Skip to main content
Glama
SuZiXunYue

IDA Script MCP

by SuZiXunYue

IDA Script MCP

English | 中文


English Version

Execute IDAPython scripts in IDA Pro through any MCP-compatible AI assistant.

Why IDA Script MCP?

IDA Script MCP

Latency

< 1ms per request (local HTTP, no IPC overhead)

Footprint

Zero external dependencies inside IDA — stdlib-only plugin

Startup

Plugin ready instantly, no background process in IDA

Concurrency

Run N IDA instances, each on its own port, zero conflict

API Coverage

Full access to 40+ IDA modules including Hex-Rays decompiler

The IDA-side plugin uses only Python stdlib (http.server, socket, json) — no pip packages needed inside IDA Pro. The MCP server (separate process) uses FastMCP for the protocol layer and communicates with IDA via plain HTTP on localhost. This means:

  • No slow startup inside IDA

  • No dependency conflicts with IDA's bundled Python

  • No memory overhead from heavy frameworks loaded into IDA

  • Each IDA instance is completely independent — one crash doesn't affect others

Features

  • AI-Powered Analysis — Let any MCP-compatible AI assistant analyze binaries directly in IDA Pro

  • Multi-Instance Support — Analyze multiple binaries simultaneously across different IDA instances with automatic port assignment

  • Async Task Execution — Long-running scripts won't disconnect the client; poll for results with configurable timeout

  • One-Command Setup — Install IDA plugin + configure your AI client in a single step

  • Full IDA API Access — Complete access to all IDA modules (idaapi, idc, idautils, ida_hexrays, etc.)

  • Jupyter-style Evaluation — Last expression is automatically returned as the result value

  • Output Capture — Capture stdout/stderr and return values from executed code

  • Universal Client Support — Works with any MCP-compatible AI client (see Supported Clients)

Requirements

  • IDA Pro 8.3+ (IDA Free does not support plugins)

  • Python 3.11+

  • Windows / macOS / Linux

Installation

pip install ida-script-mcp
ida-script-mcp-install install claude

Option 2: uv

uv pip install ida-script-mcp
ida-script-mcp-install install claude

Option 3: pipx (isolated environment)

pipx install ida-script-mcp
ida-script-mcp-install install claude

Option 4: From Source

git clone https://github.com/SuZiXunYue/ida-script-mcp.git
cd ida-script-mcp
pip install -e .
ida-script-mcp-install install

Advanced Options

# Install plugin only (no client configuration)
ida-script-mcp-install install

# Configure multiple MCP clients at once
ida-script-mcp-install install claude,cursor,cline

# Use project-level configuration (per-repo settings)
ida-script-mcp-install install --project claude

# List all available MCP clients
ida-script-mcp-install --list-clients

# Print raw MCP config JSON (for manual configuration)
ida-script-mcp-install --config

# Uninstall everything
ida-script-mcp-install uninstall claude

Usage

1. Start IDA Plugin

  1. Open IDA Pro and load a binary file

  2. Go to Edit → Plugins → IDA-Script-MCP (or press Ctrl+Alt+S)

  3. Plugin will start and show:

    [IDA-Script-MCP] Server started at http://127.0.0.1:13338
    [IDA-Script-MCP] Instance ID: 12345_crackme.exe
    [IDA-Script-MCP] Database: crackme.exe

2. Use with AI Assistant

The MCP server provides these tools to your AI assistant:

Tool

Description

list_ida_instances

List all running IDA instances with ports and database info

execute_idapython

Execute Python code in IDA Pro (supports instance_id, port, and timeout)

check_ida_connection

Check connection status and health of all IDA instances

get_ida_database_info

Get database name, path, and platform info

check_task_status

Check the status of a long-running script execution task

cancel_ida_task

Cancel a pending task, or flag a running task for cooperative cancellation

Long-Running Scripts

By default, execute_idapython waits up to 600 seconds for a script to complete, polling the IDA plugin for progress. If the script takes longer, a task_id is returned:

{
  "task_id": "a1b2c3d4",
  "status": "running",
  "message": "Script execution timed out after 600s. Use check_task_status with task_id 'a1b2c3d4' to check result later."
}

You can then use check_task_status to query the result once the script finishes:

check_task_status(task_id="a1b2c3d4")

You can also customize the timeout:

execute_idapython(code="long_analysis()", timeout=1800)

Long scripts can poll the injected mcp_cancelled() helper so they can be stopped cooperatively via the cancel_ida_task tool. Pending tasks are cancelled immediately; running tasks observe the flag the next time the script calls mcp_cancelled(). A loop that never polls cannot be interrupted — always include the check in long loops.

