merozemory/ida-multi-mcp

IDA-多MCP

通过单一MCP端点同时逆向工程多个二进制文件——dropper、payload、C2。 每个配备插件的 IDA Pro 数据库在打开时自动注册 ·无头 Idalib 会话 ·跨二进制的局部、抗剥离功能相似性。

安装· 行动中· 为什么 · 上游 · 建筑 · 工具 · 文档

---

一个提示下安装

**让你的AI代理安装它。**复制粘贴其中一个——它匹配IDA的Python版本，插入插件，并向你的客户端注册MCP服务器。

克劳德代码 / 法典：

按照此处的说明安装和配置ida-multi-mcp： https://raw.githubusercontent.com/MeroZemory/ida-multi-mcp/main/docs/installation.md

光标：

@Web取 https://raw.githubusercontent.com/MeroZemory/ida-multi-mcp/main/docs/installation.md 并按照安装步骤操作。

然后在IDA Pro中打开你的二进制文件——实例会自动注册——并与你的代理沟通。 更喜欢手动安装？参见“手动安装”。再次拆卸需要在“故障排查”里。

---

看它实际行动

两个二进制文件在两个IDA窗口中打开。一个MCP端点。

ida-multi-mcp

Reverse-engineer several binaries at once — dropper, payload, C2 — through a single MCP endpoint. Each plugin-equipped IDA Pro database auto-registers when opened · headless idalib sessions · local, stripping-resistant function similarity across binaries.

Install · In action · Why · Upstream · Architecture · Tools · Docs

---

Install in one prompt

Ask your AI agent to install it. Copy-paste one of these — it matches IDA’s Python version, drops the plugin in place, and registers the MCP server with your client.

Claude Code / Codex:

Install and configure ida-multi-mcp by following the instructions here: https://raw.githubusercontent.com/MeroZemory/ida-multi-mcp/main/docs/installation.md

Cursor:

@Web fetch https://raw.githubusercontent.com/MeroZemory/ida-multi-mcp/main/docs/installation.md and follow the installation steps.

Then open your binaries in IDA Pro — instances register themselves — and talk to your agent. Prefer doing it by hand? See Manual installation. Removing it again is in Troubleshooting.

---

See it in action

Two binaries open in two IDA windows. One MCP endpoint. No client config per binary.

“Which function in dropper.dll is the same as sub_140001000 in malware.exe?”

→ list_instances()
  k7m2  malware.exe   x86_64  port 49152
  px3a  dropper.dll   x86_64  port 49153

→ analysis_wait(instance_id="px3a", timeout_sec=200)
  { "finished": true, "functions_added": 12884 }   # 12,884 functions that did not exist a minute ago

→ index_functions(instance_id="k7m2")   ·   index_functions(instance_id="px3a")
  { "indexed": 61044 }                      { "indexed": 73929 }

→ similar_functions(instance_id="k7m2", func="sub_140001000", scope="instances")