> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/add-ons/assist/reference/requirements.md).

# Requirements & Support

This page covers Assist's platform baselines, decompiler prerequisites, emulation support and limits, and agent backend / provider requirements. For log files, `--diagnose`, and local file storage, see [Diagnostics & Data Storage](/add-ons/assist/reference/diagnostics.md).

## Platform support

* **IDA version & licensing:** Included with **IDA 9.4 SP1 or later** (IDA Home, IDA Pro; 64-bit) with no separate add-on license key. Decompiler-backed tools use your existing Hex-Rays decompiler license for the target architecture, and model turns use your own provider subscription, API key, or local model server.
* **Plugin manager (recommended):** [`hcli`](/add-ons/assist/reference/glossary.md#hcli) **0.25.0** or later (`hcli plugin install hexrays/assist`).

| OS          | Host architectures | Minimum runtime baseline                                                                      |
| ----------- | ------------------ | --------------------------------------------------------------------------------------------- |
| **macOS**   | `arm64`, `x86-64`  | 64-bit macOS supported by IDA 9.4 SP1 or later                                                |
| **Linux**   | `x86-64`, `arm64`  | `glibc 2.31` or newer (`GLIBCXX_3.4.28`, e.g., Ubuntu 20.04+, Debian 11+, RHEL/Rocky/Alma 9+) |
| **Windows** | `x86-64`, `arm64`  | 64-bit Windows supported by IDA 9.4 SP1 or later                                              |

Notes:

* **macOS codesigning:** The packaged macOS plugin binary is not codesigned; see [Getting Started → Installation](/add-ons/assist/getting-started.md#installation) for the one-line `codesign` command if macOS blocks it on first launch.
* **Updates:** Assist checks `hexrays.plugins.hex-rays.com` anonymously for new releases (configurable in **Settings → Preferences… → Updates** or `/update`) and upgrades are installed via `hcli plugin upgrade hexrays/assist`.
* **Unsupported IDA versions or batch mode:** Assist requires **IDA 9.4 SP1 or later** in GUI mode (it is not loaded under `idat` batch mode). On earlier IDA releases, `hcli` declines to install the package or IDA skips loading the plugin at startup (leaving **View → Assist** absent).

## Decompiler requirements

A **Hex-Rays decompiler license** for the target architecture is required for **18 agent tools** and several pseudocode UI actions:

### Agent tools requiring a decompiler (18)

* **Decompiler reads (5):** `decompile`, `get_microcode`, `get_ctree`, `get_ctree_calls`, `get_local_variables`
* **Local-variable editing & decompiler state (6):** `rename_lvar`, `set_lvar_type`, `set_lvar_comment`, `hide_lvar`, `remap_lvar_storage`, `reset_decompiler_information`
* **Type & prototype recovery (4):** `recover_struct_layout`, `recover_interface_layout`, `recover_multi_register_return`, `verify_prototype_convergence`
* **Dataflow & pattern analysis (3):** `register_lifetime_table`, `find_index_loops`, `filter_conditional_sites`

### UI features requiring a decompiler

* **Right-click selection actions (4):** *Rename all default names*, *Rename default variables*, *Repair prototypes*, and *Fix variable types*
* **Pseudocode navigation:** Double-click token navigation in Pseudocode views and `jump_to_address` when targeting a Pseudocode view

Assist still works for disassembly-level analysis, CFG/call-graph inspection, emulation, string extraction, and type declaration without a decompiler — but variable editing, struct recovery, and [prototype convergence](/add-ons/assist/reference/glossary.md#prototype-convergence) depend on it.

{% hint style="info" %}
Database queries, disassembly/xref/string/type inspection, and raw byte replacement (`patch_bytes`, `revert_patched_bytes`) are broadly processor-independent across IDA processor modules, whereas instruction-aware transformations have tool-specific architecture constraints (for example, `nop_range` handles supported ISA NOP encodings and otherwise falls back to `0x90`, so do not assume native multi-byte NOPs across every architecture such as ARM32).
{% endhint %}

## Tool and batch limits

* **Batched tool calls:** Many batch read and edit tools cap each call at **256** targets (`addresses`, `items`, `functions`, `names`, etc.) and return per-item status receipts, though some tools define their own bounds (for example, `apply_to_validated_sites` defaults `max_sites` to `256` and accepts `1`–`512`).
* **Prototype convergence caller budget & permission:** `verify_prototype_convergence` dry-runs a candidate prototype against the target function and up to **64** direct callers. Because it temporarily applies the candidate prototype in IDA to re-decompile and compare callers before restoring the original type, it requires **Modify this IDA database** even when `dry_run: true`.

