🔧 ida-pro-mcp-plus

Enhanced IDA Pro MCP Server - Let AI assistants analyze binaries directly

Author: oxygen (304914289@qq.com)
Version: 1.0.0
Repository: https://github.com/GameSecurityFrontierLib/ida-pro-mcp-plus

✨ Key Features

🚀 Multi-Instance Support - Analyze multiple binaries simultaneously without conflicts
🎯 No GUI Required - Fully automated batch-mode analysis via IDA headless (idat.exe)
🔄 Smart Caching - Automatic .i64 database management for faster subsequent analyses
💾 Efficient IPC - Shared memory communication for large data transfers
📦 34 Powerful Tools - Complete static analysis, modification, and type system capabilities
🧩 Modular Architecture - 7 independent script modules for easy maintenance
✅ 100% Tested - Comprehensive test suite with full coverage
🎨 One-Click Install - pip install and you're ready to go!

🆚 Why ida-pro-mcp-plus?

vs. Original ida-pro-mcp

Feature	ida-pro-mcp	ida-pro-mcp-plus
Multi-Instance	❌ Single instance only	✅ Parallel analysis
IDA GUI	⚠️ Requires idalib + GUI	✅ Headless batch mode
Caching	❌ No caching	✅ Smart .i64 cache
Architecture	Monolithic	✅ Modular (7 modules)
Installation	pip install	✅ pip install
Memory Ops	Basic	✅ Full read/write/patch
Code Modification	❌	✅ ASM patch, rename, comment
Stack Analysis	❌	✅ Frame vars + types
Type System	❌	✅ Declare, apply, search types

Key Advantages

🔥 True Parallel Processing: Analyze multiple binaries at once without resource conflicts
⚡ Lightning Fast: No GUI overhead, pure batch-mode execution + smart caching (10x faster on cached files)
🎯 Production Ready: Smart caching + timeout handling + error recovery
🛠️ More Powerful: 34 tools covering all reverse engineering needs
📦 Easy Install: pip install → ida-mcp-plus --install → Done!

📥 Installation

Method 1: Direct Install from GitHub (Recommended)

# Install directly from master branch
pip install git+https://github.com/GameSecurityFrontierLib/ida-pro-mcp-plus.git

# One-line setup: Configure all MCP clients automatically
ida-mcp-plus --install

Alternative install methods:

# From ZIP archive
pip install https://github.com/GameSecurityFrontierLib/ida-pro-mcp-plus/archive/refs/heads/master.zip

# Or specify branch explicitly
pip install git+https://github.com/GameSecurityFrontierLib/ida-pro-mcp-plus.git@master

The --install wizard will:

✅ Prompt for your IDA Pro paths (ida.exe and idat.exe)
✅ Auto-detect all installed MCP clients (Cursor, Claude Desktop, VS Code, etc.)
✅ Configure each client with proper environment variables
✅ Restart instructions for each client

Method 2: Install from Source (For Development)

git clone https://github.com/GameSecurityFrontierLib/ida-pro-mcp-plus.git
cd ida-pro-mcp-plus
pip install -e .
ida-mcp-plus --install

🚀 Quick Start

Step 1: Install the Package

pip install git+https://github.com/GameSecurityFrontierLib/ida-pro-mcp-plus.git

What this does:

Installs ida-pro-mcp-plus package to your Python environment
Creates global command ida-mcp-plus available anywhere
Installs all dependencies (mcp>=0.9.0)

Step 2: Configure MCP Clients

ida-mcp-plus --install

Interactive wizard prompts:

🚀 ida-pro-mcp-plus Installer
==================================================

Configure once, use with all AI clients!

Enter path to ida.exe (or ida64):  F:/tools/analyze/ida9.0/ida.exe
Enter path to idat.exe (or idat64): F:/tools/analyze/ida9.0/idat.exe

Auto-configures these MCP clients:

✅ Cursor (%APPDATA%\Cursor\User\globalStorage\...)
✅ Claude Desktop (%APPDATA%\Claude\claude_desktop_config.json)
✅ Cline (VS Code extension)
✅ Roo Code (VS Code extension)
✅ Windsurf
✅ Codebuddy Code
✅ Continue, LM Studio, and more...

Step 3: Restart & Verify

Restart your MCP client (close and reopen)

Test in AI chat:

User: "List all available ida-pro-mcp-plus tools"
AI: [Shows 34 tools including list_functions, decompile_function, etc.]

Success! 🎉 You can now analyze binaries through AI chat

Step 4: First Analysis

User: "Analyze the binary at C:/samples/malware.exe, 
       show me the main function decompiled code"

AI: [Automatically uses decompile_function tool to show pseudocode]

🛠️ Available Tools (34)

📊 Basic Analysis (10 tools)

list_functions - List all functions (paginated/filtered)
get_function_info - Get detailed function metadata
disassemble_function - Disassemble function
decompile_function - Decompile to pseudocode (F5)
list_strings - Extract all strings
list_imports - List imported functions
xrefs_to - Find cross-references
get_callees - Get function call relationships
read_bytes - Read raw bytes
ping - Test connection

🔬 Advanced Analysis (7 tools)

basic_blocks - Basic block CFG analysis
find_bytes - Byte pattern search (wildcards supported)
find - Immediate value search
export_funcs - List exported functions
callgraph - Complete call graph (bidirectional)
find_regex - Regex string search
lookup_funcs - Batch function lookup

