idamesh

io.github.JordanRO2Published by GitHub account JordanRO2v1.0.0Updated Oct 24, 2026

MCP server for IDA Pro: decompiler, disassembler, and analysis tools for MCP clients.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

MCP server for IDA Pro that lets an assistant decompile, disassemble, query, analyze and annotate binaries through Hex-Rays and IDA's APIs.

What you can do
  • Decompile with Hex-Rays, disassemble, follow cross-references, inspect call graphs, types, structs and memory, and search strings, bytes or text
  • Run structured filters over functions, instructions, xrefs, types and imports
  • Survey and triage binaries, detect crypto and dangerous APIs, apply vulnerability heuristics, reconstruct stack strings, and trace dataflow or taint
  • Rename, comment, retype, define code and data, edit stack frames, patch bytes or assembly, manage bookmarks, and export or import annotations
  • Open, list, close and merge databases behind a supervisor so several agents can work on private copies in parallel
  • Read-only database state is also exposed as ida:// resources
When to use it
Use it when reverse engineering or auditing binaries and you want an assistant to read, query and annotate IDA Pro databases directly, including parallel multi-agent analysis of the same binary.
Requirements
Runs locally as a Python package (3.9+) via uvx or pip, on desktop only. Needs a licensed IDA Pro install providing the idapro/idalib Python API, located through the IDADIR environment variable unless that API is already importable. The supervisor serves Streamable HTTP on a loopback port; the worker runs over stdio.
Before you install
Mutating tools rename, retype, patch bytes and assembly, and edit stack frames, so changes can alter the analyzed database; parallel sessions work on private copies and must be reconciled with idb_merge. The GUI plugin install subcommand deploys files into IDA's user directory. A licensed IDA Pro installation is required.

Installation

In SourceWeft

  1. Open idamesh in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

idamesh

A Model Context Protocol (MCP) server for IDA Pro. It exposes IDA's disassembler and the Hex-Rays decompiler to MCP clients (Claude and others) as tools and resources, with a supervisor that fronts multiple databases behind one endpoint so several agents can work in parallel.

What it does

  • Read — decompile (Hex-Rays), disassemble, cross-references, call graphs, type and struct inspection, memory reads, and string / byte / text search.
  • Query — structured filters over functions, instructions, xrefs, types, imports.
  • Analyze — survey / triage, crypto and dangerous-API detection, vulnerability heuristics, stack-string reconstruction, and dataflow / taint tracing.
  • Mutate — rename, comment, retype, define code and data, edit stack frames, patch bytes / assembly, bookmarks, and annotation export / import.
  • Parallelize — open each database over a private copy so multiple agents can work the same binary at once, and merge their edits back into one database.

Read-only IDB state is also projected as ida://… MCP resources.

Requirements

  • Python 3.9+
  • A licensed IDA Pro install providing the idapro / idalib Python API. Point the IDADIR environment variable at your IDA installation directory.

Install

bash
pip install idamesh

Or from a clone, for development:

bash
pip install -e .[dev]     # editable install + pytest, to run the test suite

This provides the idamesh command with three subcommands: worker, supervisor, and install.

Usage

Headless worker — one database on stdio (the client launches it):

bash
idamesh worker /path/to/target.exe

Supervisor — one HTTP endpoint fronting many databases:

bash
idamesh supervisor                       # http://127.0.0.1:8745/mcp

Open and close databases behind it with the idb_open / idb_list / idb_close tools; route any tool to a session with an optional database key (omit it when a single database is open). Opening the same binary twice yields two independent sessions; idb_merge reconciles their edits.

GUI plugin — serve MCP over your live, open IDA database:

bash
idamesh install     # deploy the plugin into IDA's user directory, then restart IDA

Run idamesh supervisor (or set IDAMESH_AUTOLAUNCH_SUPERVISOR=1 to have the plugin start one), then open a binary in IDA — the supervisor adopts the live session and routes to it.

Both the worker (--transport http) and the supervisor speak MCP Streamable HTTP at a single /mcp endpoint, loopback-bound with Origin validation.

Connect from Claude Code

bash
claude mcp add --scope user --transport http idamesh http://127.0.0.1:8745/mcp

Or launch a single stdio worker directly:

bash
claude mcp add --scope user -e IDADIR=/path/to/IDA-Pro \  idamesh -- idamesh worker /path/to/target.exe

Tests

bash
pip install -e .[dev]python -m pytest -q

The live idalib end-to-end tests skip cleanly when IDA is unavailable (no IDADIR), so the suite is green without an IDA install.

License

MIT.

Source: README.md at commit 46958e8

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts