ida_mcp

Execute arbitrary IDA Python code on the main thread.

List functions whose name matches a glob pattern (fnmatch).

Decompile the function at the given address or name using Hex-Rays.

Get disassembly starting at the given address or name.

Server and IDB health: uptime, paths, image base, analysis/hexrays status.

Warm up caches (analysis wait, hexrays init, counts) with per-step timing.

List running IDA MCP instances found via filesystem discovery.

Get discovery info for the instance on ``port`` (host/pid/binary/idb).

Stop the MCP server of the local instance on ``port``.

Get all cross-references TO the given address or symbol name. Returns a JSON array of ``{addr, type, function}`` objects. ``type`` is ``"code"`` or ``"data"``.

Query cross-references with direction and type filters. ``direction``: ``"to"`` (references TO address), ``"from"`` (references FROM address), or ``"both"``. ``xref_type``: ``"code"``, ``"data"``, or ``"any"``.

Get all functions called BY the function at the given address or name. Returns a JSON array of ``{addr, name, type}`` where ``type`` is ``"internal"`` or ``"external"``.

Get all functions that CALL the function at the given address or name. Uses ``CodeRefsTo`` filtered to call instructions only. Returns a JSON array of ``{addr, name}`` objects.

Read raw bytes at the given address and return as hex + ASCII dump. ``size`` defaults to 64 and is capped at 4096.

Read a null-terminated string at the given address. Returns a JSON object with ``addr`` and ``value`` (decoded UTF-8 string).

List all imported symbols with their module names. Supports glob-based filtering (e.g. ``"*Create*"``) with fnmatch. Pagination via ``offset`` / ``count`` (max 5000).

List all exported symbols with their addresses and ordinals. Supports glob filtering (e.g. ``"*Initialize*"``). Pagination via ``offset`` / ``count`` (max 5000).

Set a comment at the given address in both disassembly and decompiler views. **Unsafe** — requires ``?unsafe=true``.

Rename the function at the given address. **Unsafe** — requires ``?unsafe=true``.

Get detailed information about a function by address or name. Returns JSON with name, address, size, segment, callers/callee counts, prototype type info, and stack frame variables.

Convert a number to multiple formats (decimal, hex, bytes, binary, ASCII). ``text`` is parsed with auto-detected base (0x=hex, 0b=binary, else decimal). ``size`` is the byte width (auto-determined if 0).

Search for byte patterns with ``??`` wildcards (e.g. ``"48 8B ?? ??"``). Uses ``ida_bytes.find_bytes`` (the canonical IDA 9.x API) which accepts the hex string directly, supports ``??`` wildcards natively, and uses ``range_start`` / ``range_end`` semantics. Pagination via ``offset`` / ``limit`` (max…

List all strings in the binary with glob filtering and pagination. ``filter_pattern`` uses fnmatch (e.g. ``"*error*"``). Pagination via ``offset`` / ``count`` (max 5000).

Disassemble instructions starting at the given address or name. Returns a JSON array of ``{addr, instruction, label?}`` objects. Use ``count`` to limit the number of instructions (max 500).

Get basic blocks for a function with pagination. Returns a JSON array of ``{start, end, size, type, successors, predecessors}`` for each basic block in the function's control-flow graph.

Get the regular (non-repeatable) comment at the given address.

Delete the regular comment at the given address. Note: this is a write operation but does not require unsafe mode since it only affects annotations.

Get the repeatable comment at the given address.

Get all comments (regular and repeatable) in the binary. Returns up to 500 comment entries.

Get extra comments (anterior/before lines) at the given address.

Set the repeatable comment at the given address. **Unsafe** — requires ``?unsafe=true``.

Add an extra (multi-line anterior/posterior) comment line at an address. **Unsafe** — requires ``?unsafe=true``. ``position`` is ``"before"`` (anterior lines, shown above the item) or ``"after"`` (posterior lines). Appends a line; repeat calls to stack multiple lines.

Get all bookmarks in the binary.

Add a bookmark at the given address with an optional description. **Unsafe** — requires ``?unsafe=true``. Uses the first free slot (0-255).

