida-code
cd ida-code
uv sync
uv run ida-code

When wiring a source checkout into .mcp.json, use uv as the command:

{
  "mcpServers": {
    "ida-code": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/ida-code", "ida-code"],
      "env": { "IDA_INSTALL_DIR": "/opt/ida-pro-9.3" }
    }
  }
}

Note: the fastmcp dependency is the community fastmcp package, not the official mcp SDK. Don't install mcp by mistake.

Development

uv sync --extra dev
uv run pytest

Known issues

See KNOWN_ISSUES.md for caveats and workarounds (e.g. why we pin fastmcp<3).

The test suite covers the executor, doc/example search, comments, snapshots, structures, undo, variables, and Mach-O parsing. Tests that need idalib are skipped if it's not available.

Credits

Thanks to @p41l for ideas and for testing the tool across different LLMs.

License

MIT — see LICENSE.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ida_code-0.2.2.tar.gz (52.5 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

ida_code-0.2.2-py3-none-any.whl (43.7 kB view details)

Uploaded Python 3

File details

Details for the file ida_code-0.2.2.tar.gz.

File metadata

  • Download URL: ida_code-0.2.2.tar.gz
  • Upload date:
  • Size: 52.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ida_code-0.2.2.tar.gz
Algorithm Hash digest
SHA256 c6ea58cfcecc752d727df2adb85a4d5f2e506ab5edf7e5539b3e1d055d9cd9f8
MD5 1667e22a2533fdb95e4efb5e01012ba7
BLAKE2b-256 1cbcb391edf3cfdf8db931b134f056629534044322e5b21fd8334ef0efaa7062

See more details on using hashes here.

Provenance

The following attestation bundles were made for ida_code-0.2.2.tar.gz:

Publisher: publish-pypi.yml on sploit00n/ida-code

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file ida_code-0.2.2-py3-none-any.whl.

File metadata

  • Download URL: ida_code-0.2.2-py3-none-any.whl
  • Upload date:
  • Size: 43.7 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ida_code-0.2.2-py3-none-any.whl
Algorithm Hash digest
SHA256 2802911aee1f976b6c410a135150c0772ef9b7f654a5ed0c9f43bb43c948bd9d
MD5 1060b8a5b62b3c730b50601206504009
BLAKE2b-256 d4843e645c43d78db4e9911abf4d423621b8c6764d737b08ea6e44d567ff828c

See more details on using hashes here.

Provenance

The following attestation bundles were made for ida_code-0.2.2-py3-none-any.whl:

Publisher: publish-pypi.yml on sploit00n/ida-code

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page