Health check. Returns {ok, instance_id, pid, input_file, ...} for the resolved IDA instance.

List all live IDA databases/instances ({instance_id, pid, headless, input_file}); pass one as instance_id on every tool call while several are live.

Open a binary or .i64 database in a headless idalib worker (creates/analyzes the .i64). Call this first. Record the returned instance.instance_id — every subsequent tool call must carry it while multiple databases are open.

Save the current (or specified) IDA database to disk (.i64).

Release an IDA database worker: saved and shut down when the last user detaches; terminate=true forces shutdown. Use when its analysis is finished or no longer needed — the other instances are unaffected.

Search the official IDAPython API documentation (from the attached IDA runtime). Returns signatures + docstrings; pass 'modules' as query to list modules.

Add a new memory segment to the IDB.

Apply IDB byte patches to a copied input file and export it.

Build a call graph by walking call references from the root function(s).

Convert number to hex/unsigned/signed representations.

Create a function at an address.

Add breakpoint(s) at address(es).

Get current call stack (requires active debugger).

Continue execution.

Delete breakpoint(s) at address(es).

Enable or disable breakpoint(s).

Exit debugger.

List all breakpoints (works without active debugger).

Read memory from debugged process.

Get all debugger registers (requires active debugger).

Run debugger to specific address.

Start the debugger on the current input file. The local debugger is

Get debugger status: state, pid, threads, current instruction pointer.

Step into instruction.

Step over instruction.

Read registers of one or more debug threads (temporarily selects each thread, then restores).

Write memory to debugged process.

Declare or update an enum in the local type library.

Create stack variable(s) at specified offset(s).

Declare or update a struct in the local type library.

Declare or update a typedef in the local type library.

Decompile function(s) at given address(es). Requires Hex-Rays.

Delete an existing function.

Delete a memory segment from the IDB.

Delete stack variable(s) by name.

Snapshot a function's decompilation, run a modification tool, return the unified diff.

Disassemble function(s) into listing lines (hex addresses, no color tags).

Search for byte pattern with wildcards (?? for any byte).

Find instructions by mnemonic and/or a regex over the instruction text.

Search symbol names (functions, globals, labels) with a regular expression.

Find signatures for code locations that reference an address. For each

Invalidate cached Hex-Rays decompilations so they are regenerated.

Get basic blocks with control flow information.

Read raw bytes at address(es).

Get callees grouped by target function and call sites.

Get callers grouped by calling function and call sites.

Get current cursor position and context in IDA.

Get all program entry points.

Get the best available function signature string.

Get IDB metadata (input_file, arch, bits, endian, hash).

Read null-terminated string(s).

Get detailed structure/union definition with fields.

Guess the type at each address with IDA's type inference and apply it as a guessed type.

Linear disassemble from arbitrary address (not limited to functions).

List exported functions/symbols.

List functions with pagination and optional filtering.

List global (non-function) symbols with pagination.

List imported functions with module names.

List all local types defined in the database.

List memory segments with permissions.

List extracted strings with pagination.

List all structures/unions defined in the database.

Convert bytes at an address into code.

Create typed data items at an address.

Create unique byte signatures for addresses. Generates the shortest

Create unique byte signatures for function entry points. Resolves each

Create a byte signature for a specific address range (e.g. a selected

Create a string literal at an address.

Assemble instruction text and patch it at address(es). Requires processor assembler support (e.g. x86).

Patch bytes at address(es). Each item: {address, bytes}.

Execute Python code in IDA context.

Execute a Python script file in IDA context and capture output.

Read scalar integer(s) with explicit width.

Rename function. Accepts function name or address.

Rename global variable.

Rename local variable (Hex-Rays).

Save the current IDA database to disk.

Search disassembly listing text (instructions, comments) across the database.

Set comments at address(es). Each item: {address, comment}.

Set function prototype (type signature).

Set global variable type.

Set local variable type (Hex-Rays).

Set the display type of an instruction operand (hex/dec/oct/bin/char/stkvar).

Get stack frame variables for function(s).

High-level binary overview: metadata, entity counts, segments, entry points.

Trace data references (reads/writes/offsets) to and from an address.

Undefine items in a range.

Block until IDA auto-analysis (functions, xrefs, strings) completes.

Get all cross-references from address(es).

Get all cross-references to address(es).

Search struct field references. Heuristic by default (name/offset text