IDA Pro MCP Server for Claude Code

Bridge Claude Code (CLI and Editor Extensions like VS Code, Cursor, Windsurf) with IDA Pro 9.0+ for AI-assisted reverse engineering. 87 tools covering virtually everything IDA Pro can do.

---

Architecture

Claude Code / Cursor / VS Code (MCP Client)
               │ (stdio)
               ▼
        ida-mcp Server
               │ (JSON-RPC over localhost:13337)
               ▼
   IDA Pro Plugin (ida_mcp_plugin.py)
               │ (IDAPython API on main thread)
               ▼
         IDA Pro 9.0+

---

Installation & Setup

1. Install the IDA Plugin

Copy ida_plugin/ida_mcp_plugin.py into your IDA Pro plugins directory:

• macOS: ~/idapro-9.0/plugins/ or /Applications/IDA Professional 9.0.app/Contents/MacOS/plugins/
• Windows: %APPDATA%\Hex-Rays\IDA Pro\plugins\ or C:\Program Files\IDA Professional 9.0\plugins\
• Linux: ~/.idapro/plugins/ or /opt/idapro-9.0/plugins/

When you open any binary in IDA Pro, the plugin starts a JSON-RPC server on 127.0.0.1:13337.

2. Configure Claude Code CLI

claude mcp add ida-pro -- uv run --directory "/Users/benzi/Documents/IDA MCP" ida-mcp

3. Configure VS Code / Cursor / Windsurf

Add to .mcp.json or your editor's MCP configuration:

{
  "mcpServers": {
    "ida-pro": {
      "command": "uv",
      "args": ["run", "--directory", "/Users/benzi/Documents/IDA MCP", "ida-mcp"]
    }
  }
}

Environment Variables

• IDA_MCP_HOST — Override host (default: 127.0.0.1)
• IDA_MCP_PORT — Override port (default: 13337)

---

Available Tools (87 Total)

Analysis (4)

Tool	Description
decompile_function	Hex-Rays C pseudocode decompilation
disassemble_function	Full assembly listing for a function
disassemble_range	Assembly between two addresses
get_bytes	Read raw hex bytes from an address

Navigation & Discovery (14)

Tool	Description
list_functions	List all functions with optional filter
get_function_info	Detailed function metadata
list_segments	Memory segments with permissions
get_xrefs_to	Cross-references TO an address
get_xrefs_from	Cross-references FROM an address
list_strings	Defined strings with optional filter
get_imports	Imported functions by module
get_exports	Exported functions and entry points
list_structs	Structures, unions, member layouts
list_enums	Enumerations and values
create_struct	Create a new struct type
get_function_callers	Functions calling a target (with call sites)
get_function_callees	Functions called by a target
make_string	Define a C-style string at address

Introspection (14)

Tool	Description
get_flowchart	Control flow graph — basic blocks with predecessors/successors
get_comment	Read comment at an address
get_all_comments	Read all comments within a function
get_function_comment	Read function-level comment
set_function_comment	Set function-level comment
get_stack_frame	Full stack frame layout (locals, args, saved regs)
set_operand_type	Change operand display (hex/decimal/binary/char)
set_local_variable_type	Retype a local variable in decompilation
get_color	Get instruction/function/segment color
set_color	Set instruction/function/segment color (RGB)
get_function_hash	Hash function bytes (MD5/SHA1/SHA256)
get_exception_info	Detect try/catch/throw in a function
get_microcode	Hex-Rays intermediate representation at any maturity level

Modifications (7)

Tool	Description
rename_function	Rename a function
rename_address	Rename a label, variable, or address
set_comment	Set regular or repeatable comment
set_function_type	Set C function signature/prototype
set_type	Set type at address
rename_local_variable	Rename local variable (Hex-Rays)
apply_callee_type	Apply type at call site

Search (2)

Tool	Description
search_text	Text search through disassembly
search_bytes	Byte pattern/signature search

Debugger (17)

Tool	Description
start_debugger	Start debugging the binary
get_debugger_status	Check debugger active/suspended state
set_breakpoint	Set software breakpoint
delete_breakpoint	Remove a breakpoint
list_breakpoints	List all breakpoints
enable_breakpoint	Enable/disable breakpoint
step_into	Step into next instruction
step_over	Step over next instruction
continue_execution	Continue until next breakpoint
suspend_debugger	Pause execution
exit_debugger	Terminate process
get_registers	Read CPU registers
read_debug_memory	Read memory from debugged process (hex dump with ASCII)
get_stack_trace	Call stack trace
list_debugger_threads	List all process threads
switch_thread	Switch active debugger thread
add_watchpoint	Set hardware watchpoint (read/write/execute)

Advanced (14)

Tool	Description
patch_bytes	Patch bytes in the IDA database
execute_idapython	Run arbitrary IDAPython code
load_type_library	Load .til type information library
list_type_libraries	List loaded TILs
make_code	Convert bytes to code (instruction)
make_data	Convert bytes to typed data
undefine	Revert to raw undefined bytes
define_function	Create function at address range
undefine_function	Delete function definition
add_bookmark	Add persistent bookmark
list_bookmarks	List all bookmarks
delete_bookmark	Remove bookmark
get_local_variables	List local variables and arguments
get_global_variables	List named global data variables

Database & Export (12)

Tool	Description
save_database	Save the IDA database
apply_flirt_signature	Apply FLIRT .sig for library identification
list_flirt_signatures	List applied FLIRT signatures
create_segment	Create new memory segment
delete_segment	Delete segment definition
set_segment_permissions	Change segment rwx permissions
create_array	Define typed arrays
navigate_to	Jump IDA cursor to address
produce_asm	Export clean assembly listing
produce_c	Export clean C pseudocode
run_idc_script	Execute IDC script code
run_ida_action	Trigger registered IDA UI action
list_ida_actions	List all available IDA actions

Meta (3)

Tool	Description
get_binary_info	File path, arch, bitness, entry point
get_analysis_status	Check auto-analysis completion
ping	Check IDA connectivity