ida-pro-mcp is an MIT-licensed MCP server that connects IDA Pro to language-model clients so analysts can drive decompilation, renaming, and annotation through conversational tool calls.
| Tool | mrexodia/ida-pro-mcp — a Model Context Protocol server that lets LLM clients operate IDA Pro for assisted reverse engineering |
| Category | AI-assisted binary analysis / reverse engineering integration |
| Primary Use | Letting an authorized analyst's MCP client (Claude Code, Codex, Cline, etc.) inspect decompilation, rename symbols, and annotate an IDB under analyst supervision |
| Safe Use | For licensed IDA Pro users analyzing software they own or are authorized to assess — malware research, CTF crackmes, and in-house code audit in isolated labs |
| Telemetry Note | Purely local: all activity happens inside the analyst's IDB and worker processes; defenders observing its use would see renamed functions and comments in the database, with no network egress beyond the chosen LLM client's own traffic |
ida-pro-mcp from mrexodia is a Python-based Model Context Protocol server that bridges IDA Pro and modern LLM clients, turning the disassembler into a set of callable tools a language model can interrogate and mutate. The README pitches it bluntly as enabling "vibe reversing" — the analyst describes the goal in natural language while the model walks the decompilation, renames variables, retypes arguments, and drops comments into the database. With over twelve thousand stars and an MIT license, it has become the de facto reference implementation for MCP-driven binary analysis, and its architecture decisions are worth studying even if you never run it.
The prerequisite matrix is strict and tells you a lot about the design. You need Python 3.11+ (switchable inside IDA via idapyswitch) and IDA Pro 8.3 or higher, with 9.x recommended; the free tier is explicitly unsupported because the project leans on idalib, Hex-Rays' headless embedding of the IDA engine. On the client side the compatibility list is remarkably broad — Claude, Claude Code, Codex, Cline, Cursor, Gemini CLI, Windsurf, Warp, Zed, and roughly two dozen others — and for anything not listed, running ida-pro-mcp --config emits the JSON block you paste into your client's MCP settings. This client-agnosticism is the point of MCP, and the project honors it fully.
Installation has consolidated around package marketplaces for the major agent runtimes. For Claude Code the flow is claude plugin marketplace add mrexodia/claude-marketplace followed by uninstall and reinstall of ida-pro-mcp@mrexodia; Codex follows the same pattern with codex plugin add. A GUI-plugin path still exists — pip install from the repository zip, then ida-pro-mcp --install — but the README marks it as deprecated in favor of the newer idalib-mcp headless server. The critical operational detail is that both IDA and the MCP client must be fully restarted, including tray-resident clients, or the plugin silently fails to register.
The most interesting engineering in the project is the headless session model contributed by Willi Ballenthin. idalib-mcp acts as a supervisor that maintains each open database in its own persistent worker process, registered in a host-local discovery directory. Workers outlive the supervisor that spawned them; a new supervisor calling idb_open on a path already held by a worker adopts it transparently, and workers self-exit after an idle TTL defaulting to one hour. This is a pragmatic answer to the slow warm-up problem of idalib — auto-analysis and Hex-Rays initialization are expensive, so caching live sessions across client restarts amortizes that cost.
The idb_open tool exposes a mode parameter with four backends: prefer_headless (the default), force_headless, prefer_gui, and force_gui. The GUI modes let an agent attach to an already-running interactive IDA Pro instance, adopting the analyst's live session rather than re-analyzing from scratch — an elegant bridge between human-driven and model-driven workflows. Every subsequent tool call must carry an explicit database argument naming the session ID returned by idb_open; there is deliberately no implicit current database, which forces the model to reason about which binary it is inspecting when juggling multiple targets. Companion management tools — idb_list, idb_close, idb_save, and a forwarded server_health probe — round out a small but honest process-supervision API, with --max-workers (default 4, overridable via IDA_MCP_MAX_WORKERS) capping concurrency.
Transport flexibility is solid: uv run ida-pro-mcp --transport http://127.0.0.1:8744/sse exposes an SSE endpoint for browser-based clients, --stdio serves terminal agents, and idalib-mcp --host 127.0.0.1 --port 8745 path/to/executable boots a headless server preloaded with a binary. That a single server can serve GUI-attached, headless, stdio, and HTTP consumers against shared worker state is unusual for MCP servers in general and explains the project's traction beyond the IDA ecosystem.
What the README is unusually candid about is prompt engineering and LLM failure modes. The author's own crackme-analysis prompt instructs the model to never convert number bases itself but to call the bundled int_convert tool, because integer-to-byte conversion is a known hallucination trigger; the companion math-mcp project is recommended for arithmetic the model cannot be trusted to do in its head. The prompt also forbids brute forcing and requires that solutions be derived from the disassembly, ending with a report.md of findings. A second community prompt from @can1352-adjacent contributor @can1357 formalizes this into a five-phase methodology — decompile, improve readability, deep-dive into disassembly when needed, obey constraints, document into RE/*.md files — which reads like a genuine analyst's standard operating procedure translated into agent instructions.
The accuracy guidance is where an experienced reverser will nod along. The README states plainly that LLMs perform poorly on obfuscated code and advises deobfuscating first — stripping string encryption, import hashing, control-flow flattening, code encryption, and anti-decompilation tricks — before handing the binary to a model. It also recommends resolving open-source library code and the C++ STL with Lumina or FLIRT signatures first, so the model's attention lands on the proprietary logic rather than burning context on boilerplate. This is practical wisdom: the tool amplifies analysis quality of the input database, and garbage in still produces hallucinated garbage out.
In an authorized workflow — a licensed analyst triaging malware samples in an isolated VM, working CTF crackmes from the author's companion mcp-reversing-dataset, or auditing first-party code — the value proposition is speed on the tedious 80% of reverse engineering: bulk renaming, retyping, comment hygiene, and cross-reference triage. The human remains the verifier; the prompts embedded in the project explicitly gate solutions on user feedback, and every mutation is visible in the IDB where traditional review applies. For teams, the headless worker model plus explicit session addressing suggests pipeline use, batching decompilation and xrefs_to queries across a sample corpus from a single agent session.
Caveats are worth stating clearly. The project requires a paid IDA Pro license, its deprecation of the GUI plugin means installation paths will churn, and the persistent detached workers could surprise anyone assuming clean process teardown — idb_close exists for a reason. There is also an inherent trust question in letting a model rename and retype your database: sloppy inferences become persistent metadata that biases the next analyst. Treat the model as a junior analyst whose work you review in the diff, not an oracle, and ida-pro-mcp is one of the most productive force multipliers currently available in binary analysis.
mrexodia/ida-pro-mcp.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.