# How reverse-skill Integrates with IDA Pro for Automated Binary Analysis

> Automate binary analysis with reverse-skill and IDA Pro. Discover how reverse-skill's ida-reverse skill offers 72 functions via an HTTP API for disassembly, decompilation, and X-ref analysis without GUI interaction.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-25

---

**reverse-skill provides a dedicated `ida-reverse` skill that wraps IDA Pro's MCP server behind PowerShell bootstrap scripts and exposes 72 analysis functions via an HTTP-based Python-style API, enabling automated disassembly, decompilation, and cross-reference analysis without direct GUI interaction.**

The `zhaoxuya520/reverse-skill` repository delivers a production-ready bridge between AI agents and Hex-Rays IDA Pro, transforming the interactive disassembler into a programmatic analysis engine. This integration leverages the MCP (Multiple-Client-Protocol) server to expose IDA's deep binary analysis capabilities through standardized HTTP endpoints and PowerShell automation scripts.

## The Three-Stage Analysis Workflow

The `ida-reverse` skill operates through a strict three-phase pipeline managed by PowerShell scripts in `skills/ida-reverse/scripts/`.

### Stage 1: MCP Server Initialization

The integration begins with `skills/ida-reverse/scripts/start.ps1`, which handles environment preparation and server bootstrapping:

- Validates the `IDADIR` environment variable pointing to the IDA Pro installation
- Terminates stale `idalib-mcp` processes using `taskkill /F /T` to prevent database file locks on `.id0`, `.id1`, and `.nam` files
- Launches the `idalib-mcp` HTTP service in a hidden background window
- Binds to `127.0.0.1:13337` (with automatic port incrementation for multiple instances)

### Stage 2: Binary Loading and Auto-Analysis

The `skills/ida-reverse/scripts/open.ps1` script manages binary ingestion without MCP schema validation constraints:

- Bypasses MCP adapter validation bugs by invoking `idalib_open` via raw HTTP rather than direct MCP calls
- Auto-copies System32 dependencies to temporary folders for portable analysis
- Cleans stale database artifacts before loading
- Implements polling with `INFO:opening:...` status lines every 10 seconds
- Returns `OK:<file>:<session>` on success or `ERR:open_timeout_Xs` on failure

### Stage 3: Tool Execution via 72 MCP Functions

Once initialized, the skill exposes 72 specialized functions prefixed with `idapro_` covering survey, decompilation, cross-references, patching, and debugging operations.

## Bootstrapping and Environment Configuration

The skill automatically validates and configures the IDA Pro environment through [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh):

- Checks [`../tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/../tool-index.md) for IDA Pro presence
- Installs the MCP plugin via `pip install git+https://github.com/mrexodia/ida-pro-mcp.git`
- Executes `ida-pro-mcp --install` to configure Streamable HTTP mode with Global scope
- Verifies `IDADIR` points to the commercial installation directory (the skill does not ship IDA binaries)

## HTTP Wrapper Architecture and Session Management

To handle long-running auto-analysis reliably, the integration uses a thin HTTP wrapper that isolates the analysis lifecycle:

- **Schema Bypass**: Direct MCP calls to `idalib_open` occasionally fail validation in AI-client adapters; the HTTP wrapper sidesteps this layer
- **Timeout Handling**: Configurable timeouts (default 600 seconds) prevent indefinite hangs during initial analysis
- **Session Tracking**: Functions like `idapro_idalib_list`, `idapro_idalib_current`, and `idapro_idalib_switch` manage multiple concurrent analysis sessions
- **Health Monitoring**: `idapro_idalib_health` checks server responsiveness before operations

## The 72-Tool Function Library

The [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) defines a comprehensive Python-style function library organized into functional domains:

- **Survey Functions**: `idapro_survey_binary(detail_level="minimal")` provides mandatory reconnaissance
- **Decompilation**: `idapro_decompile(addr="sub_140001000")` extracts pseudocode from specific addresses
- **Cross-Reference Analysis**: `idapro_xrefs_to(addrs="\"http://bad.c2\"")` traces data flow to suspicious strings
- **Annotation**: `idapro_set_comments(items=@{ addr="0x140001234"; comment="Potential key derivation" })` adds analytical notes
- **Export Capabilities**: `idapro_export_funcs(addrs="*"; format="c_header")` generates C headers from recovered prototypes