Delete a bookmark by slot index or by address. **Unsafe** — requires ``?unsafe=true``. ``target`` accepts a slot number (``"3"``) or an address/symbol (the bookmark at that address is removed).

Compact single-function analysis: pseudocode (capped), strings, constants, callers, callees, xrefs, blocks.

Numeric profile of a function: sizes, counts, lists (no decompilation).

Analyze related functions as a group: per-function summaries, internal call graph, shared data.

Apply a rename/type/comment and immediately see before/after decompilation.

Follow xrefs from/to an address across multiple hops (BFS).

Build a bounded call graph from root functions.

Complete binary triage in one call — use as the FIRST tool when starting analysis.

Start the debugger session for the current target.

Return debugger lifecycle state and current IP if suspended.

Terminate the active debugger session.

Resume execution in the suspended debugger session.

Run the debuggee until the target address is reached (must be suspended).

Execute one instruction, stepping into calls (must be suspended).

Execute one instruction, stepping over calls (must be suspended).

List breakpoints with address, enabled status, condition and language.

Add soft breakpoints at comma-separated addresses/names.

Delete breakpoints at comma-separated addresses/names.

Enable/disable breakpoints in batch.

Set/clear breakpoint conditions in batch (ported from ida-pro-mcp).

Full register set for the current debugger thread (must be suspended).

General-purpose registers for the current thread (must be suspended).

Selected registers of the current thread (comma-separated names).

List debugger thread IDs and the current thread (must be suspended).

Current call stack with module and symbol context (must be suspended).

Read debuggee memory. ``regions``: JSON array of ``{\"addr\", \"size\"}``.

Write debuggee memory. ``regions``: JSON array of ``{\"addr\", \"data\"}`` (hex).

List all entry points (main, DllMain, TLS callbacks, exports, etc.) with ordinals and addresses. Returns a JSON array of ``{ordinal, addr, name}`` objects.

Get the number of entry points.

Get an entry point by its ordinal.

Get an entry point by its name.

Get the entry point at the given address.

Get all entry points that have forwarders.

Add a new entry point at the given address. ``ordinal``: set to 0 for auto-assignment. **Unsafe** — requires ``?unsafe=true``.

Rename an entry point by its ordinal. **Unsafe** — requires ``?unsafe=true``.

List functions with pagination support. ``offset``: starting position (0-based). ``count``: number of functions to return (max 1000). Returns JSON array of ``{addr, name, size}`` objects.

Get the total number of functions in the binary.

Get function start/end addresses and size. Returns JSON with ``start_ea``, ``end_ea``, and ``size``.

Get the C function signature/prototype (e.g., 'int __cdecl main(int argc, char **argv)'). Returns the signature string if type info is available.

Get function flags (thunk, library, noreturn, far, static, etc.).

Get the comment on a function.

Get the function type/prototype (alias for get_function_signature).

Get the size of a function in bytes.

Get the start address of the function containing the given address.

Get the end address of the function containing the given address.

Check if a function is a thunk function.

Check if a function is a library function.

Check if a function does not return.

Get the stack frame size of a function.

Get the arguments size of a function's stack frame.

Get local variables (stack and register) for a function. Returns names, types, offsets, and sizes.

Get register variables (regvars) for a function.

Get basic block count, edge count, and cyclomatic complexity for a function.

Get the number of instructions in a function.

Get all functions in an address range. ``start`` and ``end`` can be hex addresses or symbol names.

Get the next function after the given address.

Create/define a function at the given address. IDA infers bounds. **Unsafe** — requires ``?unsafe=true``.

Delete/undefine a function at the given address. **Unsafe** — requires ``?unsafe=true``.

Rename a function. **Unsafe** — requires ``?unsafe=true``.

Set a comment on a function. **Unsafe** — requires ``?unsafe=true``.

Get a Hex-Rays microcode summary for the function at an address.

Get the full control-flow graph (bounds + successors/predecessors + sizes).

Get basic blocks with their disassembled instructions.

Force Hex-Rays to discard cached pseudocode and recompile a function.

Install a built-in passive tracer hook (``idb``/``hexrays``/``debugger``).

Install the built-in Hex-Rays maturity tracer (logs decompilations).