mcpField
I
idamesh

idamesh

Local
github.com/JordanRO2Security8Updated 1w ago
Repository

About idamesh

idamesh is an MCP server for reverse engineers and security analysts working with IDA Pro. It exposes disassembly, decompilation, binary analysis, and editing tools, and can coordinate parallel work across database sessions.

Key features

  1. 01Disassembly and Hex-Rays decompilation
  2. 02Binary search and structured queries
  3. 03Security triage and dataflow analysis
  4. 04Rename, annotate, and patch binaries
  5. 05Parallel database sessions and edit merging

Use cases

  1. 01Inspect functions, types, and call graphs
  2. 02Triage binaries for vulnerabilities or crypto
  3. 03Have multiple agents analyze one binary
  4. 04Apply and merge annotations or patches

MCP support

idamesh exposes IDA Pro capabilities as MCP tools and read-only `ida://…` resources. It supports stdio workers and Streamable HTTP endpoints, including a supervisor for multiple database sessions.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "jordanro2-idamesh": {
      "command": "uvx",
      "args": [
        "idamesh"
      ],
      "env": {
        "IDADIR": "<IDADIR>"
      }
    }
  }
}
Run commanduvx idamesh
Environment variables to set
IDADIRPath to the licensed IDA Pro installation, used to locate idalib/idapro. Required if IDA's Python API is not already importable on PYTHONPATH.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypiidamesh1.0.0

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

idamesh

A Model Context Protocol (MCP) server for IDA Pro. It exposes IDA's disassembler and the Hex-Rays decompiler to MCP clients (Claude and others) as tools and resources, with a supervisor that fronts multiple databases behind one endpoint so several agents can work in parallel.

What it does

  • Read — decompile (Hex-Rays), disassemble, cross-references, call graphs, type and struct inspection, memory reads, and string / byte / text search.
  • Query — structured filters over functions, instructions, xrefs, types, imports.
  • Analyze — survey / triage, crypto and dangerous-API detection, vulnerability heuristics, stack-string reconstruction, and dataflow / taint tracing.
  • Mutate — rename, comment, retype, define code and data, edit stack frames, patch bytes / assembly, bookmarks, and annotation export / import.
  • Parallelize — open each database over a private copy so multiple agents can work the same binary at once, and merge their edits back into one database.

Read-only IDB state is also projected as ida://… MCP resources.

Requirements

  • Python 3.9+
  • A licensed IDA Pro install providing the idapro / idalib Python API. Point the IDADIR environment variable at your IDA installation directory.

Install

pip install idamesh

Or from a clone, for development:

pip install -e .[dev]     # editable install + pytest, to run the test suite

This provides the idamesh command with three subcommands: worker, supervisor, and install.

Usage

Headless worker — one database on stdio (the client launches it):

idamesh worker /path/to/target.exe

Supervisor — one HTTP endpoint fronting many databases:

idamesh supervisor                       # http://127.0.0.1:8745/mcp

Open and close databases behind it with the idb_open / idb_list / idb_close tools; route any tool to a session with an optional database key (omit it when a single database is open). Opening the same binary twice yields two independent sessions; idb_merge reconciles their edits.

GUI plugin — serve MCP over your live, open IDA database:

idamesh install     # deploy the plugin into IDA's user directory, then restart IDA

Run idamesh supervisor (or set IDAMESH_AUTOLAUNCH_SUPERVISOR=1 to have the plugin start one), then open a binary in IDA — the supervisor adopts the live session and routes to it.

Both the worker (--transport http) and the supervisor speak MCP Streamable HTTP at a single /mcp endpoint, loopback-bound with Origin validation.

Connect from Claude Code

claude mcp add --scope user --transport http idamesh http://127.0.0.1:8745/mcp

Or launch a single stdio worker directly:

claude mcp add --scope user -e IDADIR=/path/to/IDA-Pro \
  idamesh -- idamesh worker /path/to/target.exe

Tests

pip install -e .[dev]
python -m pytest -q

The live idalib end-to-end tests skip cleanly when IDA is unavailable (no IDADIR), so the suite is green without an IDA install.

License

MIT.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.