IDA Script MCP
IDA Script MCP enables MCP-compatible AI assistants to execute IDAPython scripts in IDA Pro and manage multiple IDA instances.
List all running IDA instances with ports and database info.
Execute Python code or script files in IDA Pro with full IDA API access (including Hex-Rays).
Target specific instances by instance_id or port for concurrent multi-binary analysis.
Handle long-running scripts asynchronously: returns task_id, check status with
check_task_status, cancel withcancel_ida_task.Check IDA connection/health and get database info (name, path, platform).
Capture stdout/stderr and return last expression or local
resultvariable (Jupyter-style).Perform analysis tasks: list functions, decompile, find xrefs, rename, list strings, etc.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@IDA Script MCPDecompile the main function"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
IDA Script MCP
English Version
Execute IDAPython scripts in IDA Pro through any MCP-compatible AI assistant.
Why IDA Script MCP?
IDA Script MCP | |
Latency | < 1ms per request (local HTTP, no IPC overhead) |
Footprint | Zero external dependencies inside IDA — stdlib-only plugin |
Startup | Plugin ready instantly, no background process in IDA |
Concurrency | Run N IDA instances, each on its own port, zero conflict |
API Coverage | Full access to 40+ IDA modules including Hex-Rays decompiler |
The IDA-side plugin uses only Python stdlib (http.server, socket, json) — no pip packages needed inside IDA Pro. The MCP server (separate process) uses FastMCP for the protocol layer and communicates with IDA via plain HTTP on localhost. This means:
No slow startup inside IDA
No dependency conflicts with IDA's bundled Python
No memory overhead from heavy frameworks loaded into IDA
Each IDA instance is completely independent — one crash doesn't affect others
Features
AI-Powered Analysis — Let any MCP-compatible AI assistant analyze binaries directly in IDA Pro
Multi-Instance Support — Analyze multiple binaries simultaneously across different IDA instances with automatic port assignment
Async Task Execution — Long-running scripts won't disconnect the client; poll for results with configurable timeout
One-Command Setup — Install IDA plugin + configure your AI client in a single step
Full IDA API Access — Complete access to all IDA modules (idaapi, idc, idautils, ida_hexrays, etc.)
Jupyter-style Evaluation — Last expression is automatically returned as the result value
Output Capture — Capture stdout/stderr and return values from executed code
Universal Client Support — Works with any MCP-compatible AI client (see Supported Clients)
Requirements
IDA Pro 8.3+ (IDA Free does not support plugins)
Python 3.11+
Windows / macOS / Linux
Installation
Option 1: pip (Recommended)
pip install ida-script-mcp
ida-script-mcp-install install claudeOption 2: uv
uv pip install ida-script-mcp
ida-script-mcp-install install claudeOption 3: pipx (isolated environment)
pipx install ida-script-mcp
ida-script-mcp-install install claudeOption 4: From Source
git clone https://github.com/SuZiXunYue/ida-script-mcp.git
cd ida-script-mcp
pip install -e .
ida-script-mcp-install installAdvanced Options
# Install plugin only (no client configuration)
ida-script-mcp-install install
# Configure multiple MCP clients at once
ida-script-mcp-install install claude,cursor,cline
# Use project-level configuration (per-repo settings)
ida-script-mcp-install install --project claude
# List all available MCP clients
ida-script-mcp-install --list-clients
# Print raw MCP config JSON (for manual configuration)
ida-script-mcp-install --config
# Uninstall everything
ida-script-mcp-install uninstall claudeUsage
1. Start IDA Plugin
Open IDA Pro and load a binary file
Go to Edit → Plugins → IDA-Script-MCP (or press
Ctrl+Alt+S)Plugin will start and show:
[IDA-Script-MCP] Server started at http://127.0.0.1:13338 [IDA-Script-MCP] Instance ID: 12345_crackme.exe [IDA-Script-MCP] Database: crackme.exe
2. Use with AI Assistant
The MCP server provides these tools to your AI assistant:
Tool | Description |
| List all running IDA instances with ports and database info |
| Execute Python code in IDA Pro (supports |
| Check connection status and health of all IDA instances |
| Get database name, path, and platform info |
| Check the status of a long-running script execution task |
| Cancel a pending task, or flag a running task for cooperative cancellation |
Long-Running Scripts
By default, execute_idapython waits up to 600 seconds for a script to complete, polling the IDA plugin for progress. If the script takes longer, a task_id is returned:
{
"task_id": "a1b2c3d4",
"status": "running",
"message": "Script execution timed out after 600s. Use check_task_status with task_id 'a1b2c3d4' to check result later."