💾 Memory Operations (7 tools)

list_globals - List global variables
int_convert - Number base conversion
get_int - Read typed integers (i8/u16/i32le/u64be etc.)
get_string - Read strings
get_global_value - Read global variable values
patch - Modify memory bytes
put_int - Write typed integers

✏️ Code Modification (3 tools)

set_comments - Set comments
patch_asm - Assembly instruction patching
rename - Unified rename (func/global/local/stack vars)

📚 Stack Frame Tools (3 tools)

stack_frame - Get stack frame variables
declare_stack - Declare stack variable types
delete_stack - Delete stack variables

🏗️ Type System (4 tools)

declare_type - Declare C types to Local Types
read_struct - Read struct instances
search_structs - Search struct definitions
set_type - Apply types to addresses

💡 Usage Examples

Example 1: Decompile Function

User: Decompile function at 0x140001000
AI: [Uses decompile_function tool]
    Returns complete C pseudocode

Example 2: Find Strings

User: Find all strings containing "password"
AI: [Uses find_regex tool]
    Returns all matching strings with addresses

Example 3: Patch Code

User: Change instruction at 0x140001234 to nop
AI: [Uses patch_asm tool]
    Successfully patches instruction

Example 4: Parallel Analysis

User: Analyze main.exe and helper.dll simultaneously
AI: [Uses multiple tools in parallel]
    Analyzes both binaries without conflicts

🔧 Configuration

Required Environment Variables

Variable	Description	Example
`IDA64_PATH`	IDA Pro executable	`C:/Program Files/IDA Pro 9.0/ida.exe`
`IDAT64_PATH`	IDA headless version	`C:/Program Files/IDA Pro 9.0/idat.exe`

Optional Environment Variables

Variable	Default	Description
`I64_CACHE_DIR`	`.i64_cache`	Database cache directory
`IDA_TIMEOUT`	`120`	Timeout in seconds
`IDA_SHM_SIZE`	`20971520`	Shared memory size (20MB)

Manual Configuration

If auto-install doesn't work, get the config template:

ida-mcp-plus --config

Then paste into your MCP client's configuration file.

🧪 Testing

Run complete test suite:

python test_mcp_direct.py

Expected output:

Total: 34 | Passed: 34 | Failed: 0

📂 Project Structure

ida-pro-mcp-plus/
├── src/ida_pro_mcp_plus/
│   ├── server.py              # Main MCP server (34 tools)
│   ├── ida_scripts.py         # Original 9 tools
│   ├── ida_scripts_analysis.py # Advanced analysis (7 tools)
│   ├── ida_scripts_core.py    # Core utilities (2 tools)
│   ├── ida_scripts_memory.py  # Memory operations (5 tools)
│   ├── ida_scripts_modify.py  # Modification tools (3 tools)
│   ├── ida_scripts_stack.py   # Stack frame tools (3 tools)
│   └── ida_scripts_types.py   # Type system (4 tools)
│
├── test_mcp_direct.py         # Test suite (34 tests)
├── pyproject.toml             # Package configuration
├── README.md                  # This file
├── README_CN.md               # Chinese version
├── CHANGELOG.md               # Version history
├── CONTRIBUTING.md            # Contribution guide
└── LICENSE                    # MIT License

🤝 Contributing

Contributions welcome! See CONTRIBUTING.md

📝 Changelog

See CHANGELOG.md for detailed version history.

🙏 Acknowledgments

Based on ida-pro-mcp by mrexodia. Thanks for the original implementation!

📄 License

MIT License - Free to use, modify, and distribute

📞 Contact

Author: oxygen
Email: 304914289@qq.com
Issues: https://github.com/GameSecurityFrontierLib/ida-pro-mcp-plus/issues

⭐ Star History

If this project helps you, please give it a Star! ⭐

中文文档 | English

Name		Name	Last commit message	Last commit date
Latest commit History 2 Commits
src/ida_pro_mcp_plus		src/ida_pro_mcp_plus
.gitignore		.gitignore
.mcp.json		.mcp.json
INSTALL.md		INSTALL.md
LICENSE		LICENSE
README.md		README.md
README_CN.md		README_CN.md
pyproject.toml		pyproject.toml

Folders and files

Latest commit

History

Repository files navigation

🔧 ida-pro-mcp-plus

✨ Key Features

🆚 Why ida-pro-mcp-plus?

vs. Original ida-pro-mcp

Key Advantages

📥 Installation

Method 1: Direct Install from GitHub (Recommended)

Method 2: Install from Source (For Development)

🚀 Quick Start

Step 1: Install the Package

Step 2: Configure MCP Clients

Step 3: Restart & Verify

Step 4: First Analysis

🛠️ Available Tools (34)

💡 Usage Examples

Example 1: Decompile Function

Example 2: Find Strings

Example 3: Patch Code

Example 4: Parallel Analysis

🔧 Configuration

Required Environment Variables

Optional Environment Variables

Manual Configuration

🧪 Testing

📂 Project Structure

🤝 Contributing

📝 Changelog

🙏 Acknowledgments

📄 License

📞 Contact

⭐ Star History

About

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Packages