Agentic IDA with idalib

IDA Pro and Home are available to AI-driven workflows through idalib. If you are wondering how to use IDA with your agent of choice, this page covers the main approaches.

Approaches

MCP server

MCP servers let you bridge IDA with the large language models (LLMs) of your choice, for example Claude.

Hex-Rays does not currently ship an official MCP server, but a well-maintained community implementation is available.

Recommended community MCP server: mrexodia/ida-pro-mcp, with a setup guide and example prompts.

This server includes a mode that uses idalib to headlessly open and analyze files, returning disassembly, pseudocode, and cross-references to the agent.

Code mode

Rather than connecting an agent to a running IDA instance, you can let the agent generate and run idalib scripts on the fly. The agent writes a Python script, executes it against the binary, and reads the output.

To help the agent understand the Domain API, point it at the ida-domain llms.txt.

For a worked example, see Malware analysis with Claude Code and idalib.

Claude Code Skills

Hex-Rays provides a set of pre-built skills that teach Claude to work with idalib and the Domain API, e.g., inspecting binary files, writing analysis scripts, and more. See the Hex-Rays Marketplace.