ida-pro-mcp MCP — 使用場景, 安裝 & 即時演示

為什麼要用

核心特性

Full decompilation and disassembly access from AI assistants
Symbol management: rename functions/variables, declare types, set comments
Pattern search: find bytes, instructions, regex across the binary
Complete debugger control: breakpoints, stepping, register/memory access
Headless analysis support via SSE transport and idalib

即時演示

實際使用效果

ida-pro-mcp.replay ▶ 就緒

0/0

安裝

選擇你的客戶端

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

開啟 Claude Desktop → Settings → Developer → Edit Config。儲存後重啟應用。

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

Cursor 使用與 Claude Desktop 相同的 mcpServers 格式。專案級設定優先於全域。

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

點擊 Cline 側欄中的 MCP Servers 圖示，然後選 "Edit Configuration"。

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "ida-pro-mcp": {
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  }
}

格式與 Claude Desktop 相同。重啟 Windsurf 生效。

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "ida-pro-mcp",
      "command": "TODO",
      "args": [
        "See README: https://github.com/mrexodia/ida-pro-mcp"
      ]
    }
  ]
}

Continue 使用伺服器物件陣列，而非映射。

~/.config/zed/settings.json

{
  "context_servers": {
    "ida-pro-mcp": {
      "command": {
        "path": "TODO",
        "args": [
          "See README: https://github.com/mrexodia/ida-pro-mcp"
        ]
      }
    }
  }
}

加入 context_servers。Zed 儲存後熱重載。

claude mcp add ida-pro-mcp -- TODO 'See README: https://github.com/mrexodia/ida-pro-mcp'

一行命令搞定。用 claude mcp list 驗證，claude mcp remove 移除。

使用場景

實戰用法： ida-pro-mcp

How to reverse engineer a binary with AI assistance in IDA Pro

👤 Reverse engineers and security researchers analyzing binaries they own or have authorization to test ⏱ ~60 min advanced

何時使用： You have a binary loaded in IDA Pro and want AI to help understand and annotate it.

前置條件

IDA Pro 8.3+ (not IDA Free) — Commercial license from Hex-Rays
ida-pro-mcp installed — pip install <repo-url> && ida-pro-mcp --install

步驟

Get an overview

List all functions in this binary. Which ones look like they handle network communication based on their names and imports?✓ 已複製

→ Categorized function list with network-related functions highlighted
Decompile key functions

Decompile the main network handler function. Explain the protocol it implements and rename variables to be descriptive.✓ 已複製

→ Decompiled C code with renamed variables and protocol analysis
Trace data flow

Find all cross-references to the encryption key buffer. Who reads it and who writes it?✓ 已複製

→ Xref chain showing data flow from key generation to encryption calls

結果： A well-annotated IDB with key functions understood, renamed, and documented.

注意事項

Decompilation can be slow on large functions — Start with smaller callees and work up. Use disasm() for quick overviews.

搭配使用： filesystem

Solve a CTF reverse engineering challenge using IDA Pro and AI

👤 CTF participants working on binary reversing challenges ⏱ ~45 min intermediate

何時使用： You have a CTF binary that needs static and/or dynamic analysis to find the flag.

前置條件

IDA Pro with ida-pro-mcp — Install and connect

步驟

Find the validation logic

Search for strings containing 'flag', 'correct', 'wrong'. Decompile the functions that reference them.✓ 已複製

→ Validation function with flag-checking logic
Debug to extract the flag

Set a breakpoint at the comparison. Run the binary with input 'AAAA' and show me what it compares against.✓ 已複製

→ Expected flag value visible in registers or memory

結果： Flag extracted through combined static and dynamic analysis.

注意事項

Anti-debug tricks prevent breakpoint hits — Use find_insns to locate anti-debug checks and patch them with patch_asm

組合

與其他 MCP 搭配，撬動十倍槓桿

ida-pro-mcp + filesystem

Export decompiled code and analysis notes to files

Decompile all functions related to the crypto module and save the annotated code to ~/analysis/crypto.c.✓ 已複製

工具

此 MCP 暴露的能力

工具	輸入參數	何時呼叫
decompile	address_or_name: str	Decompile a function to C pseudocode
disasm	address: str, count?: int	Disassemble instructions at an address
rename	old_name: str, new_name: str	Rename a function or variable
xrefs_to	address: str	Find all cross-references to an address
find_bytes	pattern: str	Search for a byte pattern in the binary
patch_asm	address: str, asm: str	Patch assembly instructions at an address
dbg_run	none	Start the debugger
set_comments	address: str, comment: str	Add a comment at an address

成本與限制

運行它的成本

API 配額: N/A — local IDA Pro instance
每次呼叫 Token 數: 200–3000 tokens (decompilation output can be large)
費用: Requires IDA Pro commercial license ($). The MCP plugin itself is free.
提示: Use list_funcs to identify targets before decompiling to avoid decompiling every function.

安全

權限、密鑰、影響範圍

憑證儲存： N/A — local tool

資料出站： All analysis is local. No network calls from the MCP server.

⚠ This tool is designed for authorized security research, CTF competitions, and defensive analysis only. Do not use it against systems you don't own or have written authorization to test.
Patching binaries modifies the IDB. Use IDA's snapshot feature before making changes.
Debugger operations execute the target binary — only debug in sandboxed environments.

故障排查

常見錯誤與修復

ida-pro-mcp --install fails

Ensure Python 3.11+ and IDA Pro 8.3+ are installed. The installer needs to find IDA's plugin directory.

驗證： python3 --version && which idat

Decompilation fails

Not all functions decompile cleanly (obfuscation, hand-written assembly). Try disasm() as a fallback.

驗證： Try decompiling a simpler function first

Debugger won't start

Ensure IDA's debugger is configured for the target platform (local, remote, etc.). Check that the binary is not already running.

驗證： Check IDA's debugger settings

替代方案

ida-pro-mcp 對比其他方案

替代方案	何時用它替代	權衡
GhidrAssistMCP	You prefer free Ghidra over commercial IDA Pro	Ghidra is free but IDA Pro generally has faster analysis and wider format support
reverse-engineering-assistant	You want a Ghidra MCP with a tool-driven approach optimized for LLMs	Fewer tools but better context management for AI interaction

ida-pro-mcp

為什麼要用

核心特性

即時演示

實際使用效果

安裝

選擇你的客戶端

使用場景

實戰用法： ida-pro-mcp

How to reverse engineer a binary with AI assistance in IDA Pro

前置條件

步驟

注意事項

Solve a CTF reverse engineering challenge using IDA Pro and AI

前置條件

步驟

注意事項

組合

與其他 MCP 搭配，撬動十倍槓桿

工具

此 MCP 暴露的能力

成本與限制

運行它的成本

安全

權限、密鑰、影響範圍

故障排查

常見錯誤與修復

替代方案

ida-pro-mcp 對比其他方案

更多

資源