How to Configure MCP Server Integrations with IDA Pro, Burp Suite, and Anything-Analyzer

The reverse-skill repository implements a unified Model-Context-Protocol (MCP) layer that enables AI agents to control IDA Pro, Burp Suite, and Anything-Analyzer through standardized JSON-RPC interfaces, exposing tool-specific ports and bootstrap scripts for automated security workflows.

The reverse-skill repository by zhaoxuya520 provides a comprehensive MCP (Model-Context-Protocol) framework that bridges AI agents with professional reverse engineering and penetration testing tools. This guide covers the exact configuration steps required to integrate IDA Pro for binary analysis, Burp Suite for web security testing, and Anything-Analyzer for browser automation into your MCP-enabled workflow.

Understanding the MCP Architecture

The reverse-skill repository implements a four-layer architecture to connect AI agents with security tools.

MCP Server Layer: Each tool runs a dedicated HTTP server or stdio bridge that advertises capabilities via the MCP JSON-RPC 2.0 protocol. IDA Pro uses PowerShell-based HTTP endpoints, Burp Suite runs a Java extension on port 9876, and Anything-Analyzer exposes a Node.js server on port 23816.

MCP Client Layer: AI agents (Claude Code, Cursor, Kiro) read the repository's RULES.md to discover available servers and their tool prefixes (idapro_, burpsuite_, anything-analyzer_). The client spawns subprocesses using command templates defined in bootstrap-manifest.json.

Routing Layer: The skills/config/routing.json file maps user intents to specific MCP servers and tool names, with human-readable documentation available in skills/routing.md and skills/routing_zh.md.

Health Check Layer: Before invocation, agents verify server availability through GET /health (Burp), GET /server_health (IDA), or TCP connection (Anything-Analyzer), falling back to installation prompts if services are unavailable.

Configuring IDA Pro MCP Server Integration

IDA Pro integration requires the idapro MCP server, documented in skills/ida-reverse/references/ida-mcp-cheatsheet.md.

Prerequisites

Ensure IDA Pro is installed and the idalib-mcp Python package is available in your environment.

Starting the Server

Execute the PowerShell bootstrap script to launch the HTTP server:

powershell -File "skills/ida-reverse/scripts/start.ps1"

A response of OK:72 indicates the server is ready to accept connections.

Opening Binaries

To analyze a specific binary, use the open script with optional auto-analysis disable for large files:

powershell -File "skills/ida-reverse/scripts/open.ps1" -Path "C:\target.exe"

The server responds with OK:target.exe:session_id, confirming the binary is loaded.

Using MCP Functions

Once active, AI agents invoke functions using the idapro_ prefix. For example, to decompile the main function:

{
  "tool": "idapro_decompile",
  "params": { "addr": "main" }
}

The response contains decompiled pseudo-code for further analysis.

Configuring Burp Suite MCP Server Integration

The Burp Suite integration relies on the burpsuite MCP server, detailed in skills/pentest-tools/references/burpsuite-mcp-guide.md.

Installing the Extension

Place burp-mcp-full.jar in burp-mcp-full/build/libs/, then load it via Extensions → Installed → Add in Burp Suite Professional or Community. Verify the console output shows [MCP] Server started on http://127.0.0.1:9876.

Configuring the Client

Add the following configuration to your AI client's MCP settings, where <SKILL_ROOT> resolves to the repository root:

{
  "mcpServers": {
    "burpsuite": {
      "command": "node",
      "args": ["<SKILL_ROOT>/burp-mcp-full/mcp-bridge.js"]
    }
  }
}

Executing Security Tests

Invoke Burp capabilities using the burpsuite_ prefix. To retrieve proxy history:

{
  "tool": "proxy_history",
  "params": { "limit": 100, "url_filter": "example.com" }
}

The response provides a JSON array of HTTP requests for analysis or replay through Intruder and Repeater modules.

Configuring Anything-Analyzer MCP Server Integration

Anything-Analyzer provides browser automation and HTTP capture capabilities through the anything-analyzer MCP server.

Installation and Startup

Clone the repository and install dependencies:

git clone https://github.com/Mouseww/anything-analyzer ~/tools/anything-analyzer
cd ~/tools/anything-analyzer
pnpm install
pnpm dev

The server launches on localhost:23816 and exposes browser automation primitives.

Client Registration

The bootstrap manifest automatically registers the endpoint http://localhost:23816. The AI client detects the anything-analyzer capability and adds the server to its available tools.

Browser Automation

Access headless Chromium functions using the anything-analyzer_ prefix:

{
  "tool": "anything-analyzer_open_page",
  "params": { "url": "https://target.com/login" }
}

This captures network traffic and returns structured data for correlation with Burp Suite findings.

End-to-End Integration Workflow

A complete penetration test can orchestrate all three MCP servers simultaneously. The following sequence demonstrates automated reconnaissance, reverse engineering, and exploitation:

1. Capture Traffic: Use Anything-Analyzer to browse the target while Burp Suite records HTTP traffic.
2. Analyze Binary: Decompile downloaded executables with IDA Pro to identify encryption routines.
3. Modify and Attack: Register custom HTTP handlers in Burp Suite based on reverse engineering findings, then execute brute-force attacks.

[
  { "tool": "anything-analyzer_open_page", "params": { "url": "https://target.com/app" } },
  { "tool": "proxy_history", "params": {} },
  { "tool": "idapro_decompile", "params": { "addr": "decrypt_func" } },
  { "tool": "register_http_handler", "params": { "header_name": "X-Encrypted", "header_value": "<decrypted>" } },
  { "tool": "intruder_attack_async", "params": {
      "url_template": "https://target.com/api?code=@@",
      "from": 0, "to": 999999, "pad_digits": 6,
      "threads": 50, "success_length_not": 176
    }
  }
]

The AI agent handles health checks, session management, and result aggregation automatically across all three services.

Summary

• reverse-skill provides unified MCP integrations for IDA Pro, Burp Suite, and Anything-Analyzer through JSON-RPC interfaces.
• IDA Pro runs via PowerShell scripts (skills/ida-reverse/scripts/start.ps1) and exposes idapro_* functions on a local HTTP port.
• Burp Suite requires the burp-mcp-full.jar extension and mcp-bridge.js connector, listening on port 9876 for burpsuite_* commands.
• Anything-Analyzer operates as a Node.js service on port 23816, providing anything-analyzer_* browser automation primitives.
• Routing configuration in skills/config/routing.json directs AI intents to the appropriate MCP server based on tool prefixes.
• Health checks ensure reliable failover when services are unavailable, triggering installation prompts when necessary.

Frequently Asked Questions

What is the Model-Context-Protocol (MCP) used in reverse-skill?

MCP is a JSON-RPC 2.0 protocol that standardizes how AI agents discover and invoke tools. In the reverse-skill repository, MCP servers wrap IDA Pro, Burp Suite, and Anything-Analyzer, exposing their functionality through HTTP endpoints or stdio bridges that AI clients can consume programmatically.

How do I troubleshoot connection failures to the IDA Pro MCP server?

Verify that the PowerShell script skills/ida-reverse/scripts/start.ps1 executed successfully and returned OK:72. Check that idalib-mcp is installed and that IDA Pro is licensed. The agent performs a GET /server_health check before operations; if this fails, ensure no firewall blocks the local HTTP port.

Can I use Burp Suite Community Edition with the MCP integration?

Yes, though with limited functionality. The burp-mcp-full.jar extension loads in both Professional and Community editions, but features like automated scanning and certain Intruder payloads require Burp Suite Professional. The MCP server starts on port 9876 regardless of edition.

Where are the MCP routing rules configured?

Routing rules reside in skills/config/routing.json, which maps user intents to specific MCP servers and tool names. Human-readable documentation is available in skills/routing.md (English) and skills/routing_zh.md (Chinese). The skills/scripts/bootstrap-reverse.sh script automates server registration based on these definitions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}