{ "initialize": { "protocolVersion": "2025-11-25", "capabilities": { "tools": {}, "resources": { "subscribe": false, "listChanged": false }, "prompts": {}, "logging": {} }, "serverInfo": { "name": "ida", "version": "" }, "instructions": "IDA Pro reverse engineering of compiled binaries (ELF, PE, Mach-O, firmware): decompile to pseudocode, disassemble (disasm), xrefs, symbols, strings, imports, types. Use instead of objdump, readelf, nm or strings when you need decompilation or cross-references." }, "tools/list": { "tools": [ { "name": "open_database", "description": "Open (load) a binary executable, shared library, firmware image, or an\nexisting .i64/.idb IDA database in IDA Pro for reverse engineering. Runs IDA\nauto-analysis (functions, disassembly, cross references, strings) in a headless\nworker, or attaches to the file already open in the IDA GUI. Call this\nfirst, then use execute_python to decompile, disassemble and query the binary.\nload_options apply only when a new worker is spawned; they do not change an\nalready-open IDA GUI database or a reused worker.", "inputSchema": { "type": "object", "properties": { "path": { "type": "string", "description": "Path to a local executable or IDB. A GUI instance is used when available." }, "set_current": { "type": "boolean", "description": "Whether this database should become the default target for execute_python().", "default": true }, "load_options": { "anyOf": [ { "type": "object", "properties": { "processor": { "type": "string", "description": "IDA processor module, such as metapc." }, "file_type": { "type": "string", "description": "IDA input file type, such as binary." }, "image_base": { "type": "integer", "description": "Image base byte address; must be 16-byte aligned." }, "entry_point": { "type": "integer", "description": "Entry point byte address." } }, "required": [], "additionalProperties": false }, { "type": "null" } ], "description": "IDA import options for a newly spawned worker, such as loading a raw blob.", "default": null }, "gui": { "type": "boolean", "description": "Open in the IDA GUI instead of a headless worker. Only when the user explicitly asks for the GUI.", "default": false } }, "required": [ "path" ] }, "title": "Open binary in IDA", "outputSchema": { "type": "object", "properties": { "instance_id": { "type": "string" }, "backend": { "type": "string", "description": "IDA process serving it: gui, idalib, or idat." }, "status": { "type": "string", "description": "Attachment state: attached or current." }, "recovery": { "type": "string", "description": "Crash recovery performed while opening: none, repaired, or restored." }, "log_path": { "type": "string" }, "mcp_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "hint": { "type": "string" } }, "required": [ "instance_id", "backend", "status", "recovery", "log_path", "mcp_id", "hint" ], "additionalProperties": false } }, { "name": "execute_python", "description": "Run Python (IDAPython and the ida-domain API) against the binary open in IDA:\ndecompile a function to Hex-Rays pseudocode, disassemble (disasm) instructions,\nenumerate functions, strings, imports, exports, symbols, segments and sections,\nfind cross references (xrefs to/from an address, callers, callees, call graph),\nget the function at an address, inspect or apply types and structs, rename\nfunctions and variables, add comments, and patch bytes. Returns the result plus\nstdout/stderr. Look up API names with reference first.", "inputSchema": { "type": "object", "properties": { "code": { "type": "string", "description": "Python code that runs against an already-open database. Call reference(query) first; do not guess the API shape. `db` is the current ida-domain Database, and `ida_domain` is also imported globally. Imports, variables, and definitions persist for this agent's database lease. A single or trailing expression is returned. For function-style code, define run(db), execute(db), or main(db); it is invoked automatically when there is no trailing expression." }, "instance_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "description": "Optional database instance id. If omitted, use the current target.", "default": null }, "timeout": { "type": "number", "description": "Python execution timeout in seconds. This does not include the separate initial autoanalysis wait.", "default": 360 } }, "required": [ "code" ] }, "title": "Run IDA Python analysis", "outputSchema": { "type": "object", "properties": { "result": {}, "stdout": { "type": "string" }, "stderr": { "type": "string" } }, "required": [ "result", "stdout", "stderr" ], "additionalProperties": false } }, { "name": "reference", "description": "Look up the IDA Pro ida-domain Python API by task or name, e.g.\n\"decompile function\", \"xrefs to address\", \"list strings\",\n\"rename local variable\", \"struct type\". Returns API signatures and usage\nexamples for IDA analysis via execute_python.", "inputSchema": { "type": "object", "properties": { "query": { "type": "string", "description": "Class, method, or reverse-engineering concept to look up in the IDA reference." } }, "required": [ "query" ] }, "title": "Search IDA API reference", "annotations": { "readOnlyHint": true } }, { "name": "list_databases", "description": "Show the IDA databases (analyzed binaries, .i64/.idb) currently open in the\nIDA GUI or in headless idalib workers, with their instance ids.", "inputSchema": { "type": "object", "properties": {}, "required": [] }, "title": "Show open IDA databases", "annotations": { "readOnlyHint": true }, "outputSchema": { "type": "object", "properties": { "instances": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string" }, "backend": { "type": "string", "description": "IDA process serving it: gui, idalib, or idat." }, "status": { "type": "string", "description": "Action state: available, attached, current, or unavailable." }, "instance_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "error": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "path", "backend", "status", "instance_id", "error" ], "additionalProperties": false } }, "hint": { "type": "string" } }, "required": [ "instances" ], "additionalProperties": false } }, { "name": "save_database", "description": "Save the IDA database (.i64) to disk so renames, comments, types and patches\nmade during reverse engineering persist.", "inputSchema": { "type": "object", "properties": { "instance_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "description": "Optional database instance id. If omitted, save the current target.", "default": null } }, "required": [] }, "title": "Save IDA database", "outputSchema": { "type": "object", "properties": { "path": { "type": "string" } }, "required": [ "path" ], "additionalProperties": false } }, { "name": "close_database", "description": "Release this session's lease on an IDA database (.i64/.idb) without\ndisrupting other clients. If this is the final lease on a managed idalib worker,\norphaned IDA Python execution is cancelled and this call waits for the IDB to\nshut down. Databases open in the IDA GUI stay open. To move a database to the\nGUI, close it and, when final_lease is true, open idb_path with gui=true.", "inputSchema": { "type": "object", "properties": { "instance_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "description": "Optional database instance id. If omitted, release the current target.", "default": null } }, "required": [] }, "title": "Release IDA database", "outputSchema": { "type": "object", "properties": { "closed": { "type": "boolean" }, "final_lease": { "type": "boolean", "description": "Whether this was the last lease: the worker then saved and closed its IDB before returning. Always false for the IDA GUI, which stays open." }, "idb_path": { "type": "string", "description": "Path of the saved database, for reopening it." } }, "required": [ "closed", "final_lease", "idb_path" ], "additionalProperties": false } } ] } }