IDA Pro MCP

Quick Verdict

IDA Pro MCP is a community project created and maintained by mrexodia. It is not authored, maintained, or supported by Hex-Rays, although it operates on Hex-Rays’ IDA Pro and idalib products. The server exposes real IDA database operations to MCP clients such as Claude Code, Codex, Cursor, and OpenCode. An agent can inspect functions, decompilation, assembly, imports, strings, cross-references, types, control flow, and call graphs, then optionally rename symbols, edit types and comments, patch bytes, or save database changes.

For a new deployment, use the headless idalib-mcp path shipped in the same repository rather than designing around the older in-GUI MCP plugin. The project README now says that the GUI plugin is no longer recommended and will eventually be deprecated. idalib-mcp supervises a separate worker for each database, supports stdio and local HTTP/SSE, and requires every analysis call to identify an explicit database session. It is a better base for isolation, multiple samples, and automation, but it still requires activated idalib and a valid paid IDA Pro installation.

This server deserves a high-risk classification even when used locally. Its authority goes far beyond reading pseudocode. It can modify the IDB, define or undefine code, patch instructions, save databases, launch a debugger, write process memory, and run arbitrary Python through py_eval. A mistaken model action can corrupt analysis state, while hostile strings or decompiled content can attempt prompt injection. Start with sample copies, read-only tools, a low-privilege virtual machine, restricted networking, IDB backups, and explicit human approval for every write, debugger, patch, save, or Python operation.

Best For

• Malware analysts, vulnerability researchers, firmware engineers, and authorized CTF participants who already understand IDA and can verify model conclusions.
• Security teams building repeatable headless triage around idalib while retaining a qualified analyst in the loop.
• Researchers who want an agent to cite addresses, xrefs, assembly, and decompilation rather than reason from an informal binary description.
• Teams capable of isolating unknown binaries, controlling model data flow, backing up IDBs, and auditing high-impact tools.
• It is not suitable for users without a valid commercial IDA license, users expecting IDA Free support, or unattended execution of unknown samples on a daily workstation.

Key Features

• Grounded static analysis: query functions, globals, imports, strings, decompilation, disassembly, basic blocks, callees, xrefs, and call graphs from the active database.
• Database editing: rename symbols, set comments and types, declare structures, define code or functions, add bookmarks, and save an IDB. These operations alter analyst state and need review.
• Bytes and patches: read raw bytes, integers, and strings or write integer and assembly patches. Always test against a disposable copy.
• Headless session supervision: idalib-mcp opens each database in its own worker and manages it through idb_open, idb_list, and idb_save.
• Explicit backend selection: sessions can prefer or force headless workers, prefer a running GUI, or force a GUI launch. Every forwarded tool call names its database.
• Debugger extension: optional tools can launch and control a process, step, manage breakpoints, inspect registers and stacks, and read or write debuggee memory.
• Arbitrary IDAPython: py_eval executes Python in IDA context, effectively giving the agent code-execution authority inside the analysis process.
• Browsable MCP resources: metadata, segments, entry points, local types, structures, imports, exports, cursor state, and selection can be exposed as resources.

Use Cases

A conservative pilot is headless, read-oriented triage. Copy a sample into an isolated VM, record its hash, open it through idalib-mcp --stdio, and allow only function lookup, decompilation, disassembly, imports, strings, and xrefs. Ask the model to cite addresses and evidence when proposing a function purpose. An analyst should approve a separate phase for names, types, and comments, inspect the resulting database diff, and preserve the untouched snapshot.

Batch work can assign a stable session ID to each database and cap concurrency with --max-workers. Persistent workers may outlive the supervisor until their idle timeout, so an operations team must understand process lifetime, storage, logs, and cleanup. Generated reports should distinguish direct IDA evidence from model hypotheses. A pipeline must not automatically convert a model’s vulnerability guess into a customer finding or detection rule without validation.

Dynamic analysis needs a stronger boundary. Unknown programs should run in a purpose-built VM with restricted networking, no host credentials, minimal shared folders, and disposable snapshots. Keep debugger extensions disabled until a named analyst approves the sample and exact action. py_eval, patching, dbg_write, and idb_save should be removed from the default allowlist and temporarily enabled only when the client displays complete arguments for confirmation.

