List all registered IDA Pro instances with their metadata.

Re-discover tools from IDA Pro instances.

Compare two IDA instances by diffing their binary metadata, entrypoints, and segments. Takes two instance_id values and returns what is common vs unique to each.

List all cached truncated outputs with cache_id, age, size, and tool name. Use this to find cache IDs for get_cached_output.

Retrieve cached output from a previous tool call that was truncated. Use this to get additional chunks of large responses.

Decompile functions and save results directly to files on disk. IMPORTANT: Each function requires a separate IDA decompile call. For large binaries, check function count with list_funcs first before using 'all'. Hundreds of functions can take minutes; thousands can take much longer.

Get functions by address or name (auto-detects)

Convert numbers to different formats

List functions WARNING: IDA executes on a single main thread. Long-running operations will block ALL subsequent requests and make IDA unresponsive. For large binaries (100K+ functions), use count/offset pagination. Avoid count=0 (all) with glob filters on large binaries.

List globals

Force-refresh all caches (strings, functions, globals). Call this after bulk modifications to ensure list_funcs/list_globals return fresh data.

List imports

Search strings with case-insensitive regex patterns

Decompile function to pseudocode

Disassemble function to assembly instructions

Get cross-references to specified addresses

Get cross-references to structure fields

Get functions called by the specified functions

Search for byte patterns in the binary (supports wildcards with ??)

Get control flow graph basic blocks for functions

Search for patterns in the binary (strings, immediate values, or references)

Export function data in various formats

Build call graph starting from root functions

Read bytes from memory addresses

Read integer values from memory addresses

Read strings from memory addresses

Read global variable values by address or name (auto-detects hex addresses vs names)

Patch bytes at memory addresses with hex data

Write integer values to memory addresses

Declare types

Reads struct type definition and parses actual memory values at the given address as instances of that struct type.

If struct name is not provided, attempts to auto-detect from address. Auto-detection only works if IDA already has type information applied at that address

Returns struct layout with actual memory values for each field.

Search structs

Apply types (function/global/local/stack)

Infer types

Set comments at addresses (both disassembly and decompiler views)

Patch assembly instructions at addresses

Unified rename operation for functions, globals, locals, and stack variables

Append comments at addresses, deduping exact text by default. Unlike set_comments (which overwrites), this preserves existing annotations — use it for incremental commentary. scope='auto' (default) writes a function comment when addr is a function start, otherwise a line comment; force with scope='func' or 'line'. dedupe=True skips writes when the exact stripped text already appears on its own line.

Define a function at each given address. IDA infers bounds unless an explicit end address is provided. Returns {addr, start, end} on success or {addr, start, error} if the function already exists or add_func fails. Use this when IDA auto-analysis missed a function entry point.

Convert raw bytes to a code instruction at each given address. Returns {addr, ea, length} on success (length is the instruction byte length) or {addr, ea, error} if create_insn failed. Use this when IDA classified an instruction as data or failed to decode.

Undefine item(s) at each address, converting them back to raw bytes. Size is determined from end (exclusive) or size; defaults to 1 byte. Uses ida_bytes.DELIT_EXPAND so adjacent items spanning into the range are fully removed. Returns {addr, start, size} on success.

Get stack vars

Create stack vars

Delete stack vars

Execute Python code in IDA context. Returns dict with result/stdout/stderr. Has access to all IDA API modules. Supports Jupyter-style evaluation. WARNING: IDA executes on a single main thread. Long-running operations will block ALL subsequent requests and make IDA unresponsive. Do NOT iterate all functions, bulk decompile, or run heavy loops. Use decompile_to_file for batch decompilation instead.

Get a compact overview of the binary in one call. Returns file metadata, segment layout, entry points, statistics, top 15 strings and functions ranked by xref count (functions include classification: thunk/wrapper/leaf/dispatcher/ complex), imports by category, and call graph summary. Use this as your FIRST tool call when starting analysis. Do not call list_funcs, imports, or find_regex separately for triage — this returns all of that. Use detail_level='minimal' for binaries with >10k functions.

Compact single-function analysis: pseudocode (capped at 100 lines), top strings, top non-trivial constants, callers, callees, xrefs, comments, and basic block summary. Use this for "tell me everything about function X" in one call instead of chaining decompile + callees + xrefs_to separately.

Analyze related functions as a group: per-function compact summaries, internal call graph (edges only between supplied functions), shared globals, interface vs internal classification, and strings used by multiple members.

Apply a rename/type/comment action and return the before/after decompilation side by side. Actions: 'rename_func' ({name}), 'set_type' ({type}), 'set_comment' ({comment}). Useful to verify a rename or type change actually improved readability. Returns {before, after, action_applied, changes_detected}.

Follow cross-references from or to an address, automatically traversing multiple hops. 'forward' follows xrefs-from, 'backward' follows xrefs-to. Returns nodes (with function name, instruction, code/data classification) and edges. Do not use for call graph traversal — use callgraph for that.

Create unique byte signatures for addresses.

Create unique byte signatures for function entry points.

Create a byte signature for an explicit address range.

Find signatures for code locations that reference an address.

Query local types with structured filters and pagination.

Inspect named types with size, declaration, and optional member layout.

Apply multiple type edits and return aggregate status.

Query IDB entities with filtering, projection, and pagination.

Search rendered listing text using IDA native text search.

Execute a Python script file in IDA context.

Return debugger lifecycle state and current IP if suspended.

Set or clear breakpoint conditions in batch.

Get general-purpose registers for the current thread.

Get general-purpose registers for specified thread IDs.

Get selected registers for the current thread.

Get selected registers for a specific thread ID.