mrexodia/ida-pro-mcp

What it solves

This project provides a Model Context Protocol (MCP) server that connects the IDA Pro disassembler and decompiler to Large Language Models (LLMs). It enables "vibe reversing"—allowing an AI agent to interactively analyze, rename, comment, and modify a binary database in IDA Pro to assist in reverse engineering tasks.

How it works

The server acts as a bridge between an MCP-compatible client (like Claude, Cursor, or VS Code) and IDA Pro. It can operate in two primary modes:

1. GUI Mode: Connects to a running instance of the IDA Pro GUI.
2. Headless Mode: Uses idalib to manage database workers as detached processes, allowing the LLM to open and analyze binaries without the GUI.

It exposes a comprehensive set of tools to the LLM, including functions for decompilation, disassembly, cross-referencing, memory reading, patching assembly, and even debugger control. It also provides read-only resources for browsing IDB metadata, segments, and type information.

Who it’s for

Reverse engineers and security researchers who want to leverage LLMs to automate the tedious parts of binary analysis, such as renaming variables, documenting function logic, and identifying patterns in obfuscated code.

Highlights

• Comprehensive Toolset: Includes tools for decompilation, patching, type declaration, and advanced control flow analysis.
• Headless Analysis: Support for idalib allows for scalable, background analysis of binaries.
• Debugger Integration: Optional extension for controlling the IDA debugger (stepping, breakpoints, register inspection).
• pyridazine-safe API: Uses strongly-typed parameters and batch-first design to handle multiple operations efficiently and reduce token overflow via cursor-based pagination.
• Python Execution: Allows the LLM to execute arbitrary Python code within the IDA context via py_eval.