Ida Pro
by mrexodia
IDA Pro MCP bridges IDA Pro to MCP clients so an agent can decompile, disassemble, patch, and drive a live debug session inside an existing IDA database.
Install as Claude Code plugin
claude plugin marketplace add mrexodia/claude-marketplace && claude plugin install ida-pro-mcp@mrexodia
About
ida-pro-mcp connects IDA Pro's analysis engine to MCP-compatible clients, including Claude, Claude Code, Cursor, and VS Code, for what the project calls 'vibe reversing.' Its source is organized into focused API modules (api_analysis, api_modify, api_debug, api_memory, api_core, and more), each exposing a set of real functions as MCP tools: decompile and disasm for code inspection, xrefs_to and callgraph for tracing relationships, rename and patch_asm for modifying a database, and a full debugger surface (dbg_start, dbg_step_into, dbg_add_bp, dbg_regs) for driving IDA's debugger from the agent.
It runs against a live IDA Pro GUI session or headlessly via idalib, and its headless mode keeps persistent database workers running so multiple MCP clients can share the same open binary. Because LLMs are known to fumble manual hex/decimal conversion, the project specifically calls out its int_convert tool as the way to hand that arithmetic off to a deterministic function instead of trusting the model's own math.
Key features
- Real IDA operations exposed as tools: decompile, disasm, xrefs_to, callgraph, rename, patch_asm
- Full debugger control from the agent: dbg_start, dbg_step_into, dbg_add_bp, dbg_regs, dbg_continue
- Memory read/write tools (get_bytes, get_string, patch) for live inspection and patching
- Runs against a live IDA GUI or headlessly via idalib with persistent shared database workers
- int_convert tool hands numeric-base conversion to deterministic code instead of LLM arithmetic
- Ships as a Claude Code plugin as well as a standalone MCP server for other clients
Use cases
- Ask an agent to decompile a suspicious function and explain what it does before you read the disassembly yourself
- Have the agent set a breakpoint, run to it, and dump register state during a live debugging session
- Batch-rename obfuscated function and variable names across a binary based on inferred behavior
- Search a binary for a byte pattern or string and trace every place it's referenced
Available tools
decompile
Returns the decompiled C-like pseudocode for a given function.
disasm
Returns the disassembly listing for a function or address range.
xrefs_to
Lists all cross-references to a given address or function.
rename
Renames a function, variable, or symbol in the IDA database.
dbg_add_bp
Adds a breakpoint at a given address for the live debugger.
patch_asm
Patches assembly instructions at a specified address.
Frequently asked questions
Does this work with IDA Free?
No. The project requires IDA Pro 8.3 or higher (9.0 recommended); IDA Free is explicitly not supported.
Can it drive a live debugging session, or is it read-only analysis?
It can drive a live session. Tools like dbg_start, dbg_step_into, dbg_add_bp, and dbg_regs control IDA's debugger directly, not just static analysis.