The project itself warns that LLMs hallucinate, mishandle number-base conversion, and perform poorly on obfuscated code. Use int_convert instead of trusting mental conversions, and first address string encryption, import hashing, control-flow flattening, anti-decompilation techniques, and unresolved library code. The right role is an evidence-gathering assistant, not an autonomous reverse engineer.

Pricing

The repository is MIT licensed and the MCP code has no software license fee. The complete solution is not free. It requires commercial IDA Pro 8.3 or later, with version 9 recommended; IDA Free is explicitly unsupported. Depending on the workflow, a Hex-Rays decompiler entitlement may also matter. Add model usage, MCP client costs, analysis machines, isolated VMs, sample storage, audit systems, and analyst review. Confirm that the organization’s IDA license permits the target devices, concurrent workers, CI operation, and remote workflow.

There is also a release-to-source gap. PyPI currently publishes ida-pro-mcp 1.4.0, released October 6, 2025. The 2026 main branch documents a substantially evolved idalib-mcp session model, plugin marketplaces, and newer tools. Its GUI installation instructions uninstall the PyPI package and install the GitHub main archive. Following main obtains current behavior but sacrifices a stable package boundary. Production users should pin a reviewed commit SHA, preserve uv.lock or an internal package, and regression-test tool schemas and IDB mutations before upgrading.

Pros

• Gives an agent evidence from the real IDA database rather than an ungrounded description of a binary.
• Headless idalib workers and explicit database sessions are suitable for controlled automation and multiple samples.
• MIT-licensed community code can be reviewed, pinned, and packaged internally.
• Broad reading, search, type, graph, modification, and resource APIs support systematic investigations.
• Works with many MCP clients and openly documents model limitations around hallucinations, numbers, and obfuscation.
• Reviewed names, comments, and types can improve the database for later human analysis.

Cons

• It is not a Hex-Rays official project, so support, compatibility, and security maintenance remain community responsibilities.
• Paid IDA Pro is mandatory and IDA Free does not work, making the real entry cost significant.
• PyPI 1.4.0 and the current main branch differ, complicating reproducible installation and upgrades.
• The GUI plugin route is being deprecated, requiring migration for older setups.
• Database edits, patches, debugger control, memory writes, and arbitrary Python can cause destructive side effects.
• Sensitive binaries, pseudocode, vulnerabilities, and indicators may flow through the MCP host and model provider.
• Models still fail on obfuscation, arithmetic, types, and control flow and cannot replace expert reverse-engineering judgment.

Alternatives

FAQ

Is IDA Pro MCP an official Hex-Rays project?

No. mrexodia created and maintains it with community contributors. Hex-Rays supplies IDA Pro and idalib, but that does not make Hex-Rays the MCP server’s author or support provider.

Should a new deployment use the GUI plugin or idalib-mcp?

Use idalib-mcp by default. The repository now labels the GUI MCP plugin as no longer recommended and says it will eventually be deprecated. Keep the GUI route only when an existing workflow truly depends on interactive IDA state.

Does it work with IDA Free?

No. The prerequisites explicitly state that IDA Free is unsupported. A compatible paid IDA Pro installation and valid entitlement are required even though the MCP repository itself is MIT licensed.

Does pip install ida-pro-mcp provide the newest capabilities?

Do not assume so. PyPI’s latest artifact is 1.4.0 from October 2025, while the main branch has continued to evolve. If current idalib behavior is required, review and pin a specific Git commit rather than tracking main indefinitely.

Why are debugger and py_eval tools especially dangerous?

Debugger tools can launch an unknown program and read or write its process memory. py_eval can execute arbitrary Python inside IDA. Both inherit meaningful machine, file, database, and sample authority and should be disabled by default inside an isolated VM.

How should database modifications be reviewed?

Preserve the original sample hash and untouched IDB, work on a copy, require the model to cite addresses and evidence, and compare names, types, comments, patches, and saved state before accepting the result. A fluent explanation is not evidence.

Bottom Line

IDA Pro MCP is a capable community reverse-engineering integration that must be credited to mrexodia, not Hex-Rays. New 2026 deployments should favor the repository’s headless idalib-mcp, pin a reviewed commit, and account for the gap between PyPI 1.4.0 and the current source. Paid IDA Pro remains mandatory. More importantly, database writes, patching, debugger control, process-memory writes, and arbitrary IDAPython make this a high-authority tool. Begin with read-only evidence collection on sample copies in an isolated VM, and require parameter-level human approval before enabling any capability that can change an IDB or execute code.