3. Example Commands for AI

Ask your AI assistant to:

  • "List all functions in this binary"

  • "Decompile the main function"

  • "Find all xrefs to address 0x401000"

  • "Rename function at 0x401000 to my_function"

  • "Show all strings in the binary"

Supported MCP Clients

This plugin supports all MCP-compatible clients. The installer provides automatic configuration for the following popular clients:

Client

Install Command

Config File

Claude Desktop

ida-script-mcp-install install claude

claude_desktop_config.json

Claude Code

ida-script-mcp-install install claude-code

.claude.json

Cursor

ida-script-mcp-install install cursor

.cursor/mcp.json

VS Code

ida-script-mcp-install install vscode

settings.json

Windsurf

ida-script-mcp-install install windsurf

mcp_config.json

The following clients are not auto-configured by the installer yet, but work perfectly with IDA Script MCP. Add the config snippet below to the client's MCP settings file:

Client

Config Location

Cline (VS Code extension)

VS Code settings.json → cline.mcpServers

Roo Code (VS Code extension)

.roo/mcp.json

Trae

Trae MCP settings

Augment

Augment MCP settings

Continue

~/.continue/config.json

Copilot (MCP mode)

VS Code settings.json → mcp.servers

Amazon Q Developer

Q Developer MCP settings

Aider

.aider.conf.yml

Any MCP-compatible client

Client's MCP config file

Manual config snippet (add to your client's MCP servers section):

{
  "mcpServers": {
    "ida-script-mcp": {
      "command": "python",
      "args": ["-m", "ida_script_mcp.server"]
    }
  }
}

If you're using a virtual environment, replace "python" with the full path:

# Find your Python path
python -c "import sys; print(sys.executable)"

Configure Multiple Clients at Once

ida-script-mcp-install install claude,cursor,vscode,windsurf

Troubleshooting

Plugin not found in IDA

  • Ensure plugin file is in IDA's plugins directory

  • Check IDA output window for errors

  • Re-run ida-script-mcp-install install

Connection refused

  • Verify IDA Pro is running with a database loaded

  • Confirm plugin is started (Edit → Plugins → IDA-Script-MCP)

  • Check that the port matches in ~/.ida_script_mcp_instances.json

Multiple instances route to wrong IDA

  • This was a Windows-specific bug fixed in v1.1.0 — ensure you're on the latest version

  • Each IDA instance should get a unique port (13338, 13339, 13340, ...)

Script times out / client disconnects

  • Long-running scripts now use async task execution — the server polls for results instead of blocking

  • If you see a task_id in the response, use check_task_status to query the result later

  • Adjust the timeout parameter (default: 600s) if your script needs more time:

    execute_idapython(code="slow_analysis()", timeout=1800)

Command not found

pip show ida-script-mcp
which ida-script-mcp-install

Security Note

This plugin allows arbitrary Python code execution in IDA Pro:

  • Per-instance token authentication (since v1.3.0): every request to the plugin must carry the X-MCP-Token header; the token is generated at plugin start and stored in ~/.ida_script_mcp_instances.json, so other processes cannot drive IDA without read access to that file

  • Host header validation (since v1.3.0): only 127.0.0.1 / localhost / [::1] hosts are accepted; no CORS headers are emitted

  • Use only with trusted AI assistants

  • Plugin binds to 127.0.0.1 by default (localhost only)

  • Never expose the HTTP port to public networks

License

MIT License

Changelog

[1.3.0] - 2026-09-28

Security:

  • Per-instance token authentication: every plugin request now requires the X-MCP-Token header. The token is generated at server start, stored in ~/.ida_script_mcp_instances.json, and never printed to the IDA console. This prevents untrusted local processes (e.g. a malware sample under analysis) from driving IDA via POST /execute.

  • Host header validation: non-loopback Host values are rejected with 403 (DNS-rebinding hardening).

  • CORS removed: no Access-Control-Allow-Origin headers are emitted anymore.

  • Registry hardening: cross-process file locking and atomic writes for ~/.ida_script_mcp_instances.json (concurrent IDA instances can no longer clobber each other's registrations); file permissions restricted to 0600 where supported.

  • Removed the dangerous Windows os.kill(pid, 0) liveness probe (which would terminate the probed process on Windows).

Added:

  • cancel_ida_task tool + POST /task/{id}/cancel endpoint; scripts get an injected mcp_cancelled() helper for cooperative cancellation of long loops.

  • Task queue cap with honest "queue full" feedback instead of unbounded growth.

  • --ida-token flag / IDA_SCRIPT_MCP_TOKEN env for pinning tokens in headless setups; IDAUSER support in the installer.

Fixed:

  • Result/status race on task completion (a poller could see completed with no result payload).

  • execute_sync scheduling failures no longer block forever — a clear error is raised.

  • check_ida_connection / get_ida_database_info no longer block the MCP event loop (all HTTP calls now run in a worker thread).

  • /health and /metadata no longer call idaapi from HTTP worker threads (they serve a snapshot captured on the main thread at plugin start).

  • Ambiguous instance_id substring matches now error out instead of routing to a random instance; timeout is validated (1–86400 s).