## Emulation support

See [Emulation](/add-ons/assist/concepts/emulation.md) for how CPU micro-emulation and whole-process emulation work.

* **CPU & function micro-emulation** — supports **x86-32**, **x86-64**, **ARM64 (AArch64)**, and **ARM32 (AArch32)**; all other CPU architectures are refused by name:
  * **Stateless runs:** `emulate`, `emulate_function`, `extract_strings`, `resolve_indirect_branches`, `emulate_recover_mmio`
  * **Stateful CPU sessions:** `emulate_start`, `emulate_step`, `emulate_run_until`, `emulate_watch`, `emulate_explore_branches`, `emulate_get_state`, `emulate_end`
  * **Session guest-state setup & inspection:** `emulate_set_register`, `emulate_read_memory`, `emulate_write_memory`, `emulate_map_memory`, `emulate_regions`, `emulate_translate`, `emulate_read_virtual`, `emulate_write_virtual`, `emulate_inject_interrupt`
  * **Session checkpoints, restore, fork & diff:** use `emulate_checkpoint` to save the current session state and return a saved-state ID (`emulate_snapshot` is a variant that performs the same save operation and additionally reports session snapshot usage); `emulate_restore` rewinds the current session to a saved state, `emulate_diff` compares register and memory deltas between any two saved states, and `emulate_fork` clones the live session and returns a new session ID.
* **Whole-process emulation (`emulate_process`):** runs user-mode **Windows PE** (`x86`, `x64`, `ARM64`; default `options.personality: "windows"`), **Linux ELF** (`x86-64`, `i386`, `AArch64`, `AArch32 EABI`, `RV64`; `options.personality: "linux"`), and **Darwin Mach-O** (`x86-64`, `AArch64`; `options.personality: "darwin"`) guest processes, with optional host runtime loading (`options.native_runtime: true`, requiring **Read files outside the project**).
* **Disabling the emulator:** See [`ASSIST_RAX_DISABLE` in Diagnostics & Data Storage → Environment variables](/add-ons/assist/reference/diagnostics.md#environment-variables).

### CPU emulation capability matrix

| Capability                                                                                                                        | x86-32                                         | x86-64                                         | ARM64 (AArch64)               | ARM32 (AArch32)                              |
| --------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | ---------------------------------------------- | ----------------------------- | -------------------------------------------- |
| Concrete execution (`emulate`, `emulate_start`)                                                                                   | ✅ Full                                         | ✅ Full                                         | ✅ Full                        | Run-to-exit (`system`) / Step & run (`user`) |
| Function emulation (`emulate_function`)                                                                                           | ✅                                              | ✅                                              | ✅                             | ❌                                            |
| Single-step & instruction tracing (`emulate_step`)                                                                                | ✅                                              | ✅                                              | ✅                             | `execution_mode: "user"` only                |
| Memory read/write recording & watchpoints (`emulate_watch`)                                                                       | ✅                                              | ✅                                              | `execution_mode: "user"` only | `execution_mode: "user"` only                |
| Stack-string extraction (`extract_strings`)                                                                                       | ✅                                              | ✅                                              | `execution_mode: "user"` only | `execution_mode: "user"` only                |
| Indirect-branch resolution (`resolve_indirect_branches`)                                                                          | ✅                                              | ✅                                              | ✅                             | ❌                                            |
| Branch exploration (`emulate_explore_branches`)                                                                                   | ❌                                              | ✅ Conditional + indirect                       | ✅ `B.cond` / `BR` / `BLR`     | ❌                                            |
| [Taint tracking](/add-ons/assist/reference/glossary.md#taint-tracking) (taint options)                                            | ✅ Supported (inspect approximation indicators) | ✅ Supported (inspect approximation indicators) | ⚠️ Approximate                | ❌                                            |
| [Symbolic execution](/add-ons/assist/reference/glossary.md#symbolic-execution) (symbolic mode)                                    | ✅                                              | ✅                                              | ✅                             | ❌                                            |
| Built-in C runtime import models (87 functions)                                                                                   | ✅ (`cdecl`)                                    | ✅ (SysV / Win64)                               | ✅ (AAPCS64)                   | ❌ (use `call_stubs`)                         |
| Checkpoints, snapshots, fork & diff (`emulate_checkpoint`, `emulate_restore`, `emulate_snapshot`, `emulate_fork`, `emulate_diff`) | ✅                                              | ✅                                              | ✅                             | ✅                                            |
| Port-IO / MMIO recovery (`emulate_recover_mmio`)                                                                                  | ✅ Hooked                                       | ✅ Port-IO + MMIO hook                          | ✅ MMIO hook                   | ✅ MMIO hook                                  |

### Modelled C and runtime functions

When `runtime_models: "known"` (the default on x86-32, x86-64, and AArch64; pass `"off"` to disable), the CPU emulator intercepts and models **87** common C and runtime functions against a synthetic guest heap (bounded by the session's mapped-memory budget) and a `64 KiB` stdio capture buffer:

* **Heap & memory (17):** `malloc`, `calloc`, `realloc`, `free`, `strdup`, `_strdup`, `strndup`, `memcpy`, `memmove`, `memset`, `__memcpy_chk`, `__memmove_chk`, `__memset_chk`, `bzero`, `explicit_bzero`, `memcmp`, `memchr`
* **Strings & wide strings (21):** `strlen`, `strnlen`, `wcslen`, `strcmp`, `strncmp`, `strcasecmp`, `strncasecmp`, `_stricmp`, `_strnicmp`, `strcpy`, `stpcpy`, `strncpy`, `strcat`, `strncat`, `__strcpy_chk`, `__strncpy_chk`, `__strcat_chk`, `__strncat_chk`, `strchr`, `strrchr`, `strstr`
* **Conversions & math (12):** `toupper`, `tolower`, `abs`, `labs`, `llabs`, `atoi`, `atol`, `atoll`, `strtol`, `strtoul`, `strtoll`, `strtoull`
* **Formatted output & stdio (18):** `puts`, `putchar`, `fputs`, `fputc`, `putc`, `fwrite`, `printf`, `fprintf`, `sprintf`, `snprintf`, `__sprintf_chk`, `__snprintf_chk`, `_acrt_iob_func`, `__acrt_iob_func`, `_stdio_common_vfprintf`, `__stdio_common_vfprintf`, `_stdio_common_vsprintf`, `__stdio_common_vsprintf`
* **Environment, time, PRNG & lifecycle (19):** `getenv`, `time`, `rand` (deterministic seeded PRNG), `srand`, `atexit`, `__cxa_atexit`, `crt_atexit`, `_crt_atexit`, `_onexit`, `onexit`, `exit`, `_exit`, `_Exit`, `abort`, `__stack_chk_fail`, `__assert_fail`, `__assert_rtn`, `_assert`, `__fortify_fail`

### Emulation resource limits

Emulation limits are defensive defaults designed to keep IDA responsive; specific values may change between releases:

| Limit                     | CPU sessions (`emulate*`)                                            | Process sessions (`emulate_process`)                         |
| ------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------ |
| Concurrent sessions       | **16** (a 17th evicts the oldest non-pinned session)                 | **4** (a 5th is refused until an existing session is closed) |
| Checkpoints / snapshots   | **32** per session (`64 MiB` per snapshot, `256 MiB` total)          | N/A                                                          |
| Guest memory              | **64 MiB** default, **256 MiB** maximum                              | **128 MiB** default, **8 MiB** minimum, **256 MiB** maximum  |
| Trace & access records    | **100,000** instruction or memory records (**16,384** MMIO records)  | **1 MiB** console buffer default (**16 MiB** maximum)        |
| Instruction / turn budget | **500,000** max with hooks/trace/watch armed; **5,000,000** unhooked | **10,000** turns default, **1,000,000** maximum              |
| Wall-clock timeout        | **5 s** default, **600 s** maximum                                   | **5 s** default, **60 s** maximum                            |

## Agent backend requirements

For the feature comparison across agent backends, see [Getting Started → Choosing an agent](/add-ons/assist/getting-started.md#choose-and-configure-a-model).

