IDA Pro MCP Server: Setup for Claude Code, Cursor and Other Apps

• Gives a quick overview of the open binary

  Returns file info, segments, entry points, statistics and the most notable strings in one call.

  Try: “Give me a quick overview of this binary.”

  Read · survey_binary

• Shows a function as C-like code

  Decompiles one function with the Hex-Rays decompiler and pages through long output.

  Try: “Decompile main and explain what it does.”

  Read · decompile

• Shows a function's assembly

  Disassembles a function, with paging for long ones.

  Try: “Show the disassembly of the function at 0x401000.”

  Read · disasm

• Summarizes one function in a single call

  Returns pseudocode, strings, constants, callers, callees, cross-references and blocks for one function.

  Try: “Analyze sub_401500 and tell me what it is for.”

  Read · analyze_function

• Analyzes a group of related functions

  Summarizes related functions together with their internal call graph and shared data.

  Try: “Analyze the functions that handle the license check as a group.”

  Read · analyze_component

• Analyzes several functions at once

  Runs a full analysis over one or more target functions.

  Try: “Analyze these five functions together.”

  Read · analyze_batch

• Profiles functions by size and complexity

  Returns summary numbers for functions, with optional sampled detail.

  Try: “Which functions are the biggest and most complex?”

  Read · func_profile

• Follows where data goes or comes from

  Follows cross-references across several hops from or to an address.

  Try: “Where does the value at 0x404000 flow to?”

  Read · trace_data_flow

• Finds what refers to an address or name

  Lists cross-references to addresses or named symbols, capped per target.

  Try: “What calls the function CheckPassword?”

  Read · xrefs_to

• Searches cross-references with filters

  Queries cross-references by direction and type, with paging.

  Try: “Show only the code references to this string.”

  Read · xref_query

• Finds uses of a struct field

  Lists cross-references to a field of a structure.

  Try: “Where is the field flags of struct Config used?”

  Read · xrefs_to_field

• Lists the functions a function calls

  Returns the unique callees of each function.

  Try: “What does main call?”

  Read · callees

• Builds a call graph from a function

  Builds a bounded call graph from one or more root functions.

  Try: “Draw the call graph two levels down from main.”

  Read · callgraph

• Shows a function's control flow

  Returns the basic blocks of a function with their links.

  Try: “Show the control-flow blocks of this function.”

  Read · basic_blocks

• Searches for a byte pattern

  Finds byte patterns, with wildcards, with paging.

  Try: “Find the byte pattern 48 8B ?? ?? in the binary.”

  Read · find_bytes

• Searches strings, constants and references

  Searches for strings, immediate values or references.

  Try: “Find where the constant 0xDEADBEEF is used.”

  Read · find

• Searches strings with a regex

  Finds strings by a case-insensitive regular expression.

  Try: “Find strings that look like URLs.”

  Read · find_regex

• Searches the disassembly listing

  Searches the rendered listing for text in an address range.

  Try: “Search the listing for the word password.”

  Read · search_text

• Searches instructions by filter

  Finds instructions by mnemonic or operand filters.

  Try: “Find all call instructions to eax.”

  Read · insn_query

• Exports function data

  Exports functions as JSON, a C header or prototypes.

  Try: “Export the prototypes of all functions in this range.”

  Read · export_funcs

• Finds functions by name or address

  Looks up functions by address or name.

  Try: “Look up the function named main.”

  Read · lookup_funcs

• Lists functions

  Lists functions with optional filters and paging.

  Try: “List the first 50 functions.”

  Read · list_funcs

• Searches functions with filters

  Queries functions with richer filters than the plain list.

  Try: “List functions larger than 500 bytes with no name.”

  Read · func_query

• Lists global variables

  Lists global variables with filters and paging.

  Try: “List the global variables.”

  Read · list_globals

• Searches database entities with filters

  Queries entities in the IDA database with typed filters and paging.

  Try: “Find all named data items that start with g_.”

  Read · entity_query

• Lists imported functions

  Lists imports with their module names.

