ida-pro-mcp MCP — ユースケース, インストール & ライブデモ

なぜ使うのか

主な機能

Full decompilation and disassembly access from AI assistants
Symbol management: rename functions/variables, declare types, set comments
Pattern search: find bytes, instructions, regex across the binary
Complete debugger control: breakpoints, stepping, register/memory access
Headless analysis support via SSE transport and idalib

ライブデモ

実際の動作

ida-pro-mcp.replay ▶ 準備完了

0/0

インストール

クライアントを選択

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

Claude Desktop → Settings → Developer → Edit Config を開く。保存後、アプリを再起動。

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

Cursor は Claude Desktop と同じ mcpServers スキーマを使用。プロジェクト設定はグローバルより優先。

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

Cline サイドバーの MCP Servers アイコンをクリックし、"Edit Configuration" を選択。

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

Claude Desktop と同じ形式。Windsurf を再起動して反映。

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "ida-pro-mcp",
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  ]
}

Continue はマップではなくサーバーオブジェクトの配列を使用。

~/.config/zed/settings.json

{
  "context_servers": {
    "ida-pro-mcp": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/mrexodia/ida-pro-mcp"
        ]
      }
    }
  }
}

context_servers に追加。保存時に Zed がホットリロード。

claude mcp add ida-pro-mcp -- TODO 'See README: https://github.com/mrexodia/ida-pro-mcp'

ワンライナー。claude mcp list で確認、claude mcp remove で削除。

ユースケース

実用的な使い方： ida-pro-mcp

How to reverse engineer a binary with AI assistance in IDA Pro

👤 Reverse engineers and security researchers analyzing binaries they own or have authorization to test ⏱ ~60 min advanced

使うタイミング： You have a binary loaded in IDA Pro and want AI to help understand and annotate it.

前提条件

IDA Pro 8.3+ (not IDA Free) — Commercial license from Hex-Rays
ida-pro-mcp installed — pip install <repo-url> && ida-pro-mcp --install

フロー

Get an overview

List all functions in this binary. Which ones look like they handle network communication based on their names and imports?✓ コピーしました

→ Categorized function list with network-related functions highlighted
Decompile key functions

Decompile the main network handler function. Explain the protocol it implements and rename variables to be descriptive.✓ コピーしました

→ Decompiled C code with renamed variables and protocol analysis
Trace data flow

Find all cross-references to the encryption key buffer. Who reads it and who writes it?✓ コピーしました

→ Xref chain showing data flow from key generation to encryption calls

結果： A well-annotated IDB with key functions understood, renamed, and documented.

注意点

Decompilation can be slow on large functions — Start with smaller callees and work up. Use disasm() for quick overviews.

組み合わせ： filesystem

Solve a CTF reverse engineering challenge using IDA Pro and AI

👤 CTF participants working on binary reversing challenges ⏱ ~45 min intermediate

使うタイミング： You have a CTF binary that needs static and/or dynamic analysis to find the flag.

前提条件

IDA Pro with ida-pro-mcp — Install and connect

フロー

Find the validation logic

Search for strings containing 'flag', 'correct', 'wrong'. Decompile the functions that reference them.✓ コピーしました

→ Validation function with flag-checking logic
Debug to extract the flag

Set a breakpoint at the comparison. Run the binary with input 'AAAA' and show me what it compares against.✓ コピーしました

→ Expected flag value visible in registers or memory

結果： Flag extracted through combined static and dynamic analysis.

注意点

Anti-debug tricks prevent breakpoint hits — Use find_insns to locate anti-debug checks and patch them with patch_asm

組み合わせ

他のMCPと組み合わせて10倍の力を

ida-pro-mcp + filesystem

Export decompiled code and analysis notes to files

Decompile all functions related to the crypto module and save the annotated code to ~/analysis/crypto.c.✓ コピーしました

ツール

このMCPが提供する機能

ツール	入力	呼び出すタイミング
decompile	address_or_name: str	Decompile a function to C pseudocode
disasm	address: str, count?: int	Disassemble instructions at an address
rename	old_name: str, new_name: str	Rename a function or variable
xrefs_to	address: str	Find all cross-references to an address
find_bytes	pattern: str	Search for a byte pattern in the binary
patch_asm	address: str, asm: str	Patch assembly instructions at an address
dbg_run	none	Start the debugger
set_comments	address: str, comment: str	Add a comment at an address

コストと制限

運用コスト

APIクォータ: N/A — local IDA Pro instance
呼び出しあたりのトークン: 200–3000 tokens (decompilation output can be large)
金額: Requires IDA Pro commercial license ($). The MCP plugin itself is free.
ヒント: Use list_funcs to identify targets before decompiling to avoid decompiling every function.

セキュリティ

権限、シークレット、影響範囲

認証情報の保管： N/A — local tool

データ送信先： All analysis is local. No network calls from the MCP server.

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
Patching binaries modifies the IDB. Use IDA's snapshot feature before making changes.
Debugger operations execute the target binary — only debug in sandboxed environments.

トラブルシューティング

よくあるエラーと対処法

ida-pro-mcp --install fails

Ensure Python 3.11+ and IDA Pro 8.3+ are installed. The installer needs to find IDA's plugin directory.

確認： python3 --version && which idat

Decompilation fails

Not all functions decompile cleanly (obfuscation, hand-written assembly). Try disasm() as a fallback.

確認： Try decompiling a simpler function first

Debugger won't start

Ensure IDA's debugger is configured for the target platform (local, remote, etc.). Check that the binary is not already running.

確認： Check IDA's debugger settings

代替案

ida-pro-mcp 他との比較

代替案	代わりに使う場面	トレードオフ
GhidrAssistMCP	You prefer free Ghidra over commercial IDA Pro	Ghidra is free but IDA Pro generally has faster analysis and wider format support
reverse-engineering-assistant	You want a Ghidra MCP with a tool-driven approach optimized for LLMs	Fewer tools but better context management for AI interaction

その他

リソース

📖 GitHub の公式 README を読む

🐙 オープンな issue を見る

🔍 400以上のMCPサーバーとSkillsを見る