PlugWiki
IDA MCP logo

IDA MCP: the official Hex-Rays server for AI reverse engineering

Official · by Hex-RaysLocal
GetPyPIida-mcphexrayssa/ida-mcpDocs
Tools
6
3 read · 3 change
Stars
1.5K
on GitHub
Downloads
73
a week
Works in
2
supported apps
Risk
High
can write

Lets your AI assistant open, decompile and annotate binaries in IDA, live in the GUI you have open or in the background.

This is Hex-Rays' own server for IDA. It lets Claude Code, Codex and other assistants open a binary, decompile it, follow cross-references, and rename or comment things while you watch in the IDA GUI. It is free and open source, runs fully on your machine, and needs IDA 9.4 or later on Home, Pro or Classroom. Know before you start that the assistant works by running Python inside IDA with your account's rights, so use a VM or sandbox for malware.

Good for

  • Malware analysts who want an assistant to trace payloads across several binaries
  • Reverse engineers who want the assistant's renames and comments to appear live in their IDA session
  • Teams on air-gapped networks who need to pair IDA with a local model
  • Developers building analysis pipelines that run IDA headless with an agent
  • CTF players solving crackmes and multi-file challenges from Claude Code or Codex

Works in

2 supported · 1 with issues · 9 should work

Tap an app to see how to set it up and any known problems.

Install IDA MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the IDA MCP server to Claude Code. Run this command:

uvx ida-hcli mcp install

Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires IDA 9.4+ with idalib, Python 3.11+, uv and git on PATH.

The Hex-Rays installer adds the IDA GUI plugin and offers to set up this client for you; rerun it to update. The plugin method adds only the client side, so run the installer once anyway to get the GUI plugin. Hex-Rays recommends turning off any other IDA MCP server. Claude finds the IDA tools more readily when the server is added as a plain server named ida (the command method) than as a plugin.

From the vendor's docs. Source.

Tools

  • Opens a binary or saved IDA database so the assistant can analyse it

    Loads an executable, library, firmware image or existing IDA database and runs IDA's auto-analysis in the background, or attaches to the copy already open in your IDA GUI. The assistant calls this before anything else.

    Try: “Open ./malware/sample.exe in IDA and tell me what it imports”

    Files · open_database

  • Decompiles, searches and edits the binary by running IDA Python scripts

    Runs Python against the open database to decompile functions, list strings and imports, follow cross-references, apply types, rename functions and variables, add comments or patch bytes. Scripts run with your account's rights, so they can also touch files and the network.

    Try: “Decompile the function at 0x401000, rename it to something sensible and add a comment explaining it”

    Runs code · execute_python

  • Shows which binaries are open in IDA right now

    Lists the databases open in your IDA GUI and in background workers, with the ID the assistant uses to pick one.

    Try: “What do I have open in the IDA GUI?”

    Read · list_databases

  • Saves the assistant's renames, comments and patches to disk

    Writes the open IDA database to disk so the changes made during the session are kept.

    Try: “Save the database now that the functions are renamed”

    Write · save_database

  • Closes the assistant's hold on a database without disturbing others

    Releases this session's hold on a database. Other assistants and the IDA GUI keep it open; a background worker shuts down once nobody is using it.

    Try: “Close sample.exe, I'm done with it”

    Write · close_database

  • Used by the assistant behind the scenes

    Looks up how to do a task in IDA's Python API

    Searches IDA's Python API reference by task or name and returns signatures and examples, so the assistant writes correct scripts. The assistant uses this for itself.

    Try: “How do I list all xrefs to an address in IDA's Python API?”

    Read · reference

Read from the source code

Pros and cons

Good

  • Made and maintained by Hex-Rays, free and open source under MIT.
  • Works on the database open in your IDA GUI, with changes shown live.
  • Also runs headless, so it can open extra binaries on its own.
  • Several assistants can share the same databases on one machine.
  • Runs fully local and works with local models.
  • Ready-made plugins for Claude Code, Codex and Copilot CLI.

Watch out

  • Needs IDA 9.4 or later with idalib, plus Python 3.11, git and uv.
  • No read-only mode; the assistant runs arbitrary Python with your rights.
  • No sandbox by design, so malware work belongs in a VM.
  • The GUI plugin can fail to load on Windows.
  • Hex-Rays asks you to disable other IDA servers to avoid confusing the assistant.

Permissions

high risk · 3 things to watch

High risk

The assistant runs Python inside IDA with your account's rights, so a bad prompt or a booby-trapped sample could reach your files and network. Run IDA and the assistant in a VM or sandbox when you analyse untrusted binaries.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • The assistant can run any Python on your machine

    Scripts run with your account's rights, including network access and starting programs. Hex-Rays recommends a VM or sandbox for untrusted samples. github.com

  • Text inside a sample can steer the assistant

    Strings in malware can act as instructions to the model. Sandboxing IDA alone does not stop this if the assistant can also run shell commands. github.com

  • It can rename, retype and patch your database

    Edits apply to the open database and can be saved to disk. Keep a copy of important databases before a long session. raw.githubusercontent.com

Security advisories

No published security advisories as of Nov 1, 2026.