  Try: “Which Windows API functions does it import?”

  Read · imports

• Searches imports with filters

  Queries imports with richer filters.

  Try: “Show imports from ws2_32.dll.”

  Read · imports_query

• Reads raw bytes

  Reads bytes from addresses in the database.

  Try: “Read 32 bytes at 0x404000.”

  Read · get_bytes

• Reads numbers from memory

  Reads integer values of a chosen type from addresses.

  Try: “Read a 32-bit integer at 0x404010.”

  Read · get_int

• Reads strings from memory

  Reads text strings at addresses.

  Try: “What string is at 0x405000?”

  Read · get_string

• Reads a global variable's value

  Reads the value of a global by address or name.

  Try: “What is the value of g_key?”

  Read · get_global_value

• Shows a function's stack variables

  Returns the stack variables of a function.

  Try: “Show the stack layout of this function.”

  Read · stack_frame

• Reads a struct at an address

  Reads a structure's field values at an address.

  Try: “Read the struct at 0x404100.”

  Read · read_struct

• Finds structs by name

  Searches local structs and unions by name pattern.

  Try: “Find structs with Config in the name.”

  Read · search_structs

• Searches local types

  Queries local types with filters.

  Try: “List the enums defined in this database.”

  Read · type_query

• Shows a type's size and members

  Inspects named types: size, kind, declaration and members.

  Try: “Show the members of struct Packet.”

  Read · type_inspect

• Converts numbers between formats

  Converts numbers between decimal, hex, bytes, ASCII and binary, so the model does not guess.

  Try: “Convert 0x1F4 to decimal.”

  Read · int_convert

• Makes a byte signature for an address

  Builds the shortest unique byte signature starting at an address, for finding it again after updates.

  Try: “Make a signature for the function at 0x401000.”

  Read · make_signature

• Makes a byte signature for a function

  Builds unique signatures for function entry points.

  Try: “Make signatures for the functions I selected.”

  Read · make_signature_for_function

• Makes a signature for an address range

  Builds a signature for a range of addresses. Uniqueness is not guaranteed.

  Try: “Make a signature for 0x401000 to 0x401040.”

  Read · make_signature_for_range

• Makes signatures for code that refers to an address

  Finds signatures for code locations that reference an address.

  Try: “Make signatures for the code that uses this global.”

  Read · find_xref_signatures

• Saves the database

  Saves the open IDA database to disk, optionally to a new path.

  Try: “Save the database now.”

  Write · idb_save

• Renames functions, globals and variables

  Renames functions, globals, locals and stack variables in a batch, with a dry run option.

  Try: “Rename sub_401500 to check_license.”

  Write · rename

• Adds comments to the disassembly

  Sets comments at addresses in both the disassembly and the decompiler views.

  Try: “Add a comment explaining this loop.”

  Write · set_comments

• Appends to existing comments

  Adds to comments at addresses, skipping exact duplicates.

  Try: “Add a note to the comment at this address.”

  Write · append_comments

• Adds a bookmark

  Adds or replaces an IDA bookmark at an address.

  Try: “Bookmark the license check.”

  Write · add_bookmark

• Applies types to functions and variables

  Applies types to functions, globals, locals or stack variables.

  Try: “Set the type of arg1 to a char pointer.”

  Write · set_type

• Applies many type edits at once

  Applies several type edits and returns the overall status.

  Try: “Apply these type fixes to the whole module.”

  Write · type_apply_batch

• Guesses and applies likely types

  Infers likely types at addresses using Hex-Rays or heuristics, and applies them.

  Try: “Infer the types in this function.”

  Write · infer_types

• Defines C types

  Declares C type definitions in the local type library.

  Try: “Declare a struct for this packet header.”

  Write · declare_type

• Creates or extends enums

  Creates local enums or adds members to them.

  Try: “Create an enum for these error codes.”

  Write · enum_upsert

• Creates stack variables

  Creates stack variables at given offsets.

  Try: “Declare a buffer at offset -0x40.”