  • --transport http now serves streamable-http (SSE fallback) instead of silently running SSE.

  • Statements-only scripts return a local result variable instead of an arbitrary last-assigned variable; None results serialize as JSON null.

  • Docs: removed references to the nonexistent int_convert tool; fixed the v1.0.1/v1.1.0 version-number inconsistency.

Upgrade note: restart IDA (or re-toggle the plugin) so the new plugin authenticates with the new MCP server. Mixed setups keep working: legacy plugin instances still accept tokenless requests.

[1.2.0] - 2026-05-08

Added:

  • Async task execution system: Long-running scripts no longer cause client disconnection. Scripts are submitted asynchronously to IDA, and the MCP server polls for completion with exponential backoff (0.5s → 5s cap). If the configurable timeout (default: 600s) is exceeded, a task_id is returned for later status queries.

  • check_task_status tool: New MCP tool to query the status and result of a long-running script execution task by its task_id.

  • timeout parameter for execute_idapython: Configurable maximum wait time (default: 600 seconds) before returning a task_id for deferred polling.

  • Task management endpoints in IDA plugin: GET /task/{id} to query task status/result, GET /tasks to list all tasks.

  • async mode for POST /execute: IDA plugin now accepts {"async": true} to submit scripts for background execution and immediately return a task_id.

  • ThreadingMixIn HTTP server: The IDA plugin HTTP server now handles each request in a separate thread, preventing a single long-running script from blocking other requests (e.g., health checks, task status queries).

Fixed:

  • Client disconnection on long-running scripts: Previously, scripts running longer than 60 seconds would cause the MCP server's HTTP connection to IDA to time out, while the script continued running in IDA with no way to retrieve the result. The new async task system eliminates this issue.

  • HTTP server blocking: The IDA plugin's single-threaded HTTP server could be blocked by a running script, making all other endpoints (health, metadata) unreachable. Switched to ThreadingMixIn for concurrent request handling.

[1.1.0] - 2026-04-16

Fixed:

  • Windows multi-instance port collision: On Windows, all IDA instances would bind to the same port (13338) because SO_REUSEADDR allows multiple processes to bind the same port without error. Fixed by disabling allow_reuse_address on Windows and adding pre-bind port detection.

[1.0.0] - 2024-01-15

Added:

  • Initial release with list_ida_instances, execute_idapython, check_ida_connection, get_ida_database_info tools.

  • Multi-instance support, auto-discovery, full IDA API access, Jupyter-style evaluation, cross-platform support.


Related MCP server: IX64MCP

中文版本

通过任何支持 MCP 协议的 AI 助手,在 IDA Pro 中执行 IDAPython 脚本。

为什么选择 IDA Script MCP?

IDA Script MCP

延迟

每次请求 < 1ms(本地 HTTP,无 IPC 开销)

资源占用

IDA 内零外部依赖 — 插件仅使用标准库

启动速度

插件即时就绪,IDA 内无后台进程

并发能力

运行 N 个 IDA 实例,各自独立端口,互不冲突

API 覆盖

完整访问 40+ IDA 模块,包括 Hex-Rays 反编译器

IDA 端插件仅使用 Python 标准库(http.server、socket、json)——无需在 IDA Pro 中安装任何 pip 包。MCP 服务器(独立进程)使用 FastMCP 作为协议层,通过本地 HTTP 与 IDA 通信。这意味着:

  • IDA 内无缓慢启动

  • 不与 IDA 内置 Python 产生依赖冲突

  • 不因加载重框架而占用 IDA 内存

  • 每个 IDA 实例完全独立 — 一个崩溃不影响其他

特性

  • AI 驱动分析 — 让任何支持 MCP 的 AI 助手直接在 IDA Pro 中分析二进制文件

  • 多实例支持 — 同时分析多个二进制文件,自动分配端口,实例间互不干扰

  • 异步任务执行 — 长时间运行的脚本不会导致客户端断开连接;可配置超时,轮询获取结果

  • 一键安装 — 一条命令完成 IDA 插件安装和 AI 客户端配置

  • 完整 IDA API 访问 — 完全访问所有 IDA 模块(idaapi、idc、idautils、ida_hexrays 等)

  • Jupyter 风格求值 — 自动返回最后一个表达式的值

  • 输出捕获 — 捕获执行代码的标准输出/错误和返回值

  • 通用客户端支持 — 兼容所有支持 MCP 协议的客户端(见支持客户端)

系统要求

  • IDA Pro 8.3+(IDA Free 不支持插件)

  • Python 3.11+

  • Windows / macOS / Linux

安装

方式一:pip(推荐)

pip install ida-script-mcp
ida-script-mcp-install install claude

方式二:uv

uv pip install ida-script-mcp
ida-script-mcp-install install claude

方式三:pipx(隔离环境)

pipx install ida-script-mcp
ida-script-mcp-install install claude

方式四:从源码安装

git clone https://github.com/SuZiXunYue/ida-script-mcp.git
cd ida-script-mcp
pip install -e .
ida-script-mcp-install install

