IDA MCP
OfficialThis server is an MCP bridge that lets AI agents inspect and drive Hex-Rays IDA databases through IDA Nexus.
reference: look up IDA API classes, methods, or concepts before writing code.
open_database: attach to a GUI database or headless idalib worker.
execute_python: run Python against an open database with persistent state and captured stdout/stderr.
list_databases: discover registered GUI and idalib databases.
save_database: explicitly save the active database.
close_database: release the MCP handle without disrupting other clients.
Can run over stdio or HTTP and integrates with agents like Claude Code, Codex, Copilot, and Pi.
Enables GitHub Copilot CLI to attach to GUI or headless idalib databases, execute Python analysis scripts, query IDA API references, and save or close IDA databases.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@IDA MCPAnalyze the open binary and list its imports"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Hex-Rays IDA MCP
⚠️ Experimental prerelease ⚠️
Official Hex-Rays IDA MCP Server.
Installation
Requirements
Installed in your PATH
IDA 9.4 or higher with idalib and Python 3.11+
Other IDA MCP servers must be disabled to reduce agent confusion
IDA GUI Plugin
To support IDA GUI instances when using Hex-Rays IDA MCP, install the plugin:
uvx ida-hcli plugin install https://github.com/HexRaysSA/ida-mcp
# or if you have hcli installed:
hcli plugin install https://github.com/HexRaysSA/ida-mcpNote: Without the GUI plugin, IDA MCP will only work headlessly.
Claude Code
# Add Hex-Rays marketplace
claude plugin marketplace add HexRaysSA/claude-marketplace
# Install plugin
claude plugin install ida-mcp@HexRaysSA
# Update to latest version
claude plugin update ida-mcp@HexRaysSACodex CLI
# Add Hex-Rays marketplace
codex plugin marketplace add HexRaysSA/codex-marketplace
# Install plugin
codex plugin add ida-mcp@HexRaysSAGitHub Copilot CLI
# Add Hex-Rays marketplace
copilot plugin marketplace add HexRaysSA/copilot-marketplace
# Install plugin
copilot plugin install ida-mcp@HexRaysSA
# Update to latest version
copilot plugin update ida-mcpPi
# Install extension
pi install git:github.com/HexRaysSA/ida-mcp@latest
# Update to latest version
pi update --extensionsoh-my-pi
# Install extension
omp plugin install github:HexRaysSA/ida-mcp#latest
# Update to latest version
omp plugin upgradeOther agents
Configure a regular stdio MCP server in your MCP JSON configuration:
{
"mcpServers": {
"ida": {
"command": "uvx",
"args": [
"--exclude-newer=1s",
"ida-mcp",
"stdio",
"--agent=my-agent"
]
}
}
}uvx resolves the latest stable ida-mcp release from PyPI, so this
configuration does not need to be updated for each release.
--agent=my-agent is a human-chosen label (like claude-code, cursor,
my-custom-agent, etc.) used to differentiate sessions in the dashboard.
Related MCP server: IDA Pro MCP Multi
Commands
Every invocation requires a subcommand:
# MCP server over standard input/output
uvx ida-mcp stdio --agent=my-agent
# MCP server over Streamable HTTP
uvx ida-mcp http --host 127.0.0.1 --port 8737
# Inspect semantic MCP sessions
uvx ida-mcp dashboard --open
# Export sessions, linked agent transcripts, and Nexus worker logs
uvx ida-mcp logs
# Agent integrations use these as pre-tool hooks
uvx ida-mcp hook claude
uvx ida-mcp hook codex
uvx ida-mcp hook copilotSemantic session files remain in the shared IDA Nexus state directory under
sessions/, including when IDA_NEXUS_STATE_DIR overrides that directory.