}You can then use check_task_status to query the result once the script finishes:
check_task_status(task_id="a1b2c3d4")You can also customize the timeout:
execute_idapython(code="long_analysis()", timeout=1800)Long scripts can poll the injected mcp_cancelled() helper so they can be stopped
cooperatively via the cancel_ida_task tool. Pending tasks are cancelled immediately;
running tasks observe the flag the next time the script calls mcp_cancelled(). A loop
that never polls cannot be interrupted — always include the check in long loops.
3. Example Commands for AI
Ask your AI assistant to:
"List all functions in this binary"
"Decompile the main function"
"Find all xrefs to address 0x401000"
"Rename function at 0x401000 to my_function"
"Show all strings in the binary"
Supported MCP Clients
This plugin supports all MCP-compatible clients. The installer provides automatic configuration for the following popular clients:
Client | Install Command | Config File |
Claude Desktop |
|
|
Claude Code |
|
|
Cursor |
|
|
VS Code |
|
|
Windsurf |
|
|
Additional Popular MCP Clients (Manual Configuration)
The following clients are not auto-configured by the installer yet, but work perfectly with IDA Script MCP. Add the config snippet below to the client's MCP settings file:
Client | Config Location |
Cline (VS Code extension) | VS Code |
Roo Code (VS Code extension) |
|
Trae | Trae MCP settings |
Augment | Augment MCP settings |
Continue |
|
Copilot (MCP mode) | VS Code |
Amazon Q Developer | Q Developer MCP settings |
Aider |
|
Any MCP-compatible client | Client's MCP config file |
Manual config snippet (add to your client's MCP servers section):
{
"mcpServers": {
"ida-script-mcp": {
"command": "python",
"args": ["-m", "ida_script_mcp.server"]
}
}
}If you're using a virtual environment, replace "python" with the full path:
# Find your Python path
python -c "import sys; print(sys.executable)"Configure Multiple Clients at Once
ida-script-mcp-install install claude,cursor,vscode,windsurfTroubleshooting
Plugin not found in IDA
Ensure plugin file is in IDA's plugins directory
Check IDA output window for errors
Re-run
ida-script-mcp-install install
Connection refused
Verify IDA Pro is running with a database loaded
Confirm plugin is started (Edit → Plugins → IDA-Script-MCP)
Check that the port matches in
~/.ida_script_mcp_instances.json
Multiple instances route to wrong IDA
This was a Windows-specific bug fixed in v1.1.0 — ensure you're on the latest version
Each IDA instance should get a unique port (13338, 13339, 13340, ...)
Script times out / client disconnects
Long-running scripts now use async task execution — the server polls for results instead of blocking
If you see a
task_idin the response, usecheck_task_statusto query the result laterAdjust the
timeoutparameter (default: 600s) if your script needs more time:execute_idapython(code="slow_analysis()", timeout=1800)
Command not found
pip show ida-script-mcp
which ida-script-mcp-installSecurity Note
This plugin allows arbitrary Python code execution in IDA Pro:
Per-instance token authentication (since v1.3.0): every request to the plugin must carry the
X-MCP-Tokenheader; the token is generated at plugin start and stored in~/.ida_script_mcp_instances.json, so other processes cannot drive IDA without read access to that fileHost header validation (since v1.3.0): only
127.0.0.1/localhost/[::1]hosts are accepted; no CORS headers are emittedUse only with trusted AI assistants
Plugin binds to
127.0.0.1by default (localhost only)Never expose the HTTP port to public networks
License
MIT License
Changelog
[1.3.0] - 2026-09-28
Security:
Per-instance token authentication: every plugin request now requires the
X-MCP-Tokenheader. The token is generated at server start, stored in~/.ida_script_mcp_instances.json, and never printed to the IDA console. This prevents untrusted local processes (e.g. a malware sample under analysis) from driving IDA viaPOST /execute.Host header validation: non-loopback
Hostvalues are rejected with 403 (DNS-rebinding hardening).CORS removed: no
Access-Control-Allow-Originheaders are emitted anymore.Registry hardening: cross-process file locking and atomic writes for
~/.ida_script_mcp_instances.json(concurrent IDA instances can no longer clobber each other's registrations); file permissions restricted to 0600 where supported.Removed the dangerous Windows
os.kill(pid, 0)liveness probe (which would terminate the probed process on Windows).
Added:
cancel_ida_tasktool +POST /task/{id}/cancelendpoint; scripts get an injectedmcp_cancelled()helper for cooperative cancellation of long loops.Task queue cap with honest "queue full" feedback instead of unbounded growth.
--ida-tokenflag /IDA_SCRIPT_MCP_TOKENenv for pinning tokens in headless setups;IDAUSERsupport in the installer.
Fixed:
Result/status race on task completion (a poller could see
completedwith no result payload).execute_syncscheduling failures no longer block forever — a clear error is raised.check_ida_connection/get_ida_database_infono longer block the MCP event loop (all HTTP calls now run in a worker thread)./healthand/metadatano longer callidaapifrom HTTP worker threads (they serve a snapshot captured on the main thread at plugin start).Ambiguous
instance_idsubstring matches now error out instead of routing to a random instance;timeoutis validated (1–86400 s).--transport httpnow serves streamable-http (SSE fallback) instead of silently running SSE.Statements-only scripts return a local
resultvariable instead of an arbitrary last-assigned variable;Noneresults serialize as JSONnull.Docs: removed references to the nonexistent
int_converttool; fixed the v1.0.1/v1.1.0 version-number inconsistency.
Upgrade note: restart IDA (or re-toggle the plugin) so the new plugin authenticates with the new MCP server. Mixed setups keep working: legacy plugin instances still accept tokenless requests.
[1.2.0] - 2026-05-08
Added:
Async task execution system: Long-running scripts no longer cause client disconnection. Scripts are submitted asynchronously to IDA, and the MCP server polls for completion with exponential backoff (0.5s → 5s cap). If the configurable timeout (default: 600s) is exceeded, a
task_idis returned for later status queries.check_task_statustool: New MCP tool to query the status and result of a long-running script execution task by itstask_id.timeoutparameter forexecute_idapython: Configurable maximum wait time (default: 600 seconds) before returning atask_idfor deferred polling.Task management endpoints in IDA plugin:
GET /task/{id}to query task status/result,GET /tasksto list all tasks.asyncmode forPOST /execute: IDA plugin now accepts{"async": true}to submit scripts for background execution and immediately return atask_id.ThreadingMixIn HTTP server: The IDA plugin HTTP server now handles each request in a separate thread, preventing a single long-running script from blocking other requests (e.g., health checks, task status queries).
Fixed:
Client disconnection on long-running scripts: Previously, scripts running longer than 60 seconds would cause the MCP server's HTTP connection to IDA to time out, while the script continued running in IDA with no way to retrieve the result. The new async task system eliminates this issue.
HTTP server blocking: The IDA plugin's single-threaded HTTP server could be blocked by a running script, making all other endpoints (health, metadata) unreachable. Switched to
ThreadingMixInfor concurrent request handling.
[1.1.0] - 2026-04-16
Fixed:
Windows multi-instance port collision: On Windows, all IDA instances would bind to the same port (13338) because
SO_REUSEADDRallows multiple processes to bind the same port without error. Fixed by disablingallow_reuse_addresson Windows and adding pre-bind port detection.
[1.0.0] - 2024-01-15
Added:
Initial release with
list_ida_instances,execute_idapython,check_ida_connection,get_ida_database_infotools.Multi-instance support, auto-discovery, full IDA API access, Jupyter-style evaluation, cross-platform support.
Related MCP server: IX64MCP
中文版本
通过任何支持 MCP 协议的 AI 助手,在 IDA Pro 中执行 IDAPython 脚本。
为什么选择 IDA Script MCP?
IDA Script MCP | |
延迟 | 每次请求 < 1ms(本地 HTTP,无 IPC 开销) |
资源占用 | IDA 内零外部依赖 — 插件仅使用标准库 |
启动速度 | 插件即时就绪,IDA 内无后台进程 |
并发能力 | 运行 N 个 IDA 实例,各自独立端口,互不冲突 |
API 覆盖 | 完整访问 40+ IDA 模块,包括 Hex-Rays 反编译器 |
IDA 端插件仅使用 Python 标准库(http.server、socket、json)——无需在 IDA Pro 中安装任何 pip 包。MCP 服务器(独立进程)使用 FastMCP 作为协议层,通过本地 HTTP 与 IDA 通信。这意味着:
IDA 内无缓慢启动
不与 IDA 内置 Python 产生依赖冲突
不因加载重框架而占用 IDA 内存
每个 IDA 实例完全独立 — 一个崩溃不影响其他
特性
AI 驱动分析 — 让任何支持 MCP 的 AI 助手直接在 IDA Pro 中分析二进制文件
多实例支持 — 同时分析多个二进制文件,自动分配端口,实例间互不干扰
异步任务执行 — 长时间运行的脚本不会导致客户端断开连接;可配置超时,轮询获取结果
一键安装 — 一条命令完成 IDA 插件安装和 AI 客户端配置
完整 IDA API 访问 — 完全访问所有 IDA 模块(idaapi、idc、idautils、ida_hexrays 等)
Jupyter 风格求值 — 自动返回最后一个表达式的值
输出捕获 — 捕获执行代码的标准输出/错误和返回值
通用客户端支持 — 兼容所有支持 MCP 协议的客户端(见支持客户端)
系统要求
IDA Pro 8.3+(IDA Free 不支持插件)
Python 3.11+
Windows / macOS / Linux
安装
方式一:pip(推荐)
pip install ida-script-mcp
ida-script-mcp-install install claude方式二:uv
uv pip install ida-script-mcp
ida-script-mcp-install install claude方式三:pipx(隔离环境)
pipx install ida-script-mcp
ida-script-mcp-install install claude方式四:从源码安装
git clone https://github.com/SuZiXunYue/ida-script-mcp.git
cd ida-script-mcp
pip install -e .
ida-script-mcp-install install高级选项
# 仅安装插件(不配置客户端)
ida-script-mcp-install install
# 同时配置多个 MCP 客户端
ida-script-mcp-install install claude,cursor,cline
# 使用项目级配置(每个仓库独立设置)
ida-script-mcp-install install --project claude
# 列出所有可用的 MCP 客户端
ida-script-mcp-install --list-clients
# 打印 MCP 配置 JSON(用于手动配置)
ida-script-mcp-install --config
# 卸载
ida-script-mcp-install uninstall claude使用方法
1. 启动 IDA 插件
打开 IDA Pro 并加载二进制文件
进入 Edit → Plugins → IDA-Script-MCP(或按
Ctrl+Alt+S)插件启动后会显示:
[IDA-Script-MCP] Server started at http://127.0.0.1:13338 [IDA-Script-MCP] Instance ID: 12345_crackme.exe [IDA-Script-MCP] Database: crackme.exe
2. 使用 AI 助手
MCP 服务器为 AI 助手提供以下工具:
工具 | 说明 |
| 列出所有运行中的 IDA 实例及其端口和数据库信息 |
| 在 IDA Pro 中执行 Python 代码(支持 |
| 检查所有 IDA 实例的连接状态和健康信息 |
| 获取数据库名称、路径和平台信息 |
| 查询长时间运行的脚本执行任务的状态 |
| 取消尚未开始的任务,或为运行中的任务设置协作式取消标志 |
长时间运行的脚本
默认情况下,execute_idapython 最多等待 600 秒让脚本完成,期间会轮询 IDA 插件获取进度。如果脚本执行时间超过该限制,会返回一个 task_id:
{
"task_id": "a1b2c3d4",
"status": "running",
"message": "Script execution timed out after 600s. Use check_task_status with task_id 'a1b2c3d4' to check result later."
}脚本完成后,可使用 check_task_status 查询结果:
check_task_status(task_id="a1b2c3d4")也可以自定义超时时间:
execute_idapython(code="long_analysis()", timeout=1800)长脚本应轮询注入的 mcp_cancelled() 辅助函数,以支持通过 cancel_ida_task 工具进行协作式取消。
尚未开始的任务会被立即取消;运行中的任务在脚本下一次调用 mcp_cancelled() 时观察到取消标志。
从不轮询的死循环无法被中断——长循环中务必加入该检查。
3. 示例命令
让 AI 助手执行:
"列出此二进制文件中的所有函数"
"反编译 main 函数"
"查找地址 0x401000 的所有交叉引用"
"将地址 0x401000 的函数重命名为 my_function"
"显示二进制文件中的所有字符串"
支持的 MCP 客户端
本插件支持所有兼容 MCP 协议的客户端。 安装器为以下常用客户端提供自动配置:
客户端 | 安装命令 | 配置文件 |
Claude Desktop |
|
|
Claude Code |
|
|
Cursor |
|
|
VS Code |
|
|
Windsurf |
|
|
更多常用 MCP 客户端(手动配置)
以下客户端暂未纳入安装器自动配置,但完全兼容 IDA Script MCP。将下方配置片段添加到客户端的 MCP 设置中即可:
客户端 | 配置位置 |
Cline(VS Code 扩展) | VS Code |
Roo Code(VS Code 扩展) |
|
Trae | Trae MCP 设置 |
Augment | Augment MCP 设置 |
Continue |
|
Copilot(MCP 模式) | VS Code |
Amazon Q Developer | Q Developer MCP 设置 |
Aider |
|
任何支持 MCP 的客户端 | 客户端 MCP 配置文件 |
手动配置片段(添加到客户端的 MCP 服务器配置中):
{
"mcpServers": {
"ida-script-mcp": {
"command": "python",
"args": ["-m", "ida_script_mcp.server"]
}
}
}如果使用虚拟环境,将 "python" 替换为完整路径:
# 查看 Python 路径
python -c "import sys; print(sys.executable)"同时配置多个客户端
ida-script-mcp-install install claude,cursor,vscode,windsurf故障排除
在 IDA 中找不到插件
确认插件文件在 IDA 的 plugins 目录中
检查 IDA 输出窗口的错误信息
重新运行
ida-script-mcp-install install
连接被拒绝
确保 IDA Pro 正在运行且已加载数据库
确认插件已启动(Edit → Plugins → IDA-Script-MCP)
检查
~/.ida_script_mcp_instances.json中的端口是否正确
多实例路由到错误的 IDA
这是 Windows 上的已知问题,已在 v1.1.0 中修复 — 请确保使用最新版本
每个 IDA 实例应获得唯一端口(13338、13339、13340……)
脚本超时 / 客户端断开
长时间运行的脚本现在使用异步任务执行 — 服务器会轮询获取结果而非阻塞等待
如果响应中包含
task_id,可使用check_task_status稍后查询结果可通过
timeout参数调整等待时间(默认 600 秒):execute_idapython(code="slow_analysis()", timeout=1800)
找不到命令
pip show ida-script-mcp
which ida-script-mcp-install安全提示
此插件允许在 IDA Pro 中执行任意 Python 代码:
实例级令牌认证(v1.3.0 起):发往插件的每个请求都必须携带
X-MCP-Token头;令牌在插件启动时生成并写入~/.ida_script_mcp_instances.json,其他进程没有该文件读取权限就无法驱动 IDAHost 头校验(v1.3.0 起):仅接受
127.0.0.1/localhost/[::1];不再输出任何 CORS 头仅与可信的 AI 助手一起使用
插件默认绑定到
127.0.0.1(仅本地访问)切勿将 HTTP 端口暴露到公网
许可证
MIT License
更新日志
[1.3.0] - 2026-09-28
安全:
实例级令牌认证:发往插件的每个请求现在都要求
X-MCP-Token头。令牌在服务器启动时生成、写入~/.ida_script_mcp_instances.json,且绝不打印到 IDA 控制台。这防止了不受信任的本地进程(例如正在分析的恶意样本)通过POST /execute驱动 IDA。Host 头校验:非回环地址的
Host值将被拒绝(防 DNS 重绑定)。移除 CORS:不再输出任何
Access-Control-Allow-Origin头。注册文件加固:
~/.ida_script_mcp_instances.json采用跨进程文件锁 + 原子写入(多个 IDA 实例并发启动不再互相覆盖注册信息);文件权限收紧为 0600(支持的系统上)。移除危险的 Windows
os.kill(pid, 0)存活探测(该写法在 Windows 上会直接终止被探测的进程)。
新增:
cancel_ida_task工具 +POST /task/{id}/cancel端点;脚本命名空间注入mcp_cancelled()以支持长循环的协作式取消。任务队列上限,队列满时返回明确错误而非无限增长。
--ida-token参数 /IDA_SCRIPT_MCP_TOKEN环境变量(无头场景固定令牌);安装器支持IDAUSER自定义用户目录。
修复:
任务完成时 result/status 赋值竞态(轮询方可能看到
completed却没有结果载荷)。execute_sync调度失败不再无限阻塞,改为返回明确错误。check_ida_connection/get_ida_database_info不再阻塞 MCP 事件循环(所有 HTTP 调用改在工作线程中执行)。/health、/metadata不再从 HTTP 工作线程调用idaapi(改为提供插件启动时在主线程捕获的快照)。模糊的
instance_id子串匹配改为报错,不再随机路由;timeout参数校验(1–86400 秒)。--transport http现在真正提供 streamable-http(旧版 mcp 自动回退 SSE),而不是默默跑 SSE。纯语句脚本返回局部
result变量(不再是不可靠的"最后一个赋值变量");None结果序列化为 JSONnull。文档:删除不存在的
int_convert工具引用;修正 v1.0.1/v1.1.0 版本号不一致。
升级提示:请重启 IDA(或重新切换插件),使新版插件与新版 MCP 服务器配套。过渡期互不影响:旧版插件实例仍接受无令牌请求。
[1.2.0] - 2026-05-08
新增:
异步任务执行系统:长时间运行的脚本不再导致客户端断开连接。脚本异步提交到 IDA,MCP 服务器以指数退避策略(0.5s → 5s 上限)轮询完成状态。如果超过可配置的超时时间(默认 600 秒),会返回
task_id供后续查询。check_task_status工具:新增 MCP 工具,通过task_id查询长时间运行的脚本执行任务的状态和结果。execute_idapython的timeout参数:可配置最大等待时间(默认 600 秒),超时后返回task_id以便延迟轮询。IDA 插件任务管理端点:
GET /task/{id}查询任务状态/结果,GET /tasks列出所有任务。POST /execute的async模式:IDA 插件现在接受{"async": true}以提交脚本进行后台执行,并立即返回task_id。ThreadingMixIn HTTP 服务器:IDA 插件 HTTP 服务器现在在独立线程中处理每个请求,防止单个长时间运行的脚本阻塞其他请求(如健康检查、任务状态查询)。
修复:
长时间运行脚本导致客户端断开:此前,运行超过 60 秒的脚本会导致 MCP 服务器到 IDA 的 HTTP 连接超时,而脚本在 IDA 中继续运行但无法获取结果。新的异步任务系统解决了此问题。
HTTP 服务器阻塞:IDA 插件的单线程 HTTP 服务器可被运行中的脚本阻塞,导致所有其他端点(health、metadata)不可达。改用
ThreadingMixIn实现并发请求处理。
[1.1.0] - 2026-04-16
修复:
Windows 多实例端口冲突:在 Windows 上,所有 IDA 实例会绑定到同一端口 (13338),因为
SO_REUSEADDR允许多个进程无错误地绑定同一端口。通过在 Windows 上禁用allow_reuse_address并添加绑定前端口检测来修复。
[1.0.0] - 2024-01-15
新增:
初始发布,包含
list_ida_instances、execute_idapython、check_ida_connection、get_ida_database_info工具。多实例支持、自动发现、完整 IDA API 访问、Jupyter 风格求值、跨平台支持。
Available Tools
6 toolscancel_ida_taskADestructiveIdempotent
Request cancellation of a script execution task.
Cancellation is cooperative:
Pending tasks (not yet started in IDA) are cancelled immediately.
Running tasks set a flag that is visible to the script through the injected
mcp_cancelled()helper; a script in a tight loop that never polls it cannot be interrupted, so long scripts should check it.
Args: task_id: The task ID returned by execute_idapython instance_id: Target IDA instance ID (optional, uses default if not specified) port: Target IDA instance port (optional, uses default if not specified)
Returns: str: JSON-formatted cancellation result.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| task_id | Yes | ||
| instance_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (destructiveHint=true, idempotentHint=true) by disclosing that cancellation is cooperative, that pending tasks cancel immediately while running tasks only set a flag, and that tight-loop scripts polling may never observe it. This directly reframes what the destructive hint means in practice and warns the caller of a real failure mode.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first line, and the bulleted cooperative-cancellation semantics are tight and each convey a distinct, load-bearing fact. No padding or repetition of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, yet the description still notes a JSON result string. The non-obvious cooperative semantics and the mcp_cancelled() polling contract are exactly the context an agent needs to call this correctly and warn users about uninterruptible scripts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning, and it does: task_id is identified as the value returned by execute_idapython, and instance_id/port are described as optional overrides of a default target. It stops short of giving formats or clarifying precedence when both instance_id and port are supplied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Request cancellation of a script execution task') and immediately names the sibling that produces the task_id (execute_idapython), so the agent can place it in the workflow without opening the schema. It is clearly distinct from check_task_status and execute_idapython.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the description ties task_id back to execute_idapython, which signals when you would call this. However, it never explicitly contrasts with check_task_status or states whether cancellation can be requested for already-completed tasks, so the when/when-not guidance is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_ida_connectionBRead-onlyIdempotent
Check if IDA Pro instances are running and accessible.
Returns: str: JSON-formatted string with connection status and all instances.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety and side-effect profile is fully covered. The description adds only that the result is a JSON string containing connection status and instance data, which is modest additional context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, front-loaded sentences with no padding, and the core purpose leads. The 'Returns: str: JSON-formatted string' block is mildly redundant given an output schema exists, but it costs little.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and annotations cover safety, so the description is nearly sufficient for a zero-parameter probe. What it omits is the relationship to list_ida_instances, which is the one thing an agent actually needs to route between these two overlapping tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; there is nothing for the description to disambiguate. The input schema is empty and consistent with the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: checking whether IDA Pro instances are running and accessible. However, it does not differentiate from the sibling list_ida_instances, and the phrase 'connection status and all instances' actively overlaps with that sibling's apparent job, leaving an agent unsure which tool answers the 'what instances exist' question.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of the sibling list_ida_instances despite the clear functional overlap in the return payload. An agent must infer that this is a connectivity preflight before calling execute_idapython or get_ida_database_info.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_task_statusARead-onlyIdempotent
Check the status of a long-running script execution task.
Use this tool when execute_idapython returns a task_id with status 'running' or 'pending', indicating the script is still executing in IDA Pro and the timeout was exceeded.
Args: task_id: The task ID returned by execute_idapython instance_id: Target IDA instance ID (optional, uses default if not specified) port: Target IDA instance port (optional, uses default if not specified)
Returns: str: JSON-formatted task status with result if completed.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| task_id | Yes | ||
| instance_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is covered. The description adds genuinely useful context beyond that — the task runs in IDA Pro, the status reflects a timeout-exceeded execution, and a completed task carries its result — though it gives no polling cadence or expiry guidance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and usage are front-loaded in the first two sentences, with Args/Returns sections following in a scannable layout. The Returns line slightly restates what the output schema already provides, which is the only wasted content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only polling tool with three params, the description covers the trigger condition, every parameter's origin and optionality, and the completion semantics. Return shape details are already handled by the existing output schema, so nothing an agent needs to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the parameter burden, and it does: task_id is identified as the value returned by execute_idapython, and instance_id/port are explained as optional target selectors that fall back to defaults. It stops short of describing what a non-default instance_id or port implies for routing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Check the status of a long-running script execution task') and immediately names the sibling that produces the input (execute_idapython), so an agent can distinguish it from cancel_ida_task or check_ida_connection without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the triggering condition: use when execute_idapython returns a task_id with status 'running' or 'pending' because the timeout was exceeded. This is a precise when-to-use rule tied to a named sibling rather than an inferred one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_idapythonADestructive
Execute Python code or script file in IDA Pro context.
This tool sends Python code to the IDA Pro plugin for execution. The code runs in IDA's main thread with full access to all IDA API modules.
For long-running scripts, the tool polls for completion up to timeout
seconds. If the timeout is exceeded, a task_id is returned so you can check
status later using the check_task_status tool. Long scripts should poll the
injected mcp_cancelled() helper so they can be stopped cooperatively via
the cancel_ida_task tool.
Avoid calling ida_kernwin.ask_* and other interactive dialogs in scripts:
they block IDA's main thread until answered and freeze the whole task queue.
Args: params (ExecuteScriptInput): Validated input parameters containing: - code (Optional[str]): Python code string to execute - script_path (Optional[str]): Path to Python script file - capture_output (bool): Whether to capture stdout/stderr - instance_id (Optional[str]): Target IDA instance ID (e.g., "crackme.exe" or full ID) - port (Optional[int]): Target IDA instance port (e.g., 13338) - timeout (int): Maximum wait time in seconds (default: 600)
Returns:
str: JSON-formatted string containing:
- result: The value of the last expression (or a local result
variable), as a string or null
- stdout: Captured standard output
- stderr: Captured standard output (including errors)
- instance: The IDA instance that executed the code
- task_id: Present if script is still running or timed out
Examples: # Execute on default instance execute_idapython(code="print(idaapi.get_root_filename())")
# Execute on specific instance by database name
execute_idapython(code="len(list(idautils.Functions()))", instance_id="crackme.exe")
# Execute on specific instance by port
execute_idapython(code="idc.get_func_name(0x401000)", port=13339)
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare destructive/not-idempotent/not-read-only; the description goes far beyond, disclosing that code runs in IDA's main thread with full API access, that blocking dialogs freeze the entire task queue, and how timeout/cancellation behave. These are exactly the behavioral traits an agent needs before firing arbitrary code into a host process.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and caveats before the Args/Returns/Examples blocks, and the examples are genuinely illustrative (default instance, by name, by port). It is on the long side and the Args/Returns text restates schema-level detail, but no sentence is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a dangerous arbitrary-code tool with a nested params object, the description covers execution context, threading implications, timeout/task_id lifecycle, cancellation helper, output shape (result/stdout/stderr/instance/task_id), and worked examples. Nothing an agent needs in order to invoke it safely is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The Args section enumerates all six fields (code, script_path, capture_output, instance_id, port, timeout) with their roles, and gives concrete example call forms for instance_id and port. Much of this overlaps the schema's own descriptions, so it adds examples rather than new semantics, but it does compensate for the reported low schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Execute Python code or script file in IDA Pro context') and immediately distinguishes itself from siblings by naming check_task_status and cancel_ida_task as its follow-up companions. An agent can tell what this tool does and roughly where it sits in the workflow without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operational context: long-running scripts poll up to `timeout`, timeouts yield a task_id to be resolved via check_task_status, and long scripts should poll `mcp_cancelled()` for cooperative cancellation via cancel_ida_task. It also warns against interactive dialogs. What's missing is an explicit statement of when this tool is preferable to any alternative (none exists among siblings), so it stops just short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_ida_database_infoBRead-onlyIdempotent
Get information about an IDA database.
Args: instance_id: Target IDA instance ID (optional, uses default if not specified).
Returns: str: JSON-formatted string with database information.
| Name | Required | Description | Default |
|---|---|---|---|
| instance_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered. The description only adds that the result is a JSON-formatted string of database information, which is modest added context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded one-line purpose followed by compact Args/Returns blocks with no filler. The Args/Returns scaffolding is boilerplate but harmless and short.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the return shape need not be spelled out, and the single optional parameter is explained. What remains missing is any hint of what 'database information' contains or how it relates to sibling lookup tools, leaving the agent to infer the tool's niche.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the schema itself says nothing about instance_id beyond its type. The description compensates by explaining it is optional and that a default instance is used when omitted, which is the key semantic an agent needs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a verb and resource ('Get information about an IDA database'), which is enough to know the general intent. However, 'information' is vague and the description does nothing to distinguish this from siblings like list_ida_instances or check_ida_connection, so the agent must guess which metadata call to make.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage note is that instance_id is optional and falls back to a default. There is no guidance on when to call this versus list_ida_instances or check_ida_connection, and no prerequisites or exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_ida_instancesARead-onlyIdempotent
List all running IDA instances with MCP plugin enabled.
Returns: str: JSON-formatted list of IDA instances with their ports and database info.
Example response: { "count": 2, "instances": { "12345_crackme.exe": {"port": 13338, "database": "crackme.exe"}, "67890_malware.dll": {"port": 13339, "database": "malware.dll"} } }
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds contextual details by specifying that it returns a JSON list with ports and database info, including an example response. This goes beyond the annotations by clarifying the output structure and the MCP-plugin filter, but it does not discuss auth or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose in the first sentence, then provides a compact return description and example. The example is useful though slightly verbose; overall it is well-structured and earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the empty input schema, rich annotations, and an output schema, the description is nearly complete. It states the scope, return format, and an example. The main gap is the lack of when-to-use guidance against sibling tools, but for a simple lister this is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline score is 4 per the rubric. The schema and description need not document parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (list), resource (running IDA instances), and filter (with MCP plugin enabled). It clearly distinguishes a discovery operation from sibling tools like check_ida_connection or get_ida_database_info, which act on a single instance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no explicit when-to-use or when-not-to-use guidance. It does not say when to prefer this over check_ida_connection or that it should be used before attempting to connect. The usage is only implied by the verb 'list'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v1.3.0- Added
cancel_ida_task - Changed
execute_idapython4 fields changed- changed
Input schema / $defs / ExecuteScriptInput / properties / port / anyOfPrevious value: -[ - { - "type": "integer" - }, - { - "type": "null" - } -]New value: +[ + { + "maximum": 65535, + "minimum": 1, + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / $defs / ExecuteScriptInput / properties / timeout / descriptionPrevious value: -"Maximum time in seconds to wait for script execution to complete (default: 600). If the script takes longer, a task_id will be returned to check status later."New value: +"Maximum time in seconds to wait for script execution to complete (default: 600, max: 86400). If the script takes longer, a task_id will be returned to check status later." - added
Input schema / $defs / ExecuteScriptInput / properties / timeout / maximumAdded value: +86400 - added
Input schema / $defs / ExecuteScriptInput / properties / timeout / minimumAdded value: +1
5 tool updates
v1.2.0- First observed
check_ida_connection - First observed
check_task_status - First observed
execute_idapython - First observed
get_ida_database_info - First observed
list_ida_instances
TDQS
Scored across 6 tools
Most tools target distinct operations: list instances, execute scripts, get database info, check task status, and cancel tasks. However, list_ida_instances and check_ida_connection both concern instance availability, which could cause slight confusion in some contexts. The descriptions help distinguish them, so the overlap is minor.
All tool names use consistent snake_case with a verb-first pattern (list_, execute_, check_, get_, cancel_). The convention is predictable throughout, making the tool set easy to navigate.
Six tools is a well-scoped set for remote IDA Pro control, covering instance listing, script execution, connection checks, database info, task status, and cancellation. Each tool earns its place without redundancy or bloat.
The surface covers the core lifecycle: discover instances, execute scripts, check connectivity, inspect database info, and manage long-running tasks via status and cancellation. A minor gap is the absence of a dedicated tool to list all active tasks, but task IDs are returned by execute_idapython and can be tracked individually.
Maintenance
Related MCP Connectors
Reuse your team's AI instructions (Bindings and Stacks) from Bindry in any MCP client.
Trade 16 crypto exchanges + MetaTrader 5 from your AI assistant via one MCP connection.
Use AI models for chat, image, and video generation from Claude Code and other MCP hosts.
Automate 1,000+ services from any MCP-compatible AI agent: build Applets, run actions and queries.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables LLM clients like Claude to interact with IDA Pro for binary analysis, decompilation, cross-references, patching, and more via 41 MCP tools, 8 resources, and 7 guided prompts.52MIT
- AlicenseNot gradedqualityDmaintenanceConnects AI agents to IDA Pro and x64dbg for unified static and dynamic reverse engineering, enabling coordinated analysis, debugging, and patch planning through a local MCP daemon.15MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI tools to execute IDA Python code inside IDA Pro for reverse engineering tasks via MCP over SSE.3-
- FlicenseNot gradedqualityCmaintenanceEnables LLMs to perform binary analysis and reverse engineering via IDA Pro's headless idalib, providing 66 MCP tools like decompile, disasm, and xrefs without requiring the IDA GUI.3-