高级选项

# 仅安装插件(不配置客户端)
ida-script-mcp-install install

# 同时配置多个 MCP 客户端
ida-script-mcp-install install claude,cursor,cline

# 使用项目级配置(每个仓库独立设置)
ida-script-mcp-install install --project claude

# 列出所有可用的 MCP 客户端
ida-script-mcp-install --list-clients

# 打印 MCP 配置 JSON(用于手动配置)
ida-script-mcp-install --config

# 卸载
ida-script-mcp-install uninstall claude

使用方法

1. 启动 IDA 插件

  1. 打开 IDA Pro 并加载二进制文件

  2. 进入 Edit → Plugins → IDA-Script-MCP(或按 Ctrl+Alt+S)

  3. 插件启动后会显示:

    [IDA-Script-MCP] Server started at http://127.0.0.1:13338
    [IDA-Script-MCP] Instance ID: 12345_crackme.exe
    [IDA-Script-MCP] Database: crackme.exe

2. 使用 AI 助手

MCP 服务器为 AI 助手提供以下工具:

工具

说明

list_ida_instances

列出所有运行中的 IDA 实例及其端口和数据库信息

execute_idapython

在 IDA Pro 中执行 Python 代码(支持 instance_id、port 和 timeout)

check_ida_connection

检查所有 IDA 实例的连接状态和健康信息

get_ida_database_info

获取数据库名称、路径和平台信息

check_task_status

查询长时间运行的脚本执行任务的状态

cancel_ida_task

取消尚未开始的任务,或为运行中的任务设置协作式取消标志

长时间运行的脚本

默认情况下,execute_idapython 最多等待 600 秒让脚本完成,期间会轮询 IDA 插件获取进度。如果脚本执行时间超过该限制,会返回一个 task_id:

{
  "task_id": "a1b2c3d4",
  "status": "running",
  "message": "Script execution timed out after 600s. Use check_task_status with task_id 'a1b2c3d4' to check result later."
}

脚本完成后,可使用 check_task_status 查询结果:

check_task_status(task_id="a1b2c3d4")

也可以自定义超时时间:

execute_idapython(code="long_analysis()", timeout=1800)

长脚本应轮询注入的 mcp_cancelled() 辅助函数,以支持通过 cancel_ida_task 工具进行协作式取消。 尚未开始的任务会被立即取消;运行中的任务在脚本下一次调用 mcp_cancelled() 时观察到取消标志。 从不轮询的死循环无法被中断——长循环中务必加入该检查。

3. 示例命令

让 AI 助手执行:

  • "列出此二进制文件中的所有函数"

  • "反编译 main 函数"

  • "查找地址 0x401000 的所有交叉引用"

  • "将地址 0x401000 的函数重命名为 my_function"

  • "显示二进制文件中的所有字符串"

支持的 MCP 客户端

本插件支持所有兼容 MCP 协议的客户端。 安装器为以下常用客户端提供自动配置:

客户端

安装命令

配置文件

Claude Desktop

ida-script-mcp-install install claude

claude_desktop_config.json

Claude Code

ida-script-mcp-install install claude-code

.claude.json

Cursor

ida-script-mcp-install install cursor

.cursor/mcp.json

VS Code

ida-script-mcp-install install vscode

settings.json

Windsurf

ida-script-mcp-install install windsurf

mcp_config.json

更多常用 MCP 客户端(手动配置)

以下客户端暂未纳入安装器自动配置,但完全兼容 IDA Script MCP。将下方配置片段添加到客户端的 MCP 设置中即可:

客户端

配置位置

Cline(VS Code 扩展)

VS Code settings.json → cline.mcpServers

Roo Code(VS Code 扩展)

.roo/mcp.json

Trae

Trae MCP 设置

Augment

Augment MCP 设置

Continue

~/.continue/config.json

Copilot(MCP 模式)

VS Code settings.json → mcp.servers

Amazon Q Developer

Q Developer MCP 设置

Aider

.aider.conf.yml

任何支持 MCP 的客户端

客户端 MCP 配置文件

手动配置片段(添加到客户端的 MCP 服务器配置中):

{
  "mcpServers": {
    "ida-script-mcp": {
      "command": "python",
      "args": ["-m", "ida_script_mcp.server"]
    }
  }
}

如果使用虚拟环境,将 "python" 替换为完整路径:

# 查看 Python 路径
python -c "import sys; print(sys.executable)"

同时配置多个客户端

ida-script-mcp-install install claude,cursor,vscode,windsurf

故障排除

在 IDA 中找不到插件

  • 确认插件文件在 IDA 的 plugins 目录中

  • 检查 IDA 输出窗口的错误信息

  • 重新运行 ida-script-mcp-install install

连接被拒绝

  • 确保 IDA Pro 正在运行且已加载数据库

  • 确认插件已启动(Edit → Plugins → IDA-Script-MCP)

