run_ida_commandLABSCO SUMMARY
The escape hatch is the main tool.
The inventory and search tools cover the routine questions, but run_ida_command is what makes this open-ended: anything expressible in IDAPython is reachable. That also sets the security frame — scripts the model writes execute inside your IDA session with your privileges over the binary, and the loopback-only bind is the containment. Keep it that way unless you have a reason not to.
What it is
Two pieces that work together. A plugin, ida_remote_server.py, runs an HTTP server inside IDA Pro on 127.0.0.1:9045; an MCP server in front of it turns those operations into tools. IDA stays open with your binary loaded, and the assistant works against that live session.
What you get
run_ida_command— execute an IDAPython script by absolute path, optionally writing its output to a fileget_functions,get_exports,get_strings— inventory of the loaded binaryget_disassembly— disassembly for an address range, or a set number of instructions from a start addresssearch_immediate_value— find immediate operands, with a radix and an optional address rangesearch_text— find text in the binary, case-sensitive or not, within an address rangesearch_byte_sequence— find byte patterns such as90 90 90- The plugin's own HTTP API underneath, including
/api/importsand three script-execution endpoints, if you want to script it outside MCP
Requirements
IDA Pro 8.3 or later with a binary already open, Node.js 18 or later, and the plugin file copied into IDA's plugins directory — the path is documented for Windows, macOS and Linux. The MCP half is built from source with npm install and npm run build; the repository's package name is ida-server. By default the plugin binds only to 127.0.0.1; exposing it to a network means editing DEFAULT_HOST in the plugin, with the consequences that implies.
Setup effort
Build from source — git clone https://github.com/fdrechsler/mcp-server-idapro.git
USE CASES
01
Getting oriented in an unfamiliar binary
Pull functions, exports and strings, and let the assistant point at what looks interesting before you open a single graph view.
02
Chasing a constant or a magic value
Search immediate operands with the right radix, then read the disassembly around each hit.
03
Finding a known byte pattern
Search for the sequence across the binary and get the addresses back, then disassemble each one.
04
Running analysis you would otherwise write by hand
Have a script generated, executed inside the session, and its output written to a file you can read back.
8 tools
Listed in project docs. Your client may show a different list.
search_immediate_valuesearch_textsearch_byte_sequenceget_disassemblyget_functionsget_exportsget_stringsBEFORE YOU INSTALL
What to know first
Tools you get
8 tools named in the project's documentation.
Requires
- node on PATH
- Node.js 18 or later
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone and build this one yourself.
Server setup
TERMINAL
git clone https://github.com/fdrechsler/mcp-server-idapro.git
cd mcp-server-idapro
npm install
npm run buildCopy ida_remote_server.py from the clone into your IDA Pro plugins directory (Windows %PROGRAMFILES%\IDA Pro\plugins, macOS /Applications/IDA Pro.app/Contents/MacOS/plugins, Linux /opt/idapro/plugins)
Start IDA Pro and open a binary; the plugin starts its HTTP server on 127.0.0.1:9045
In the config block, <YOUR_PATH_TO_IDA_SERVER>/dist/index.js is the full path to dist/index.js in your clone
MCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"ida-pro": {
"command": "node",
"args": [
"<YOUR_PATH_TO_IDA_SERVER>/dist/index.js"
],
"env": {}
}
}
}
