name	ida-pro-mcp
description	Use IDA Pro through the action-specific ida_* MCP operations.

IDA Pro MCP

Use the ida_* tools shown by MCP. Their JSON schemas are the complete call contract; do not invent a tool(action=...) call when an ida_* operation is available.

First turn

ida_open_binary(binary_path=...) when no session is active.
ida_session_state() to see analysis progress and context.
ida_overview() for architecture and entry-point context.
Use ida_find(query=...), then pass returned addresses verbatim to ida_decompile, ida_disassemble, ida_xrefs_to, ida_callers, or ida_callees.

Working rules

Build the semantic index with ida_index_functions() before ida_semantic_search(...). Use quality="full" when retrieval quality matters; both index qualities include bounded CFG/call evidence, while full quality also includes ctree-derived control and local data-flow evidence. Full indexing uses bounded passes, so repeat with the returned next_cursor until complete is true.
Treat the structure field returned by ida_decompile and ida_disassemble as evidence: it summarizes CFG shape and call targets; decompilation additionally supplies bounded ctree control points and local data-flow. Use ida_help or dedicated graph/advanced operations only when the compact summary is insufficient.
Use hex address strings exactly as returned by tools.
ida_rename and ida_comment mutate the IDB. Set risk_ack=true only after verifying the target and intended change.
Use ida_python(code=..., risk_ack=true) for narrowly scoped IDA-side scripting; it executes in the live IDA process and is policy-gated.
Record confirmed work with ida_write_finding; use ida_next_target to choose the next investigation point.
If a result is truncated, read _continue.token and _continue.fields. Call ida_continue(token=...) when one field is listed; when multiple fields are listed, pass the exact selected name as field=... (for example ida_continue(token="ABC123", field="code")).

Help

Call ida_help(topic="ida_decompile") for an exact schema and example, or ida_help(query="strings") to discover an operation. This works through MCP and does not depend on local workspace files.

Reference

Read references/operations.md only when the MCP schema or ida_help does not answer a specific question.

IDA Pro MCP

Use the ida_* tools shown by MCP. Their JSON schemas are the complete call contract; do not invent a tool(action=...) call when an ida_* operation is available.

First turn

ida_open_binary(binary_path=...) when no session is active.

ida_session_state() to see analysis progress and context.

ida_overview() for architecture and entry-point context.

Use ida_find(query=...), then pass returned addresses verbatim to ida_decompile, ida_disassemble, ida_xrefs_to, ida_callers, or ida_callees.

Working rules

Build the semantic index with ida_index_functions() before ida_semantic_search(...). Use quality="full" when retrieval quality matters; both index qualities include bounded CFG/call evidence, while full quality also includes ctree-derived control and local data-flow evidence. Full indexing uses bounded passes, so repeat with the returned next_cursor until complete is true.

Treat the structure field returned by ida_decompile and ida_disassemble as evidence: it summarizes CFG shape and call targets; decompilation additionally supplies bounded ctree control points and local data-flow. Use ida_help or dedicated graph/advanced operations only when the compact summary is insufficient.

Use hex address strings exactly as returned by tools.

ida_rename and ida_comment mutate the IDB. Set risk_ack=true only after verifying the target and intended change.

Use ida_python(code=..., risk_ack=true) for narrowly scoped IDA-side scripting; it executes in the live IDA process and is policy-gated.

Record confirmed work with ida_write_finding; use ida_next_target to choose the next investigation point.

If a result is truncated, read _continue.token and _continue.fields. Call ida_continue(token=...) when one field is listed; when multiple fields are listed, pass the exact selected name as field=... (for example ida_continue(token="ABC123", field="code")).

Help

Call ida_help(topic="ida_decompile") for an exact schema and example, or ida_help(query="strings") to discover an operation. This works through MCP and does not depend on local workspace files.

Reference

Read references/operations.md only when the MCP schema or ida_help does not answer a specific question.

ida-pro-mcp

IDA Pro MCP

First turn

Working rules

Help

Reference

IDA Pro MCP

First turn

Working rules

Help

Reference