Embedding
The server API is available from ida_mcp.mcp for applications that need to
add tools or host Streamable HTTP themselves:
from ida_mcp.mcp import serve_http, stop_http_server, tool
@tool
def application_status() -> str:
"""Return the embedding application's status."""
return "ready"
serve_http("127.0.0.1", 8737, path_prefix="/hex-rays")
# Later, during application shutdown:
stop_http_server()serve_http() also accepts a DatabaseManager subclass and constructor
arguments for hosts that provide custom database resolution. See
the architecture documentation for lifecycle, tracing,
and archive details.
We tested the following clients, but any MCP client should work similarly:
Example Usage
Start your agent harness and ask it something like:
Reverse /path/to/sample.elf for me
To test the GUI integration, open something in IDA and ask your harness:
What do I have open in the IDA GUI?
Developers: IDA Nexus
The IDA MCP project is built on IDA Nexus, which allows multiple clients to seamlessly share and operate on IDA databases.
You can build your own tools on top of the ida-nexus library, see
the documentation
for more information.
Available Tools
6 toolsclose_databaseA
Release this MCP's IDA Nexus database handle without disrupting other clients.
If this is the final lease on a managed idalib worker, orphaned execution is cancelled and this call waits for the IDB to finish closing. GUI databases are never closed here.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, release the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| closed | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses important behavioral details: cancellation of orphaned execution on final lease, waiting for IDB to close, and the GUI database exclusion. This goes beyond what the schema or annotations would convey, giving the agent a clear picture of side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each carrying substantive information. The primary action and key constraint are front-loaded, with behavioral caveats following. No redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter) and the presence of an output schema, the description covers the purpose, the key behavioral side effects, and an exclusion. An agent can safely decide when and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes the single optional parameter (instance_id) with clear semantics ('If omitted, release the current target'). The description adds no further parameter meaning, so the baseline score of 3 for high schema coverage applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Release this MCP's IDA Nexus database handle') and adds scope ('without disrupting other clients'). It clearly differentiates from siblings by mentioning the managed idalib worker and GUI databases, making it obvious this is the close operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (to release the handle) and provides an explicit exclusion ('GUI databases are never closed here'), which helps the agent avoid misuse. However, it does not explicitly name alternatives like open_database or save_database, so the contrast is implicit rather than direct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_pythonA
Execute Python and return its result plus captured stdout and stderr.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Python code that runs against an already-open database. Call reference(query) first; do not guess the API shape. `db` is the current ida-domain Database, and `ida_domain` is also imported globally. Imports, variables, and definitions persist for this agent's database lease. A single or trailing expression is returned. For function-style code, define run(db), execute(db), or main(db); it is invoked automatically when there is no trailing expression. | |
| timeout | No | Python execution timeout in seconds. This does not include the separate initial autoanalysis wait. | |
| instance_id | No | Optional database instance id. If omitted, use the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes | |
| stderr | Yes | |
| stdout | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully carries the burden and does so well: it discloses cross-call persistence, automatic invocation of run(db)/execute(db)/main(db), single/trailing expression return, captured stdout/stderr, and timeout behavior excluding the autoanalysis wait. This goes well beyond typical 'executes code' descriptions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The main description is one focused sentence with the key output promise front-loaded, and the longer parameter descriptions are dense but organized around distinct semantics. No filler or repetition of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The definition is nearly complete: it explains environment, state persistence, invocation conventions, timeout, target selection, and output capture, and the output schema covers return shape. It lacks an explicit warning that arbitrary Python may mutate the database or cause side effects, which is more salient because no annotations exist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are described with 100% coverage, and the code parameter description adds substantial operational meaning: the execution environment, available globals (db, ida_domain), required reference() pattern, persistence, and return conventions. The timeout and instance_id descriptions also clarify defaults and exclusions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Execute Python') and return behavior ('result plus captured stdout and stderr'), which clearly differentiates it from the database-lifecycle siblings. The function-style invocation rules in the code parameter further pin down what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs the agent to call reference(query) first and not guess the API shape, and states that code runs against an already-open database. It does not explicitly contrast with siblings, but the prerequisite and persistence guidance give clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesA
Discover registered GUI and idalib databases in IDA Nexus.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | No | |
| instances | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full burden of behavioral disclosure. It implies a read-only operation via 'Discover' and adds context with 'registered', but does not explicitly state that it does not modify state, require permissions, or have side effects. For a simple listing tool this is acceptable, but it lacks explicit transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core action and resource. Every word earns its place; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with no parameters and an output schema is present, so the description need not explain return values. It clearly conveys the purpose and the scope ('registered'), which is sufficient for an agent to understand what it does. Minor gaps such as clarifying the meaning of 'registered' are not critical given the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline for parameter semantics is 4. The description adds no parameter-specific information because none are needed, and the input schema is empty, so there is nothing to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Discover' and names the resource ('registered GUI and idalib databases') plus the environment ('IDA Nexus'). This clearly distinguishes it from sibling tools like open_database, close_database, and save_database, which are all actions on databases rather than discovery.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. The description only states what it does, not when it should be called (e.g., as a precursor to open_database). There is no mention of exclusions or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_databaseB
Attach to a GUI database or shared managed idalib worker through IDA Nexus.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to a local executable or IDB. A GUI instance is used when available. | |
| set_current | No | Whether this database should become the default target for execute_python(). |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | Yes | |
| status | Yes | Attachment state: attached or current. |
| backend | Yes | Instance backend: gui or idalib. |
| log_path | Yes | |
| nexus_id | Yes | |
| recovery | Yes | Crash recovery performed while opening: none, repaired, or restored. |
| instance_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does reveal the core mechanism (two attachment modes: GUI database vs shared managed idalib worker), which is genuine behavioral context. However, it omits side effects — whether opening locks the database, what happens if it is already open, resource implications, or failure modes — leaving an agent guessing about the operation's consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single 15-word sentence with zero filler, and the core action is front-loaded. It is efficient, but the brevity comes at the cost of omitted usage guidance and behavioral detail, so it earns a 4 rather than a 5 — it is concise but slightly under-specified for the complexity of the operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema exists, so return values need no description. The schema covers both parameters. However, given the tool is an open/attach operation with two modes and siblings forming a clear lifecycle (open → save/execute/close), the description lacks the usage context and side-effect disclosure needed to be fully self-sufficient. It is adequate but leaves meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline 3 applies. The schema already documents both parameters well (path: 'Path to a local executable or IDB'; set_current: whether it becomes default for execute_python). The description itself adds no parameter-level meaning beyond the schema, so it neither helps nor hurts — the schema carries the load, making 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Attach') with a clear resource ('GUI database or shared managed idalib worker through IDA Nexus'). It distinguishes from siblings like save_database and close_database by focusing on the opening/attaching action, and from execute_python by naming attachment rather than execution. It loses a point because the technical jargon ('idalib worker', 'IDA Nexus') is unexplained and could confuse an agent unfamiliar with the domain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is only implied — as an open operation it is clearly a precursor to save/close/execute, but the description never states when to choose it over siblings, nor does it give exclusions or prerequisites. The schema's 'A GUI instance is used when available' hints at behavior but not at decision guidance. There is no explicit when-to-use or when-not-to-use statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
referenceA
