Skip to main content

Headless IDA Pro 9.3 MCP server using idalib

Project description

IDA MCP Server

A headless IDA Pro 9.3 MCP server built on idalib. Exposes a comprehensive set of binary analysis tools over the Model Context Protocol (MCP), letting LLMs drive IDA Pro for reverse engineering tasks.

Requirements

  • IDA Pro 9.3 with a valid license (including Hex-Rays decompiler for decompilation tools)
  • Python 3.13+
  • uv package manager
  • macOS, Windows, or Linux

Installation

uv tool install ida-mcp

Or with pip:

pip install ida-mcp

The idapro package is loaded at runtime directly from your local IDA Pro installation — no extra setup steps or environment variables are needed if IDA is installed in a standard location.

From source

git clone https://github.com/jtsylve/ida-mcp && cd ida-mcp
uv sync

Finding IDA Pro

At startup the server looks for your IDA Pro installation in the following order:

  1. IDADIR environment variable — checked first; set this if IDA is in a non-standard location.
  2. IDA's own config fileida-install-dir in ~/.idapro/ida-config.json (macOS/Linux) or %APPDATA%\Hex-Rays\IDA Pro\ida-config.json (Windows). This is the same file IDA itself uses.
  3. Platform-specific default paths:
Platform Default search paths
macOS /Applications/IDA Professional *.app/Contents/MacOS
Windows C:\Program Files\IDA Professional 9.3, C:\Program Files\IDA Pro 9.3
Linux /opt/ida-pro-9.3, /opt/idapro-9.3, ~/ida-pro-9.3

If the server can't find IDA, you'll get a clear error message telling you to set IDADIR.

Usage

Stdio transport (default)

uvx ida-mcp

Running without installing

You can run the server without installing it first:

# macOS/Linux
IDADIR=/path/to/ida uvx ida-mcp

# Windows (PowerShell)
$env:IDADIR = "C:\Program Files\IDA Professional 9.3"
uvx ida-mcp

MCP client configuration

Add to your MCP client config (e.g. Claude Desktop claude_desktop_config.json):

{
  "mcpServers": {
    "ida": {
      "command": "uvx",
      "args": ["ida-mcp"]
    }
  }
}

If IDA is not in a default location, add IDADIR via the env key:

{
  "mcpServers": {
    "ida": {
      "command": "uvx",
      "args": ["ida-mcp"],
      "env": {
        "IDADIR": "/path/to/ida"
      }
    }
  }
}

Basic workflow

  1. Open a binary — call open_database with the path to a binary file
  2. Analyze — use the available tools (list functions, decompile, search strings, read bytes, etc.)
  3. Close — call close_database when done (auto-saves by default)

The binary must be in a writable directory since IDA creates a .i64 database file alongside it.

Tools

The server provides a comprehensive set of tools covering all major areas of IDA Pro's functionality:

  • Database — open/close/save databases, file region mapping, metadata
  • Functions — list, query, decompile, disassemble, rename, manage chunks and types
  • Decompiler — pseudocode variable renaming/retyping, microcode, ctree AST exploration and pattern matching
  • Cross-References — xref queries, call graphs, xref creation/deletion
  • Search — strings, byte patterns, text in disassembly, immediate values, function name regex
  • Types & Structures — local types, structs, enums, type parsing and application
  • Instructions & Operands — decode instructions, resolve operand values, change operand display format
  • Control Flow — basic blocks, CFG edges, switch/jump tables
  • Patching — byte patching, instruction assembly, function/code creation
  • Segments — create, modify, rebase segments
  • Names & Comments — rename addresses, manage comments, C++ demangling
  • Analysis — auto-analysis, fixups, exception handlers, register tracking
  • Signatures — FLIRT signatures, type libraries, IDS modules
  • Export — batch decompilation/disassembly, output file generation
  • Utility — number conversion, IDC evaluation, bookmarks, colors, undo/redo

See docs/tools.md for the complete tools reference.

Architecture

See docs/architecture.md for detailed architecture documentation.

Development

uv sync                          # Install dependencies
uv run ruff check src/           # Lint
uv run ruff format src/          # Format
uv run ruff check --fix src/     # Lint with auto-fix

Pre-commit hooks run REUSE compliance checks, ruff lint (with auto-fix), ruff formatting, and pytest on every commit.

License

This project is licensed under the MIT License.

© 2026 Joe T. Sylve, Ph.D.

This project is REUSE compliant.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ida_mcp-1.0.0.tar.gz (53.2 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

ida_mcp-1.0.0-py3-none-any.whl (84.6 kB view details)

Uploaded Python 3

File details

Details for the file ida_mcp-1.0.0.tar.gz.

File metadata

  • Download URL: ida_mcp-1.0.0.tar.gz
  • Upload date:
  • Size: 53.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for ida_mcp-1.0.0.tar.gz
Algorithm Hash digest
SHA256 c66c6f8763db97efbe0d201fe04b56597fbdf4dd276daf809ae4959e4eebf80f
MD5 4c5417710e7dabacf8f820eee8736086
BLAKE2b-256 eb07ee6e5cdae44de2be6b1c664e73315df3b8206a1a01cea04a7ca99be804fe

See more details on using hashes here.

Provenance

The following attestation bundles were made for ida_mcp-1.0.0.tar.gz:

Publisher: publish.yml on jtsylve/ida-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file ida_mcp-1.0.0-py3-none-any.whl.

File metadata

  • Download URL: ida_mcp-1.0.0-py3-none-any.whl
  • Upload date:
  • Size: 84.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for ida_mcp-1.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 4efb159f4ff9de995f4659163c5a02d69b4c0f08d06a2761d5ea6ba41310c208
MD5 9ba0071b44ea852eed1ba5ea72fff0b3
BLAKE2b-256 1c366862fbb15357493fc0fda02a8d45584d6ac3c137cdd243bfe313a0d99fa3

See more details on using hashes here.

Provenance

The following attestation bundles were made for ida_mcp-1.0.0-py3-none-any.whl:

Publisher: publish.yml on jtsylve/ida-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page