  • 检查 ~/.ida_script_mcp_instances.json 中的端口是否正确

多实例路由到错误的 IDA

  • 这是 Windows 上的已知问题,已在 v1.1.0 中修复 — 请确保使用最新版本

  • 每个 IDA 实例应获得唯一端口(13338、13339、13340……)

脚本超时 / 客户端断开

  • 长时间运行的脚本现在使用异步任务执行 — 服务器会轮询获取结果而非阻塞等待

  • 如果响应中包含 task_id,可使用 check_task_status 稍后查询结果

  • 可通过 timeout 参数调整等待时间(默认 600 秒):

    execute_idapython(code="slow_analysis()", timeout=1800)

找不到命令

pip show ida-script-mcp
which ida-script-mcp-install

安全提示

此插件允许在 IDA Pro 中执行任意 Python 代码:

  • 实例级令牌认证(v1.3.0 起):发往插件的每个请求都必须携带 X-MCP-Token 头;令牌在插件启动时生成并写入 ~/.ida_script_mcp_instances.json,其他进程没有该文件读取权限就无法驱动 IDA

  • Host 头校验(v1.3.0 起):仅接受 127.0.0.1 / localhost / [::1];不再输出任何 CORS 头

  • 仅与可信的 AI 助手一起使用

  • 插件默认绑定到 127.0.0.1(仅本地访问)

  • 切勿将 HTTP 端口暴露到公网

许可证

MIT License

更新日志

[1.3.0] - 2026-09-28

安全:

  • 实例级令牌认证:发往插件的每个请求现在都要求 X-MCP-Token 头。令牌在服务器启动时生成、写入 ~/.ida_script_mcp_instances.json,且绝不打印到 IDA 控制台。这防止了不受信任的本地进程(例如正在分析的恶意样本)通过 POST /execute 驱动 IDA。

  • Host 头校验:非回环地址的 Host 值将被拒绝(防 DNS 重绑定)。

  • 移除 CORS:不再输出任何 Access-Control-Allow-Origin 头。

  • 注册文件加固:~/.ida_script_mcp_instances.json 采用跨进程文件锁 + 原子写入(多个 IDA 实例并发启动不再互相覆盖注册信息);文件权限收紧为 0600(支持的系统上)。

  • 移除危险的 Windows os.kill(pid, 0) 存活探测(该写法在 Windows 上会直接终止被探测的进程)。

新增:

  • cancel_ida_task 工具 + POST /task/{id}/cancel 端点;脚本命名空间注入 mcp_cancelled() 以支持长循环的协作式取消。

  • 任务队列上限,队列满时返回明确错误而非无限增长。

  • --ida-token 参数 / IDA_SCRIPT_MCP_TOKEN 环境变量(无头场景固定令牌);安装器支持 IDAUSER 自定义用户目录。

修复:

  • 任务完成时 result/status 赋值竞态(轮询方可能看到 completed 却没有结果载荷)。

  • execute_sync 调度失败不再无限阻塞,改为返回明确错误。

  • check_ida_connection / get_ida_database_info 不再阻塞 MCP 事件循环(所有 HTTP 调用改在工作线程中执行)。

  • /health、/metadata 不再从 HTTP 工作线程调用 idaapi(改为提供插件启动时在主线程捕获的快照)。

  • 模糊的 instance_id 子串匹配改为报错,不再随机路由;timeout 参数校验(1–86400 秒)。

  • --transport http 现在真正提供 streamable-http(旧版 mcp 自动回退 SSE),而不是默默跑 SSE。

  • 纯语句脚本返回局部 result 变量(不再是不可靠的"最后一个赋值变量");None 结果序列化为 JSON null。

  • 文档:删除不存在的 int_convert 工具引用;修正 v1.0.1/v1.1.0 版本号不一致。

升级提示:请重启 IDA(或重新切换插件),使新版插件与新版 MCP 服务器配套。过渡期互不影响:旧版插件实例仍接受无令牌请求。

[1.2.0] - 2026-05-08

新增:

  • 异步任务执行系统:长时间运行的脚本不再导致客户端断开连接。脚本异步提交到 IDA,MCP 服务器以指数退避策略(0.5s → 5s 上限)轮询完成状态。如果超过可配置的超时时间(默认 600 秒),会返回 task_id 供后续查询。

  • check_task_status 工具:新增 MCP 工具,通过 task_id 查询长时间运行的脚本执行任务的状态和结果。

  • execute_idapython 的 timeout 参数:可配置最大等待时间(默认 600 秒),超时后返回 task_id 以便延迟轮询。

  • IDA 插件任务管理端点:GET /task/{id} 查询任务状态/结果,GET /tasks 列出所有任务。

  • POST /execute 的 async 模式:IDA 插件现在接受 {"async": true} 以提交脚本进行后台执行,并立即返回 task_id。

  • ThreadingMixIn HTTP 服务器:IDA 插件 HTTP 服务器现在在独立线程中处理每个请求,防止单个长时间运行的脚本阻塞其他请求(如健康检查、任务状态查询)。

