ida-pro-mcp

name	ida-pro-mcp
description	Use IDA Pro through the action-specific ida_* MCP operations.

IDA Pro MCP

Use the ida_* tools shown by MCP. Their JSON schemas are the complete call contract; do not invent a tool(action=...) call when an ida_* operation is available.

First turn

1. ida_open_binary(binary_path=...) when no session is active.
2. ida_session_state() to see analysis progress and context.
3. ida_overview() for architecture and entry-point context.
4. Use ida_find(query=...), then pass returned addresses verbatim to ida_decompile, ida_disassemble, ida_xrefs_to, ida_callers, or ida_callees.

Working rules

• Build the semantic index with ida_index_functions() before ida_semantic_search(...). Use quality="full" when retrieval quality matters; both index qualities include bounded CFG/call evidence, while full quality also includes ctree-derived control and local data-flow evidence. Full indexing uses bounded passes, so repeat with the returned next_cursor until complete is true.
• Treat the structure field returned by ida_decompile and ida_disassemble as evidence: it summarizes CFG shape and call targets; decompilation additionally supplies bounded ctree control points and local data-flow. Use ida_help or dedicated graph/advanced operations only when the compact summary is insufficient.
• Use hex address strings exactly as returned by tools.
• ida_rename and ida_comment mutate the IDB. Set risk_ack=true only after verifying the target and intended change.
• Use ida_python(code=..., risk_ack=true) for narrowly scoped IDA-side scripting; it executes in the live IDA process and is policy-gated.
• Record confirmed work with ida_write_finding; use ida_next_target to choose the next investigation point.
• If a result is truncated, read _continue.token and _continue.fields. Call ida_continue(token=...) when one field is listed; when multiple fields are listed, pass the exact selected name as field=... (for example ida_continue(token="ABC123", field="code")).

Help

Call ida_help(topic="ida_decompile") for an exact schema and example, or ida_help(query="strings") to discover an operation. This works through MCP and does not depend on local workspace files.

Reference

Read references/operations.md only when the MCP schema or ida_help does not answer a specific question.