Look up the active ida-domain API and return a plain-text IDA reference.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Class, method, or reverse-engineering concept to look up in the IDA reference. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the burden of behavioral disclosure. 'Look up' implies a read-only operation and 'plain-text' discloses the return format, but it does not explicitly state side-effect profile, behavior on unknown queries, or dependence on an active domain beyond the word 'active.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, direct sentence conveys the action, target, and output with no filler or redundancy. The key scoping detail ('active ida-domain API') is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter lookup tool, this is mostly adequate, but the description leaves some gaps: no output schema exists, yet return details are only 'plain-text IDA reference,' and there is no mention of no-match behavior or what 'active ida-domain API' precisely means.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the query parameter is already documented as 'Class, method, or reverse-engineering concept.' The description adds no material meaning beyond what the schema provides, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Look up'), a specific resource ('the active ida-domain API'), and a concrete output ('plain-text IDA reference'). It is clearly distinct from sibling tools that manage databases or execute Python.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies this tool is for retrieving IDA reference information about a class, method, or concept. It does not explicitly name alternatives or state when not to use it, but the purpose is clear enough for an agent to route to it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_databaseA
Explicitly save an active GUI or idalib database.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No | Optional database instance id. If omitted, save the current target. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of behavioral disclosure. It only states that the tool saves a database; it does not explain what saving entails, whether it overwrites existing state, whether it requires an open database, or what errors may occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the action, the resource, and the scope ('active GUI or idalib database') efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with one fully documented parameter and an output schema, the description is nearly sufficient. However, the lack of annotations and the presence of lifecycle siblings like open_database and close_database suggest that a bit more context about prerequisites or effects would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema already explains that instance_id is optional and that omission targets the current database. The description adds little beyond the schema, which is acceptable because the parameter meaning is already fully documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('save') and a specific resource ('active GUI or idalib database'), so the tool's purpose is immediately clear. It also distinguishes itself from the sibling lifecycle tools such as open_database, close_database, and list_databases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'active ... database' implies the tool should be used on a database that is already open or targeted, which gives some contextual guidance. However, it does not explicitly state when to use this tool instead of close_database, when saving is necessary, or what happens if no active database exists.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.10.3- Changed
open_database2 fields changed- added
Output schema / properties / recoveryAdded value: +{ + "description": "Crash recovery performed while opening: none, repaired, or restored.", + "type": "string" +} - changed
Output schema / requiredPrevious value: -[ - "instance_id", - "backend", - "status", - "log_path", - "nexus_id", - "hint" -]New value: +[ + "instance_id", + "backend", + "status", + "recovery", + "log_path", + "nexus_id", + "hint" +]
6 tool updates
v0.7.0- First observed
close_database - First observed
execute_python - First observed
list_databases - First observed
open_database - First observed
reference - First observed
save_database
TDQS
Scored across 6 tools
Each tool has a clearly distinct purpose: reference for API lookup, open_database for attaching, execute_python for running code, list_databases for discovery, save_database for persistence, and close_database for cleanup. No two tools overlap in functionality, making misselection unlikely.
Most tools follow a consistent verb_noun pattern (open_database, list_databases, save_database, close_database, execute_python). The exception is 'reference', which is a noun and deviates from the verb-first convention, but it remains clear and unambiguous, so the minor inconsistency is acceptable.
Six tools is well within the ideal range for a focused server. Each tool covers a distinct operation necessary for IDA database interaction and Python execution, with no redundancy or bloat.
The surface covers the core lifecycle (open, list, save, close) and execution (execute_python) along with reference lookup. While there is no explicit 'create database' or 'get database info' tool, execute_python can handle arbitrary operations, mitigating any gaps. Minor missing features like status checks are workable.
Maintenance
Related MCP Connectors
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Codebase intelligence for agents: 152 structured artifacts across 21 programs, one call.
Code intelligence for coding agents: semantic, AST, graph, and full-text search. 279+ languages.
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Related MCP Servers
- AlicenseCqualityDmaintenanceEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.562MIT
- AlicenseNot gradedqualityCmaintenanceExtends IDA Pro with multi-instance support and vulnerability scanning for AI-assisted reverse engineering.12MIT
- AlicenseNot gradedqualityDmaintenanceEnables LLM clients like Claude to interact with IDA Pro for binary analysis, decompilation, cross-references, patching, and more via 41 MCP tools, 8 resources, and 7 guided prompts.52MIT
- FlicenseNot gradedqualityCmaintenanceEnables LLMs to perform binary analysis and reverse engineering via IDA Pro's headless idalib, providing 66 MCP tools like decompile, disasm, and xrefs without requiring the IDA GUI.-