修复:

  • 长时间运行脚本导致客户端断开:此前,运行超过 60 秒的脚本会导致 MCP 服务器到 IDA 的 HTTP 连接超时,而脚本在 IDA 中继续运行但无法获取结果。新的异步任务系统解决了此问题。

  • HTTP 服务器阻塞:IDA 插件的单线程 HTTP 服务器可被运行中的脚本阻塞,导致所有其他端点(health、metadata)不可达。改用 ThreadingMixIn 实现并发请求处理。

[1.1.0] - 2026-04-16

修复:

  • Windows 多实例端口冲突:在 Windows 上,所有 IDA 实例会绑定到同一端口 (13338),因为 SO_REUSEADDR 允许多个进程无错误地绑定同一端口。通过在 Windows 上禁用 allow_reuse_address 并添加绑定前端口检测来修复。

[1.0.0] - 2024-01-15

新增:

  • 初始发布,包含 list_ida_instances、execute_idapython、check_ida_connection、get_ida_database_info 工具。

  • 多实例支持、自动发现、完整 IDA API 访问、Jupyter 风格求值、跨平台支持。

Available Tools

6 tools
cancel_ida_taskA
DestructiveIdempotent

Request cancellation of a script execution task.

Cancellation is cooperative:

  • Pending tasks (not yet started in IDA) are cancelled immediately.

  • Running tasks set a flag that is visible to the script through the injected mcp_cancelled() helper; a script in a tight loop that never polls it cannot be interrupted, so long scripts should check it.

Args: task_id: The task ID returned by execute_idapython instance_id: Target IDA instance ID (optional, uses default if not specified) port: Target IDA instance port (optional, uses default if not specified)

Returns: str: JSON-formatted cancellation result.

ParametersJSON Schema
NameRequiredDescriptionDefault
portNo
task_idYes
instance_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (destructiveHint=true, idempotentHint=true) by disclosing that cancellation is cooperative, that pending tasks cancel immediately while running tasks only set a flag, and that tight-loop scripts polling may never observe it. This directly reframes what the destructive hint means in practice and warns the caller of a real failure mode.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first line, and the bulleted cooperative-cancellation semantics are tight and each convey a distinct, load-bearing fact. No padding or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, yet the description still notes a JSON result string. The non-obvious cooperative semantics and the mcp_cancelled() polling contract are exactly the context an agent needs to call this correctly and warn users about uninterruptible scripts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it does: task_id is identified as the value returned by execute_idapython, and instance_id/port are described as optional overrides of a default target. It stops short of giving formats or clarifying precedence when both instance_id and port are supplied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Request cancellation of a script execution task') and immediately names the sibling that produces the task_id (execute_idapython), so the agent can place it in the workflow without opening the schema. It is clearly distinct from check_task_status and execute_idapython.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the description ties task_id back to execute_idapython, which signals when you would call this. However, it never explicitly contrasts with check_task_status or states whether cancellation can be requested for already-completed tasks, so the when/when-not guidance is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_ida_connectionB
Read-onlyIdempotent

Check if IDA Pro instances are running and accessible.

Returns: str: JSON-formatted string with connection status and all instances.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety and side-effect profile is fully covered. The description adds only that the result is a JSON string containing connection status and instance data, which is modest additional context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences with no padding, and the core purpose leads. The 'Returns: str: JSON-formatted string' block is mildly redundant given an output schema exists, but it costs little.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and annotations cover safety, so the description is nearly sufficient for a zero-parameter probe. What it omits is the relationship to list_ida_instances, which is the one thing an agent actually needs to route between these two overlapping tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4; there is nothing for the description to disambiguate. The input schema is empty and consistent with the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: checking whether IDA Pro instances are running and accessible. However, it does not differentiate from the sibling list_ida_instances, and the phrase 'connection status and all instances' actively overlaps with that sibling's apparent job, leaving an agent unsure which tool answers the 'what instances exist' question.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no mention of the sibling list_ida_instances despite the clear functional overlap in the return payload. An agent must infer that this is a connectivity preflight before calling execute_idapython or get_ida_database_info.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_task_statusA
Read-onlyIdempotent

Check the status of a long-running script execution task.

Use this tool when execute_idapython returns a task_id with status 'running' or 'pending', indicating the script is still executing in IDA Pro and the timeout was exceeded.

Args: task_id: The task ID returned by execute_idapython instance_id: Target IDA instance ID (optional, uses default if not specified) port: Target IDA instance port (optional, uses default if not specified)

Returns: str: JSON-formatted task status with result if completed.