* **ChatGPT account:** Binds a temporary local OAuth callback listener on `127.0.0.1:1455` (falling back to `1457`), or accepts a pasted redirect URL if you complete sign-in in a browser on another machine. Supports **Effort**, **Speed** (`Standard` / `Fast`), and **Context** (`Automatic` working notes / `Summaries`).
* **Grok:** Binds a temporary local OAuth callback listener on `127.0.0.1` using an OS-assigned ephemeral port.
* **Claude Code:** Requires the `claude` CLI (**2.1.261** or later) installed, signed in, and on `PATH` (or configured via custom path in **Settings → Preferences… → Agent**).
* **Antigravity CLI:** Requires the `agy` CLI (**1.3.1** or later) installed, signed in, and on `PATH` (or configured via custom path in **Settings → Preferences… → Agent**). Effort is selected via model variant (`-low` / `-high`).
* **API key or OpenAI-compatible endpoint:** Connects over HTTPS/HTTP to any of the 170+ built-in presets or any custom OpenAI-compatible base URL (`<base>/chat/completions`), discovering models and context windows from `<base>/models` and a bundled endpoint/model reference snapshot; API keys are stored in the OS credential store. When a model's context window cannot be discovered automatically, a configurable **Context** token limit (default `131,072`) is shown. Because the compatible path drives Assist's agent loop over Chat Completions, the target endpoint and model must support tool calling and streaming (an endpoint may list a model via `<base>/models` that still fails during a turn if it does not support tool calls).
* **OpenCode:** Requires the `opencode` CLI (`opencode acp`) installed and on `PATH`.

### OpenAI-compatible provider presets

The **API key or OpenAI-compatible endpoint** backend includes more than **170 built-in presets across 130+ providers** (presets configure endpoint URLs and authentication formats; they do not guarantee that every listed model, plan, region, modality, context window, or provider-specific feature is supported on your account), organized into four groups:

* **Model providers** — OpenAI, Anthropic (with optional Workspace ID), Google Gemini, xAI, DeepSeek, Mistral, Groq, Together AI, Fireworks, Cohere, Cerebras, DeepInfra, NVIDIA, Hugging Face, Baseten, Nebius, Venice AI, Azure OpenAI, Amazon Bedrock (Runtime & Mantle), Cloudflare Workers AI, Databricks, Snowflake Cortex, OCI Generative AI, Alibaba Cloud, Moonshot / Kimi, MiniMax, Z.ai, StepFun, SiliconFlow, Volcengine / Doubao, Xiaomi MiMo, and more. Providers with multiple plans or regional endpoints expose **Plan** and **Region** selectors automatically.
* **Gateways** — OpenRouter, Vercel AI Gateway, Helicone, Poe, Requesty, Kilo AI Gateway, Merge Gateway, DevPass LLM Gateway, ZenMux, OpenCode (Zen and Go / Go Plus), AIHubMix, Eden AI, 302.AI, FastRouter, NanoGPT, and more.
* **Local servers** — **Ollama** (`http://localhost:11434/v1`), **LM Studio** (`http://127.0.0.1:1234/v1`), **LiteLLM Proxy** (`http://localhost:4000/v1`), **Bifrost** (`http://localhost:8080/openai`), and **Lynkr** (`http://127.0.0.1:8081/v1`).
* **Custom endpoint...** — Any custom HTTP or HTTPS OpenAI-compatible server (such as vLLM, `llama.cpp`, SGLang, or an internal enterprise gateway) with configurable authentication (**Bearer token**, **api-key header**, **x-api-key header**, **Bifrost virtual key**, or **No authentication**) and multiple named API keys per endpoint.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.hex-rays.com/add-ons/assist/reference/requirements.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.