IDA-instances-MCP
MCP server for IDA Pro that hosts several headless idalib sessions: an agent opens binaries, keeps each database isolated and connects with an access key
- 126 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The IDA plugin can run arbitrary code through py_eval and the key is a bearer token: whoever has it controls the instance
- The server listens on 0.0.0.0 by default, accepts file uploads with POST /upload and writes them to disk
- The --unsafe flag enables destructive tools and the debugger; run malware samples only in an isolated environment
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/ida-instances-mcpDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The IDA plugin can run arbitrary code through py_eval and the key is a bearer token: whoever has it controls the instance
- The server listens on 0.0.0.0 by default, accepts file uploads with POST /upload and writes them to disk
- The --unsafe flag enables destructive tools and the debugger; run malware samples only in an isolated environment
This is third-party code. Review the repository files before installing.
What it does
IDA-instances-MCP is a reworked build of ida-pro-mcp, the MCP server that lets an agent drive IDA Pro. The author adapted it for hosting: uv run idalib-mcp starts a supervisor that listens on 0.0.0.0:9999/mcp and opens each database in its own idalib worker process. The idb_open, idb_list and idb_close tools manage sessions, and --max-workers sets how many databases run in parallel (default 4). Every HTTP request needs a key. The server generates it at startup and hands it out once through GET /key; afterwards it lives in ~/.idapro/mcp/api_key. /health reports readiness, /sessions lists open databases and /upload accepts a sample directly on the server. Idle sessions are closed after an hour (saved first), and on SIGTERM the server saves every database. For interactive work inside IDA there is still the plugin and the stdio proxy uv run ida-pro-mcp. The repository also ships tool profiles, readonly.txt and triage.txt, that narrow the available calls, and a skill at skills/idapython/SKILL.md.
Who it is for. For reverse engineers and malware analysts holding an IDA Pro license who want Claude Code, Cursor or Codex to work through binaries on a dedicated server.
Good fit when
- Several binaries must be analyzed in parallel, each in its own isolated idalib session
- IDA with a license runs on a server or in a container while the agent sits on another machine
- Samples need to be uploaded over HTTP with POST /upload and opened through idb_open
- The agent should be limited to reading: the readonly.txt profile removes write tools
- A long decompilation must not die on a client timeout: the proxy waits up to 900 seconds
Not a fit when
- You have no IDA Pro license: IDA Free is not supported
- You want an open-source disassembler: the catalog has separate MCP servers for Ghidra
- The server would face the internet without a TLS reverse proxy: the key is a bearer token and whoever gets it owns the instance
- You need the unmodified upstream: this build carries its own changes on top of ida-pro-mcp
Example request
Upload sample.elf to the IDA server, open the database and find the function that compares the entered password with the referenceMCP
- Transport
- http, stdio
- Authentication
- key is optional
Environment variables
IDADIRrequired- IDA Pro install directory, required for headless runs
IDA_MCP_API_KEYsecret- Your own access key instead of the generated one
IDA_MCP_IDLE_TIMEOUT- Minutes before an idle session is closed, default 60
Limitations
Requires IDA Pro 8.3 or newer (9.x recommended), Python 3.11 or newer and uv. Before the first run, execute py-activate-idalib.py from the IDA directory and set IDADIR.
- The supervisor listens on 0.0.0.0 by default, and the IDA plugin binds to 0.0.0.0 too and demands the same key, because it can execute arbitrary code through py_eval. For access beyond a trusted network the author recommends a TLS reverse proxy.
- The --unsafe flag enables destructive tools and the debugger.
- At startup the server checks GitHub releases and offers a self-update; IDA_MCP_NO_UPDATE_CHECK=1 turns that off.
How to disable. Stop the idalib-mcp process (on SIGTERM it saves the databases) and remove the ida-instances entry from the client's MCP settings, for example with claude mcp remove ida-instances. The key lives in ~/.idapro/mcp/api_key and uploads in ~/.idapro/mcp/uploads.
FAQ
How is IDA-instances-MCP different from plain ida-pro-mcp?
It is a fork tuned for hosting: an access key on every request, /health, /sessions and /upload endpoints, reaping of idle sessions, saving databases on shutdown and a 900-second proxy timeout instead of 30.
How do I get the access key?
The server creates a key on first start and hands it out once through GET /key. After that the endpoint stays closed until restart. The key persists in ~/.idapro/mcp/api_key, and IDA_MCP_API_KEY sets your own.
How do I connect the server to Claude Code?
Run claude mcp add --transport http ida-instances http://your-host:9999/mcp --header 'Authorization: Bearer key'. Cursor and other clients accept a JSON block with url and headers.
Does it work with the free IDA?
No. It needs IDA Pro 8.3 or newer; the author does not support IDA Free.
How do I limit the agent to read-only work?
Start the supervisor with --profile and profiles/readonly.txt from the repository, and the toolset narrows to reading. The triage.txt profile defines a set for first-pass analysis.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server for IDA Pro with one endpoint for several open databases: decompilation, cross-references and similar-function search across binaries
MCP server that bridges IDA Pro with an agent: reading decompilation, renaming and typing, comments and running IDAPython right in the database
A headless IDA Pro MCP server in Rust: the agent opens a database, lists functions, disassembles, decompiles and builds cross references
The official Hex-Rays MCP server: an agent opens IDA databases, runs Python inside them and reverses binaries, with plugins for Claude Code and Codex
A Ghidra extension with an MCP server: an agent reads pseudocode and disassembly, builds call graphs and edits names, types and structures via 100 tools
An MCP server for the Ghidra disassembler: hundreds of tools for reverse engineering, decompilation, renaming, structures, emulation and debugging
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| IDA-instances-MCP (this entry) | no | key is optional | 126 | |
| GhidrAssistMCP | no | not required | 780 | an extension for the free Ghidra rather than IDA Pro |
| ReVa | no | API key | 879 | an MCP server for Ghidra with small decompilation tools |
README in short
The page explains how the build differs from ida-pro-mcp 2.0.0: a table of twelve changes (data safety, saving, locking, timeouts, key, endpoints, self-update) and a requirements list. It then covers starting the supervisor and the proxy, an example of fetching the key and uploading a sample with curl, client setup and a table of IDA_MCP_* environment variables. The security section warns that the key acts as a bearer token. The MIT license is inherited from upstream.