ParametersJSON Schema
NameRequiredDescriptionDefault
portNo
task_idYes
instance_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is covered. The description adds genuinely useful context beyond that — the task runs in IDA Pro, the status reflects a timeout-exceeded execution, and a completed task carries its result — though it gives no polling cadence or expiry guidance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and usage are front-loaded in the first two sentences, with Args/Returns sections following in a scannable layout. The Returns line slightly restates what the output schema already provides, which is the only wasted content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only polling tool with three params, the description covers the trigger condition, every parameter's origin and optionality, and the completion semantics. Return shape details are already handled by the existing output schema, so nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the parameter burden, and it does: task_id is identified as the value returned by execute_idapython, and instance_id/port are explained as optional target selectors that fall back to defaults. It stops short of describing what a non-default instance_id or port implies for routing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Check the status of a long-running script execution task') and immediately names the sibling that produces the input (execute_idapython), so an agent can distinguish it from cancel_ida_task or check_ida_connection without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the triggering condition: use when execute_idapython returns a task_id with status 'running' or 'pending' because the timeout was exceeded. This is a precise when-to-use rule tied to a named sibling rather than an inferred one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_idapythonA
Destructive

Execute Python code or script file in IDA Pro context.

This tool sends Python code to the IDA Pro plugin for execution. The code runs in IDA's main thread with full access to all IDA API modules.

For long-running scripts, the tool polls for completion up to timeout seconds. If the timeout is exceeded, a task_id is returned so you can check status later using the check_task_status tool. Long scripts should poll the injected mcp_cancelled() helper so they can be stopped cooperatively via the cancel_ida_task tool.

Avoid calling ida_kernwin.ask_* and other interactive dialogs in scripts: they block IDA's main thread until answered and freeze the whole task queue.

Args: params (ExecuteScriptInput): Validated input parameters containing: - code (Optional[str]): Python code string to execute - script_path (Optional[str]): Path to Python script file - capture_output (bool): Whether to capture stdout/stderr - instance_id (Optional[str]): Target IDA instance ID (e.g., "crackme.exe" or full ID) - port (Optional[int]): Target IDA instance port (e.g., 13338) - timeout (int): Maximum wait time in seconds (default: 600)

Returns: str: JSON-formatted string containing: - result: The value of the last expression (or a local result variable), as a string or null - stdout: Captured standard output - stderr: Captured standard output (including errors) - instance: The IDA instance that executed the code - task_id: Present if script is still running or timed out

Examples: # Execute on default instance execute_idapython(code="print(idaapi.get_root_filename())")

# Execute on specific instance by database name
execute_idapython(code="len(list(idautils.Functions()))", instance_id="crackme.exe")

# Execute on specific instance by port
execute_idapython(code="idc.get_func_name(0x401000)", port=13339)
ParametersJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare destructive/not-idempotent/not-read-only; the description goes far beyond, disclosing that code runs in IDA's main thread with full API access, that blocking dialogs freeze the entire task queue, and how timeout/cancellation behave. These are exactly the behavioral traits an agent needs before firing arbitrary code into a host process.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action and caveats before the Args/Returns/Examples blocks, and the examples are genuinely illustrative (default instance, by name, by port). It is on the long side and the Args/Returns text restates schema-level detail, but no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a dangerous arbitrary-code tool with a nested params object, the description covers execution context, threading implications, timeout/task_id lifecycle, cancellation helper, output shape (result/stdout/stderr/instance/task_id), and worked examples. Nothing an agent needs in order to invoke it safely is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The Args section enumerates all six fields (code, script_path, capture_output, instance_id, port, timeout) with their roles, and gives concrete example call forms for instance_id and port. Much of this overlaps the schema's own descriptions, so it adds examples rather than new semantics, but it does compensate for the reported low schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Execute Python code or script file in IDA Pro context') and immediately distinguishes itself from siblings by naming check_task_status and cancel_ida_task as its follow-up companions. An agent can tell what this tool does and roughly where it sits in the workflow without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear operational context: long-running scripts poll up to `timeout`, timeouts yield a task_id to be resolved via check_task_status, and long scripts should poll `mcp_cancelled()` for cooperative cancellation via cancel_ida_task. It also warns against interactive dialogs. What's missing is an explicit statement of when this tool is preferable to any alternative (none exists among siblings), so it stops just short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ida_database_infoB
Read-onlyIdempotent

Get information about an IDA database.

Args: instance_id: Target IDA instance ID (optional, uses default if not specified).

Returns: str: JSON-formatted string with database information.

