IDA Pro backend for re-mcp — headless IDA Pro MCP server using idalib
Project description
re-mcp-ida
IDA Pro backend for RE-MCP — a headless IDA Pro MCP server using idalib. Exposes IDA's full analysis capabilities over the Model Context Protocol, letting LLMs drive reverse engineering directly.
This is a standalone server, not an IDA plugin. It uses idalib to run IDA's analysis engine without a GUI.
Requirements
- Python 3.12+
- IDA Pro 9+ with a valid license
- macOS, Windows, or Linux
Installation
uv tool install re-mcp-ida
Or with pip:
pip install re-mcp-ida
Finding IDA Pro
The server looks for your IDA Pro installation in the following order:
IDADIRenvironment variable — set this if IDA is in a non-standard location.- IDA's config file —
Paths.ida-install-dirin~/.idapro/ida-config.json(macOS/Linux) or%APPDATA%\Hex-Rays\IDA Pro\ida-config.json(Windows). - Platform-specific default paths (e.g.
/Applications/IDA Professional *.app/Contents/MacOSon macOS).
See the main documentation for the full list of default search paths per platform.
Usage
# Run the server (direct stdio mode)
re-mcp-ida
# Or with uvx (no install needed)
uvx re-mcp-ida
MCP client configuration
{
"mcpServers": {
"ida": {
"command": "uvx",
"args": ["re-mcp-ida"]
}
}
}
CLI subcommands
| Command | Description |
|---|---|
re-mcp-ida (or re-mcp-ida stdio) |
Direct stdio mode — single-session, workers die on disconnect (default) |
re-mcp-ida proxy |
Stdio proxy that auto-spawns a persistent HTTP daemon |
re-mcp-ida serve |
Start the HTTP daemon directly |
re-mcp-ida stop |
Gracefully shut down a running daemon |
Environment variables
| Variable | Default | Description |
|---|---|---|
IDADIR |
(auto-detected) | Path to IDA Pro installation directory |
IDA_MCP_MAX_WORKERS |
(unlimited) | Maximum simultaneous databases (1-8) |
IDA_MCP_LOG_LEVEL |
WARNING |
Logging level |
IDA_MCP_LOG_DIR |
(unset) | Directory for per-run log files |
IDA_MCP_IDLE_TIMEOUT |
300 |
Auto-shutdown timeout in seconds (0 to disable) |
IDA_MCP_ALLOW_SCRIPTS |
(unset) | Set to 1, true, or yes to enable run_script for arbitrary IDAPython |
Features
- Full decompilation and disassembly
- Function, type, and structure management
- Cross-reference and call graph analysis
- String and byte pattern search
- Binary patching and instruction assembly
- FLIRT signature and type library support
- MCP prompts for guided workflows (binary triage, function analysis, crypto detection, etc.)
- Multi-database support with concurrent analysis
- MCP resources for structured read-only access
See the main documentation for the full tool catalog, multi-database workflows, and detailed usage.
License
Dual-licensed under MIT and Apache-2.0.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file re_mcp_ida-3.0.0rc2.tar.gz.
File metadata
- Download URL: re_mcp_ida-3.0.0rc2.tar.gz
- Upload date:
- Size: 102.7 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.12
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
7c3a9f5820d8e3a0f8fcfa2cf1ce171d6513d2af63e409671c614dfa2dbb36c1
|
|
| MD5 |
92c157aa2ae3c066d011a9df3288e241
|
|
| BLAKE2b-256 |
f0affd1be5cc415f29dfd52a75b49a5b172a56e52ef7cc45753af112b5868cb4
|
Provenance
The following attestation bundles were made for re_mcp_ida-3.0.0rc2.tar.gz:
Publisher:
publish.yml on jtsylve/re-mcp
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
re_mcp_ida-3.0.0rc2.tar.gz -
Subject digest:
7c3a9f5820d8e3a0f8fcfa2cf1ce171d6513d2af63e409671c614dfa2dbb36c1 - Sigstore transparency entry: 1435542393
- Sigstore integration time:
-
Permalink:
jtsylve/re-mcp@b8b148a8c6f205bbf4dc9089ec71cf931ce8711d -
Branch / Tag:
refs/tags/v3.0.0rc2 - Owner: https://github.com/jtsylve
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@b8b148a8c6f205bbf4dc9089ec71cf931ce8711d -
Trigger Event:
release
-
Statement type:
File details
Details for the file re_mcp_ida-3.0.0rc2-py3-none-any.whl.
File metadata
- Download URL: re_mcp_ida-3.0.0rc2-py3-none-any.whl
- Upload date:
- Size: 145.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.12
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
cbc7efc32eb2e6bef1b261557dcc86edf7270aa7abaf49ab19518b81bc7ebb81
|
|
| MD5 |
3929ef6be91cf509a3c6105546cf252a
|
|
| BLAKE2b-256 |
2a3eb54c2dfa24b2e4e05f2f00414a51f8ce5c39daf1c626bb42994a9b35ee95
|
Provenance
The following attestation bundles were made for re_mcp_ida-3.0.0rc2-py3-none-any.whl:
Publisher:
publish.yml on jtsylve/re-mcp
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
re_mcp_ida-3.0.0rc2-py3-none-any.whl -
Subject digest:
cbc7efc32eb2e6bef1b261557dcc86edf7270aa7abaf49ab19518b81bc7ebb81 - Sigstore transparency entry: 1435542457
- Sigstore integration time:
-
Permalink:
jtsylve/re-mcp@b8b148a8c6f205bbf4dc9089ec71cf931ce8711d -
Branch / Tag:
refs/tags/v3.0.0rc2 - Owner: https://github.com/jtsylve
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@b8b148a8c6f205bbf4dc9089ec71cf931ce8711d -
Trigger Event:
release
-
Statement type: