A Model Context Protocol (MCP) server for
IDA Pro. It exposes IDA's disassembler and the Hex-Rays decompiler to MCP
clients (Claude and others) as tools and resources, with a supervisor that fronts
multiple databases behind one endpoint so several agents can work in parallel.
What it does
- Read — decompile (Hex-Rays), disassemble, cross-references, call graphs, type
and struct inspection, memory reads, and string / byte / text search. - Query — structured filters over functions, instructions, xrefs, types, imports.
- Analyze — survey / triage, crypto and dangerous-API detection, vulnerability
heuristics, stack-string reconstruction, and dataflow / taint tracing. - Mutate — rename, comment, retype, define code and data, edit stack frames,
patch bytes / assembly, bookmarks, and annotation export / import. - Parallelize — open each database over a private copy so multiple agents can
work the same binary at once, and merge their edits back.
Three ways to run it: a headless idalib worker, a supervisor fronting many
databases over one HTTP endpoint, and a resident GUI plugin that serves MCP over
your live, open database. Streamable HTTP + stdio transports; zero third-party
runtime dependencies.
See the README for install and usage.