mrexodia/ida-pro-mcp

What it solves

This project enables "vibe reversing" by allowing Large Language Models (LLMs) to interact directly with IDA Pro, a professional disassembler and reverse engineering tool. It bridges the gap between an AI assistant and a complex binary analysis environment, allowing the AI to perform tasks like decompiling code, renaming variables, and analyzing control flow without the user having to manually copy-paste data.

How it works

It implements a Model Context Protocol (MCP) server that exposes IDA Pro's internal capabilities as a set of tools and resources for an MCP-compatible client (such as Claude, Cursor, or VS Code). It can operate in two modes:

1. GUI Mode: Connects to a running instance of the IDA Pro interface.
2. Headless Mode: Uses idalib to manage database workers as detached processes, allowing for automated analysis without a visible GUI.

Who it’s for

Reverse engineers and security researchers who want to leverage LLMs to automate the tedious parts of binary analysis, such as documenting functions, identifying patterns, and cleaning up decompiled code.

Highlights

• Comprehensive Toolset: Provides tools for decompilation, disassembly, cross-referencing, memory reading, and patching.
• Database Management: Supports multiple concurrent database sessions with a supervisor that manages headless workers.
• Interactive Debugging: Includes an optional extension for debugger control, including breakpoints, register inspection, and memory writes.
• Direct Modification: Allows the LLM to actively improve the IDA database by renaming variables, declaring types, and adding comments.
• Advanced Search: Supports regex string searches and byte pattern matching.
• Python Integration: Includes a py_eval tool to execute arbitrary Python code within the IDA context.