IDA Pro MCP Server for Claude Code

Bridge Claude Code (CLI and Editor Extensions like VS Code, Cursor, Windsurf) with IDA Pro 9.0+ for AI-assisted reverse engineering. 87 tools covering virtually everything IDA Pro can do.

Architecture

Claude Code / Cursor / VS Code (MCP Client)
               │ (stdio)
               ▼
        ida-mcp Server
               │ (JSON-RPC over localhost:13337)
               ▼
   IDA Pro Plugin (ida_mcp_plugin.py)
               │ (IDAPython API on main thread)
               ▼
         IDA Pro 9.0+

Installation & Setup

1. Install the IDA Plugin

Copy ida_plugin/ida_mcp_plugin.py into your IDA Pro plugins directory:

macOS: ~/idapro-9.0/plugins/ or /Applications/IDA Professional 9.0.app/Contents/MacOS/plugins/
Windows: %APPDATA%\Hex-Rays\IDA Pro\plugins\ or C:\Program Files\IDA Professional 9.0\plugins\
Linux: ~/.idapro/plugins/ or /opt/idapro-9.0/plugins/

When you open any binary in IDA Pro, the plugin starts a JSON-RPC server on 127.0.0.1:13337.

2. Configure Claude Code CLI

claude mcp add ida-pro -- uv run --directory "/Users/benzi/Documents/IDA MCP" ida-mcp

3. Configure VS Code / Cursor / Windsurf

Add to .mcp.json or your editor's MCP configuration:

{
  "mcpServers": {
    "ida-pro": {
      "command": "uv",
      "args": ["run", "--directory", "/Users/benzi/Documents/IDA MCP", "ida-mcp"]
    }
  }
}

Environment Variables

IDA_MCP_HOST — Override host (default: 127.0.0.1)
IDA_MCP_PORT — Override port (default: 13337)

Available Tools (87 Total)

Analysis (4)

Tool	Description
`decompile_function`	Hex-Rays C pseudocode decompilation
`disassemble_function`	Full assembly listing for a function
`disassemble_range`	Assembly between two addresses
`get_bytes`	Read raw hex bytes from an address

Tool	Description
`list_functions`	List all functions with optional filter
`get_function_info`	Detailed function metadata
`list_segments`	Memory segments with permissions
`get_xrefs_to`	Cross-references TO an address
`get_xrefs_from`	Cross-references FROM an address
`list_strings`	Defined strings with optional filter
`get_imports`	Imported functions by module
`get_exports`	Exported functions and entry points
`list_structs`	Structures, unions, member layouts
`list_enums`	Enumerations and values
`create_struct`	Create a new struct type
`get_function_callers`	Functions calling a target (with call sites)
`get_function_callees`	Functions called by a target
`make_string`	Define a C-style string at address

Introspection (14)

Tool	Description
`get_flowchart`	Control flow graph — basic blocks with predecessors/successors
`get_comment`	Read comment at an address
`get_all_comments`	Read all comments within a function
`get_function_comment`	Read function-level comment
`set_function_comment`	Set function-level comment
`get_stack_frame`	Full stack frame layout (locals, args, saved regs)
`set_operand_type`	Change operand display (hex/decimal/binary/char)
`set_local_variable_type`	Retype a local variable in decompilation
`get_color`	Get instruction/function/segment color
`set_color`	Set instruction/function/segment color (RGB)
`get_function_hash`	Hash function bytes (MD5/SHA1/SHA256)
`get_exception_info`	Detect try/catch/throw in a function
`get_microcode`	Hex-Rays intermediate representation at any maturity level

Modifications (7)

Tool	Description
`rename_function`	Rename a function
`rename_address`	Rename a label, variable, or address
`set_comment`	Set regular or repeatable comment
`set_function_type`	Set C function signature/prototype
`set_type`	Set type at address
`rename_local_variable`	Rename local variable (Hex-Rays)
`apply_callee_type`	Apply type at call site

Search (2)

Tool	Description
`search_text`	Text search through disassembly
`search_bytes`	Byte pattern/signature search

Debugger (17)

Tool	Description
`start_debugger`	Start debugging the binary
`get_debugger_status`	Check debugger active/suspended state
`set_breakpoint`	Set software breakpoint
`delete_breakpoint`	Remove a breakpoint
`list_breakpoints`	List all breakpoints
`enable_breakpoint`	Enable/disable breakpoint
`step_into`	Step into next instruction
`step_over`	Step over next instruction
`continue_execution`	Continue until next breakpoint
`suspend_debugger`	Pause execution
`exit_debugger`	Terminate process
`get_registers`	Read CPU registers
`read_debug_memory`	Read memory from debugged process (hex dump with ASCII)
`get_stack_trace`	Call stack trace
`list_debugger_threads`	List all process threads
`switch_thread`	Switch active debugger thread
`add_watchpoint`	Set hardware watchpoint (read/write/execute)

Advanced (14)

Tool	Description
`patch_bytes`	Patch bytes in the IDA database
`execute_idapython`	Run arbitrary IDAPython code
`load_type_library`	Load .til type information library
`list_type_libraries`	List loaded TILs
`make_code`	Convert bytes to code (instruction)
`make_data`	Convert bytes to typed data
`undefine`	Revert to raw undefined bytes
`define_function`	Create function at address range
`undefine_function`	Delete function definition
`add_bookmark`	Add persistent bookmark
`list_bookmarks`	List all bookmarks
`delete_bookmark`	Remove bookmark
`get_local_variables`	List local variables and arguments
`get_global_variables`	List named global data variables

Database & Export (12)

Tool	Description
`save_database`	Save the IDA database
`apply_flirt_signature`	Apply FLIRT .sig for library identification
`list_flirt_signatures`	List applied FLIRT signatures
`create_segment`	Create new memory segment
`delete_segment`	Delete segment definition
`set_segment_permissions`	Change segment rwx permissions
`create_array`	Define typed arrays
`navigate_to`	Jump IDA cursor to address
`produce_asm`	Export clean assembly listing
`produce_c`	Export clean C pseudocode
`run_idc_script`	Execute IDC script code
`run_ida_action`	Trigger registered IDA UI action
`list_ida_actions`	List all available IDA actions

Meta (3)

Tool	Description
`get_binary_info`	File path, arch, bitness, entry point
`get_analysis_status`	Check auto-analysis completion
`ping`	Check IDA connectivity