## Evidence-First Analysis Policy

The skill enforces a "hard-gate" rule requiring evidence collection before deep analysis:

- Imports must be identified and stored as `E-imports` evidence
- `idapro_survey_binary` and `idapro_entity_query(kind="imports")` provide mandatory baseline data
- This policy ensures analytical traceability and prevents assumptions about binary structure

## Router Integration and Skill Discovery

The `ida-reverse` skill integrates with the central routing system via [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md):

- Automatically selected when the router detects binary file extensions (`.exe`, `.dll`, `.so`, `.elf`)
- Entry: `| Binary exe/dll/so/elf | \`ida-reverse/\` — IDA Pro decompile |`
- Enables zero-configuration invocation for binary analysis requests

## Practical Implementation Example

The following PowerShell sequence demonstrates a complete analysis workflow:

```powershell

# Configure environment

setx IDADIR "C:\Program Files\IDA Pro 8.0"

# Initialize MCP server

powershell -File "skills/ida-reverse/scripts/start.ps1"

# Load target binary with 10-minute timeout

powershell -File "skills/ida-reverse/scripts/open.ps1" `
    -Path "C:\samples\malware.exe" `
    -TimeoutSeconds 600

# Mandatory survey before analysis

idapro_survey_binary(detail_level="minimal")

# Decompile entry point

idapro_decompile(addr="sub_140001000")

# Trace cross-references to network indicator

idapro_xrefs_to(addrs="\"http://bad.c2\"")

# Document findings

idapro_set_comments(items=@{ addr="0x140001234"; comment="C2 communication" })

# Export results

idapro_export_funcs(addrs="*"; format="c_header") > funcs.h

# Cleanup

idapro_idalib_close(session_id="abcd1234")

```

## Summary

- **reverse-skill** wraps IDA Pro through the `ida-reverse` skill using PowerShell automation and MCP HTTP protocols
- **Three-stage workflow**: Server bootstrap (`start.ps1`), binary loading (`open.ps1`), and tool execution (72 `idapro_*` functions)
- **Schema validation bypass**: Raw HTTP wrapper prevents MCP adapter compatibility issues during `idalib_open` operations
- **Evidence requirement**: Mandatory import survey via `idapro_survey_binary` before deep analysis
- **Session management**: Automatic cleanup of stale processes and database locks, with health monitoring and timeout protection
- **Router integration**: Automatic selection for `.exe`, `.dll`, `.so`, and `.elf` files through [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)

## Frequently Asked Questions

### How does reverse-skill handle IDA Pro licensing and installation?

The skill requires a pre-installed commercial IDA Pro instance with the `IDADIR` environment variable set to the installation path. The [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) script installs only the open-source MCP plugin bridge, not the IDA binary itself, ensuring compliance with Hex-Rays licensing terms.

### Why does the integration use PowerShell HTTP wrappers instead of direct MCP calls?

Direct MCP calls to `idalib_open` suffer from schema-validation bugs in certain AI-client adapters. The `skills/ida-reverse/scripts/open.ps1` HTTP wrapper bypasses this validation layer while adding critical functionality for System32 file copying, stale database cleanup, and configurable timeouts with status polling.

### What happens if IDA Pro crashes during automated analysis?

The `skills/ida-reverse/scripts/start.ps1` script implements defensive process management by executing `taskkill /F /T` on existing `idalib-mcp` workers before launching new instances. This prevents orphaned processes from locking database files (`.id0`, `.id1`, `.nam`), and the `idapro_idalib_health` function enables proactive server status checks between operations.

### How many analysis functions are available through the ida-reverse skill?

The skill exposes **72 distinct MCP tools** prefixed with `idapro_`, organized into categories including binary survey, decompilation, cross-reference analysis, memory access, patching, type system management, stack frame analysis, signature matching, and debugger control, as documented in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md).