IDA Pro becomes a named MCP analysis service
IDA Pro MCP exposes decompilation, disassembly, functions, imports, cross-references, types, memory, stack frames, searches, and graphs to an MCP client. It also lets an agent rename symbols, add comments, declare types, define code, patch bytes, and save databases. The newer idalib service can open several binaries as named sessions, while the GUI bridge connects to an interactive IDA process. That combination can remove repetitive navigation from reverse engineering without replacing the analyst who judges the result.
The repository is substantial enough to deserve normal service discipline. Our checkout contained 211 files, about 35,032 source lines, and measured 6 MB. Most calls use structured parameters, batch-oriented results, pagination, and explicit database session IDs. The explicit ID is a good safeguard when several binaries are open because there is no ambient current database. It does not prevent an agent from choosing the wrong session, so prompts and approval logs still need to name the sample and expected operation.
A paid IDA installation is the first dependency
Python 3.11 or newer and uv are only the beginning. The README requires IDA Pro 8.3 or newer, recommends version 9, and says IDA Free is unsupported. Headless operation also needs idalib activated globally with the script shipped inside the IDA installation. GUI installation must be followed by a complete restart of IDA and the MCP client; desktop clients that remain in the system tray must actually be quit.
Client setup has ready-made paths for Claude Code, Codex, and Kimi Code, plus generated configuration for other MCP clients. The README says the older GUI MCP plugin is no longer recommended and will eventually be deprecated in favor of idalib-mcp. Our 53 MB installed Python environment therefore understates the real price: a licensed analysis suite, its supported Python bridge, an agent client, a model account or local model, and enough isolation for untrusted binaries all sit outside those 35 packages.
What happened when we ran it
Our fresh unprivileged Debian sandbox installed commit 3349ae3 in 22 seconds. It added 35 Python packages and occupied 53 MB on disk. The build completed in 8 seconds, and pip-audit reported 0 known vulnerabilities. The repository had 1 CI workflow file, no Dockerfile, and a tests directory. No licensed IDA installation or idalib activation was available in this sandbox, so the meaningful evidence comes from the package, build, and test logs we were given.
Pytest exited with code 1 after 13 seconds. It reported 136 passed, 0 failed, and 29 collection or setup errors out of 165. The log tail listed errors in server, tool metadata, trace, typed fixture, utility, MCP schema, endpoint, HTTP end-to-end, tools-list, and truncation modules. Those lines do not identify why setup failed, so blaming missing IDA libraries or a system package would be speculation. The honest result is a partially exercised suite that did not complete in our stated environment.
Write tools make a disposable database the safe default
This server is not read-only. An agent can rename identifiers, change function and variable types, create or delete stack variables, define and undefine code, assemble patches, write raw bytes, add comments, and save the database. The py_eval tool can run arbitrary Python inside IDA. Debugger operations are hidden unless the connection enables the dbg extension, but once enabled they can start execution, set breakpoints, and write memory. Those capabilities are useful precisely because they carry side effects.
Start with copies of the binary and database, bind HTTP transports to localhost, and expose only the tools needed for one task. The 136 passing tests show that much of the suite ran, while the 29 setup errors prevent treating every boundary as checked. An agent's rename can look plausible and still poison later analysis. Save checkpoints, compare database changes, and require human review before patches or debugger writes become part of a report.
The README warns that models misread hard binaries
The prompting guidance tells users to verify decompilation, improve types and names, consult assembly when needed, and use a conversion tool instead of trusting the model to translate integer and byte representations. It also says models perform poorly on obfuscated code and recommends removing string encryption, import hashing, flattened control flow, encrypted code, and anti-decompilation tricks before expecting good results. That is a candid limit, not a minor tuning note.
Current issues give concrete examples of machine-readable output going wrong. Issue 506 says the callgraph tool labels non-fallthrough jumps as calls, so a loop can appear as self-recursion; pull request 507 proposes a fix. Issue 510 reports that 64-bit values outside JavaScript's safe integer range can become BigInt values and crash clients when re-serialized. These bugs affect exactly the structured facts an agent may trust. Cross-check graphs and large numeric values against IDA itself until fixes reach the installed revision.
Headless workers persist after the supervisor exits
The idalib supervisor gives each database its own worker process. Workers register in a host-local discovery directory, can be adopted by later supervisors, and outlive the process that created them. The default limit is 4 workers and the idle timeout is 1 hour; idb_close can release one earlier. This supports long analyses and client restarts, but operators must expect lingering processes, locked databases, and saved state after the visible MCP session ends.
Issue 497 reports a Windows race where a live GUI registration file can be deleted after one failed probe, preventing later discovery and adoption even though the process still answers directly. GitHub showed 11,615 stars, 45 combined open issues and pull requests, and a last push on August 17, 2026. The latest tagged release was 1.4.0 from October 2025, while source activity continued well beyond it. Pin the commit or plugin revision, confirm update behavior, and rerun the suite in the licensed IDA environment before depending on headless workers.