  Write · declare_stack

• Deletes stack variables

  Deletes stack variables by name or offset.

  Try: “Delete the stack variable var_8.”

  Delete · delete_stack

• Defines a function at an address

  Creates a function at an address, with optional end.

  Try: “Define a function at 0x401800.”

  Write · define_func

• Turns bytes into code

  Converts bytes into instructions at addresses.

  Try: “Convert the bytes at 0x401900 to code.”

  Write · define_code

• Turns code or data back into raw bytes

  Undefines items at addresses and returns them to raw bytes.

  Try: “Undefine the data at 0x404000.”

  Delete · undefine

• Creates typed data

  Creates a typed data item at an address, replacing what was there.

  Try: “Make a 4-byte integer at 0x404010.”

  Write · make_data

• Sets how an instruction operand is shown

  Sets the type of an operand, like the Y, O or # keys in the GUI.

  Try: “Show this operand as an offset.”

  Write · set_op_type

• Refreshes the decompiler's cache

  Clears the decompile cache for functions so changes show up.

  Try: “Recompile this function after the type change.”

  Write · force_recompile

• Shows a change and its decompile before and after

  Renames a function, sets its type or adds a comment, then shows the decompiled result before and after.

  Try: “Rename this function and show me the difference.”

  Write · diff_before_after

• Patches bytes in the program

  Changes bytes at addresses in the database, in a batch.

  Try: “Patch the byte at 0x401234 to 0x90.”

  Write · patch

• Patches assembly instructions

  Replaces instructions at addresses with new assembly.

  Try: “Replace this jump with a nop.”

  Write · patch_asm

• Writes numbers into the database

  Writes integer values at addresses.

  Try: “Set the integer at 0x404010 to 5.”

  Write · put_int

• Runs Python code inside IDA

  Runs any Python in IDA and returns the output. It can do anything IDA and your account can do, with no limits.

  Try: “Run a script that lists all functions with no name.”

  Runs code · py_eval

• Runs a Python file inside IDA

  Runs a whole Python script file in IDA and returns its output, with no limits.

  Try: “Run my script analyze.py in IDA.”

  Runs code · py_exec_file

• Starts debugging the program

  Starts a debugger session. Hidden unless the debugger extension is turned on in the address.

  Try: “Start the debugger and stop at the entry point.”

  Runs code · dbg_start

• Reads memory of the running program

  Reads memory from the program being debugged. Hidden unless the debugger extension is on.

  Try: “Read 64 bytes at the stack pointer.”

  Read · dbg_read

• Writes memory of the running program

  Writes bytes into the program being debugged. Hidden unless the debugger extension is on.

  Try: “Set the flag byte to 1 in the running program.”

  Write · dbg_write

• Opens a binary for headless work

  In the headless idalib mode, opens a binary and returns a session ID that other tools need.

  Try: “Open C:/samples/crackme.exe.”

  Files · idb_open

• Closes a headless session

  Saves, if asked, and closes a headless session.

  Try: “Close the crackme session.”

  Write · idb_close

• Used by the assistant behind the scenes

  Checks the server is up

  Reports the state of the MCP server for the open database.

  Try: “Is the IDA server responding?”

  Read · server_health

• Lists open sessions

  Lists open sessions and running IDA windows in headless mode.

  Try: “Which databases are open?”

  Read · idb_list

Watch out for

• One tool runs any Python code inside IDA

  py_eval and py_exec_file run code with no limits, so they can read and write files and reach the network from your machine. Turn unsafe tools off in the plugin's tool page if you do not need them. github.com

• It changes your database and patches bytes

  Tools rename, retype, undefine and patch code in the open database. Keep a copy of the IDB before a long session. github.com

• Debugger tools can run the program

  The debugger tools are hidden by default and turn on with an option in the address. They can start the program and write to its memory, so use them only in a sandbox. github.com

• The author recommends the official server

  The README says to use the official Hex-Rays IDA MCP server instead. This one is still maintained. github.com

Security advisories