Technical details
Talks toNone from the server itself; scripts the assistant runs can make network requests. Your AI model provider receives what the assistant reads

Alternatives

Use the official server on IDA 9.4 or later. Pick ida-pro-mcp if you are stuck on an older IDA, and ida-mcp-rs for headless work on Apple binaries.

ServerOfficialWorks in IDA GUICan change thingsToolsGitHub stars
IDA MCPThis pageOfficialYesYes61.5K
ida-pro-mcpCommunityYes––13.2K
ida-mcp-rsCommunityNo––890

What people say

People like that it is first-party and works live in the IDA GUI, and want clearer guidance on how risky it is to point at malware.

What people like

  • The author of the most popular community IDA server now recommends this one instead.
  • Changes the assistant makes show up live in your IDA session.
  • It runs locally with any model, which suits air-gapped work.

Common complaints

  • Users asked Hex-Rays to document the threat model before running it on malware.
  • It needs IDA 9.4 or newer, and older versions will not be supported.
  • On Windows the GUI plugin can fail to load, so the assistant cannot see databases open in IDA.
  • Choosing between floating license pools is not automated.

In their words

Docs
“I recommend using the Official Hex-Rays IDA MCP Server instead!”
mrexodiaGitHub issueOct 2026
“Before using this MCP server, I want to know what the risks are.”
mspinka-r7GitHub issueOct 2026
“There is no sandboxing, security controls or API restrictions of any kind and this is by design.”
mrexodiaGitHub issueSep 2026
“It would be great if this MCP handled things a bit more ad-hoc, e.g. checking finding a suitable license on the license server when needed.”
bluecmd

Questions

Is the IDA MCP server free?

Yes. The server is free and open source under the MIT license. You still need a licensed IDA 9.4 or later: Home, Pro (Essential, Expert or Ultimate) or Classroom.

Does it work with IDA Free or older IDA versions?

No. It needs IDA 9.4 or newer with idalib, and Hex-Rays has said there are no plans to support older versions. On an older IDA, the community ida-pro-mcp server supports 8.3 and later.

Is it safe to use on malware?

Only inside a VM or sandbox. The assistant runs Python inside IDA with your account's rights, and Hex-Rays says there is no sandboxing by design. Text inside a sample can also try to steer the assistant.

Does my analysis leave my machine?

The server itself runs fully local and works with local models. What leaves your machine is whatever your AI model provider receives, so pick a local model for sensitive samples.

IDA MCP vs ida-pro-mcp: which should I use?

Use the official IDA MCP on IDA 9.4 or later. It gives the assistant a few tools plus IDAPython scripting and lets several assistants share databases. The author of ida-pro-mcp now recommends the official server too.

Do I need IDA open while it works?

No. Without the GUI it opens binaries in a background worker. With the GUI plugin installed, it can also work on the database you have open and show its changes live.

Can several assistants work on the same binary?

Yes, if they run on the same machine. Each one sees the others' renames and comments right away, and you can keep working in the GUI at the same time.

How do I update it?

Run the same installer command from the install box again. The maintainer confirmed that rerunning it updates the IDA plugin and the assistant plugins.

Should I remove my other IDA MCP servers?

Yes, or at least turn them off. Hex-Rays recommends disabling other IDA servers so the assistant does not mix up their tools.

Does it work with floating licenses?

It uses IDA's own license handling underneath, so it works the way IDA does on your machine. Switching between several license pools is not automated.

Examples

  • Reverse a binary from scratch without opening IDA first

    Reverse /path/to/sample.elf for me in IDA

    Source

  • Check that the assistant can see your open IDA session

    What do I have open in the IDA GUI?

    Source

  • Solve a challenge spread across an EXE and three DLLs, including pulling data from resources and reproducing a custom decryption

    Can you obtain the collection code for parcel ZX-4815 in ParcelDesk.exe?

    In Hex-Rays' demo the agent traced data across the DLLs, parsed the resources and replicated the decryption.

    Source

  • Extract a second-stage payload from a malware sample and analyse it as its own database

    Source

Information

updated Nov 2, 2026

Publisher
Hex-Rays (official)
Package
ida-mcp
Registry
PyPI
Transport
stdio, Streamable HTTP
Auth
None
Version
20261028.0.3
License
MIT
Last commit
Oct 28, 2026
Open issues
17

WebsiteDocsGitHubPyPIChangelogIssues

Other IDA Pro MCP servers

See all

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 15
  1. Hex-Rays IDA MCP README · github.com
  2. IDA MCP Getting Started · docs.hex-rays.com
  3. Claude Code: plugin install makes ida-mcp half as findable in tool search · github.com
  4. IDA MCP Overview · docs.hex-rays.com
  5. Hex-Rays IDA MCP Server · hex-rays.com
  6. IDA MCP tool metadata · raw.githubusercontent.com
  7. Document the threat model · github.com
  8. Multiplexing · docs.hex-rays.com
  9. add support for version 9.0+ · github.com
  10. ida-mcp and interaction with floating licenses · github.com
  11. Is there any easy update way? · github.com
  12. IDA Pro MCP README · github.com
  13. Document the threat model · github.com
  14. GUI plugin never registers on Windows · github.com
  15. ida-mcp-rs README · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.