ParametersJSON Schema
NameRequiredDescriptionDefault
instance_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered. The description only adds that the result is a JSON-formatted string of database information, which is modest added context beyond the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-line purpose followed by compact Args/Returns blocks with no filler. The Args/Returns scaffolding is boilerplate but harmless and short.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the return shape need not be spelled out, and the single optional parameter is explained. What remains missing is any hint of what 'database information' contains or how it relates to sibling lookup tools, leaving the agent to infer the tool's niche.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the schema itself says nothing about instance_id beyond its type. The description compensates by explaining it is optional and that a default instance is used when omitted, which is the key semantic an agent needs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a verb and resource ('Get information about an IDA database'), which is enough to know the general intent. However, 'information' is vague and the description does nothing to distinguish this from siblings like list_ida_instances or check_ida_connection, so the agent must guess which metadata call to make.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only usage note is that instance_id is optional and falls back to a default. There is no guidance on when to call this versus list_ida_instances or check_ida_connection, and no prerequisites or exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_ida_instancesA
Read-onlyIdempotent

List all running IDA instances with MCP plugin enabled.

Returns: str: JSON-formatted list of IDA instances with their ports and database info.

Example response: { "count": 2, "instances": { "12345_crackme.exe": {"port": 13338, "database": "crackme.exe"}, "67890_malware.dll": {"port": 13339, "database": "malware.dll"} } }

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds contextual details by specifying that it returns a JSON list with ports and database info, including an example response. This goes beyond the annotations by clarifying the output structure and the MCP-plugin filter, but it does not discuss auth or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose in the first sentence, then provides a compact return description and example. The example is useful though slightly verbose; overall it is well-structured and earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the empty input schema, rich annotations, and an output schema, the description is nearly complete. It states the scope, return format, and an example. The main gap is the lack of when-to-use guidance against sibling tools, but for a simple lister this is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the baseline score is 4 per the rubric. The schema and description need not document parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list), resource (running IDA instances), and filter (with MCP plugin enabled). It clearly distinguishes a discovery operation from sibling tools like check_ida_connection or get_ida_database_info, which act on a single instance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides no explicit when-to-use or when-not-to-use guidance. It does not say when to prefer this over check_ida_connection or that it should be used before attempting to connect. The usage is only implied by the verb 'list'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv1.3.0
    • Addedcancel_ida_task
    • Changedexecute_idapython4 fields changed
      • changedInput schema / $defs / ExecuteScriptInput / properties / port / anyOf
        Previous value: -[
        -  {
        -    "type": "integer"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]New value: +[
        +  {
        +    "maximum": 65535,
        +    "minimum": 1,
        +    "type": "integer"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / $defs / ExecuteScriptInput / properties / timeout / description
        Previous value: -"Maximum time in seconds to wait for script execution to complete (default: 600). If the script takes longer, a task_id will be returned to check status later."New value: +"Maximum time in seconds to wait for script execution to complete (default: 600, max: 86400). If the script takes longer, a task_id will be returned to check status later."
      • addedInput schema / $defs / ExecuteScriptInput / properties / timeout / maximum
        Added value: +86400
      • addedInput schema / $defs / ExecuteScriptInput / properties / timeout / minimum
        Added value: +1
  2. 5 tool updatesv1.2.0
    • First observedcheck_ida_connection
    • First observedcheck_task_status
    • First observedexecute_idapython
    • First observedget_ida_database_info
    • First observedlist_ida_instances

TDQS

A3.9/5.0

Scored across 6 tools

Disambiguation4/5

Most tools target distinct operations: list instances, execute scripts, get database info, check task status, and cancel tasks. However, list_ida_instances and check_ida_connection both concern instance availability, which could cause slight confusion in some contexts. The descriptions help distinguish them, so the overlap is minor.

Naming Consistency5/5

All tool names use consistent snake_case with a verb-first pattern (list_, execute_, check_, get_, cancel_). The convention is predictable throughout, making the tool set easy to navigate.

Tool Count5/5

Six tools is a well-scoped set for remote IDA Pro control, covering instance listing, script execution, connection checks, database info, task status, and cancellation. Each tool earns its place without redundancy or bloat.

Completeness4/5

The surface covers the core lifecycle: discover instances, execute scripts, check connectivity, inspect database info, and manage long-running tasks via status and cancellation. A minor gap is the absence of a dedicated tool to list all active tasks, but task IDs are returned by execute_idapython and can be tracked individually.

Maintenance

ActivityMaintained
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables LLM clients like Claude to interact with IDA Pro for binary analysis, decompilation, cross-references, patching, and more via 41 MCP tools, 8 resources, and 7 guided prompts.
    52
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Connects AI agents to IDA Pro and x64dbg for unified static and dynamic reverse engineering, enabling coordinated analysis, debugging, and patch planning through a local MCP daemon.
    15
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI tools to execute IDA Python code inside IDA Pro for reverse engineering tasks via MCP over SSE.
    3
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables LLMs to perform binary analysis and reverse engineering via IDA Pro's headless idalib, providing 66 MCP tools like decompile, disasm, and xrefs without requiring the IDA GUI.
    3
    -