# How Reverse-Skill Manages IDA Pro Instances with MCP: A Complete Technical Breakdown

> Discover how reverse-skill manages IDA Pro instances with MCP, launching it as an HTTP micro-service. Access 72 RE tools via a stateless protocol for remote AI or script invocation.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-31

---

**Reverse-skill launches IDA Pro as an MCP-enabled HTTP micro-service, exposing 72 built-in reverse engineering tools through a stateless protocol that any AI agent or script can invoke remotely.**

The `reverse-skill` repository by zhaoxuya520 provides a dedicated **ida-reverse** skill that transforms IDA Pro from an interactive desktop application into a programmable remote service. This architecture enables automated binary analysis, decompilation, and cross-reference extraction through the Model Context Protocol (MCP) — making IDA's advanced capabilities accessible to AI agents, CI/CD pipelines, and orchestrated workflows.

## IDA Pro MCP Architecture Overview

The ida-reverse skill embeds a lightweight HTTP server directly inside the IDA process. According to the source code in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md), this server implements the MCP protocol and exposes **72 discrete tooling commands** including:

- `decompile` — pseudo-code generation for specified functions
- `xref` — cross-reference search across the binary
- `flowgraph` — control-flow graph extraction
- Additional commands for data-flow tracing, type reconstruction, and export generation

The MCP endpoint listens on a configurable port (default **23816**) and processes stateless HTTP POST requests, allowing any client — PowerShell, Python, curl, or AI agents like Claude — to interact with IDA without GUI automation.

## Core Components and File Structure

| Component | Purpose | Source File |
|-----------|---------|-------------|
| **Start script** | Launches IDA and initializes the MCP HTTP server | `skills/ida-reverse/scripts/start.ps1` |
| **Open script** | Opens target binaries via MCP command | `skills/ida-reverse/scripts/open.ps1` |
| **Supervisor** | Process monitoring, crash recovery, timeout handling | [`skills/ida-reverse/scripts/run-supervisor.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/scripts/run-supervisor.py) |
| **Helper module** | PowerShell wrappers for MCP commands | `skills/ida-reverse/scripts/IdaOpenHelpers.ps1` |
| **Cheatsheet** | Complete reference of 72 MCP commands | [`skills/ida-reverse/references/ida-mcp-cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/references/ida-mcp-cheatsheet.md) |
| **Routing entry** | Maps "IDA Pro" hints to this skill | [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) |

The routing configuration in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) ensures that any incoming request containing "IDA Pro" triggers the ida-reverse skill, as documented in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md).

## Starting and Managing IDA Pro MCP Instances

### Bootstrap: Launching the MCP Server

The `start.ps1` script handles IDA Pro initialization with embedded MCP support. It launches `idat` or `idat64` and injects a Python module that creates the HTTP listener.

```powershell

# Start the IDA Pro MCP service (Windows)

.\skills\ida-reverse\scripts\start.ps1

```

For Linux or macOS environments with PowerShell Core installed:

```bash
pwsh -File skills/ida-reverse/scripts/start.ps1

```

### Process Supervision and Fault Tolerance

The [`run-supervisor.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/run-supervisor.py) script in [`skills/ida-reverse/scripts/run-supervisor.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/scripts/run-supervisor.py) provides production-grade process management:

- Monitors IDA process health via periodic heartbeat checks
- Automatically restarts IDA on crash or hang
- Rebinds the MCP endpoint to maintain service continuity
- Handles configurable timeouts for long-running analysis tasks

This supervisor ensures that downstream AI agents experience a persistent IDA service even when analyzing unstable binaries that trigger IDA exceptions.

### Opening Binaries for Remote Analysis

The `open.ps1` script accepts a file path and forwards it to the MCP `open` command, with optional timeout control for initial auto-analysis:

```powershell

# Open a binary with 10-minute analysis timeout

.\skills\ida-reverse\scripts\open.ps1 `
    -Path "C:\samples\malware.exe" `
    -TimeoutSeconds 600

```

The `-TimeoutSeconds` parameter controls how long the script waits for IDA's initial auto-analysis to complete before returning control to the caller.

## Interacting with IDA Pro via MCP Commands

### PowerShell Helper Interface

The `IdaOpenHelpers.ps1` module in `skills/ida-reverse/scripts/IdaOpenHelpers.ps1` provides high-level wrappers that translate intent into MCP protocol calls. Key functions include:

- `Invoke-McpCommand` — Generic MCP request dispatcher
- `McpCall` — Simplified interface for common operations

```powershell

# Import helpers and decompile a specific function

Import-Module .\skills\ida-reverse\scripts\IdaOpenHelpers.ps1

$targetFunction = "sub_401000"
$decompilation = Invoke-McpCommand -Command "decompile" -Args $targetFunction

Write-Output $decompilation

```

### Direct HTTP API Access

Clients can bypass helpers and POST directly to the MCP endpoint. This approach works from any language or environment:

```python

# Direct MCP call from Python — useful for agent frameworks

import requests
import json

MCP_URL = "http://127.0.0.1:23816"

# Query cross-references to 'main'

payload = {
    "command": "xref",
    "args": {"symbol": "main"}
}

response = requests.post(MCP_URL, json=payload)
print(json.dumps(response.json(), indent=2))

```

## Available MCP Commands Reference

The complete command reference is maintained in [`skills/ida-reverse/references/ida-mcp-cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/references/ida-mcp-cheatsheet.md). The 72 exposed commands fall into these functional categories:

- **Decompilation**: `decompile`, `decompile_batch`, `optimize_pseudocode`
- **Navigation**: `xref`, `get_func`, `find_data`, `jump_to`
- **Graph extraction**: `flowgraph`, `callgraph`, `proximity_browser`
- **Data analysis**: `get_type`, `set_type`, `scan_for_strings`
- **Export**: `binexport`, `generate_idb`, `create_snapshot`

All commands accept JSON payloads and return structured JSON responses, enabling reliable parsing by automated systems.

## Integration with Downstream Skills

The MCP-enabled IDA instance functions as a shared service that other reverse-skill components consume. According to the routing configuration:

- The `binary-diff` skill calls `export` to retrieve BinExport files for automated diffing
- The `pentest-tools` skill extracts call graphs for vulnerability hunting workflows
- Generic analysis skills invoke `decompile` for code comprehension tasks

This service-oriented architecture prevents redundant IDA instances and provides consistent analysis results across an agent's entire operation.

## Summary

Reverse-skill manages IDA Pro instances with MCP through this key design:

- **HTTP micro-service architecture** — IDA runs as a stateless MCP server on port 23816
- **Process supervision** — [`run-supervisor.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/run-supervisor.py) ensures 24/7 availability with automatic restart
- **72 exposed commands** — Full decompiler and analysis API accessible via JSON/HTTP
- **Multi-language clients** — PowerShell helpers, Python requests, or direct HTTP from any environment
- **Skill integration** — Downstream capabilities consume IDA analysis through the MCP `export` and `decompile` commands

## Frequently Asked Questions

### What port does the IDA Pro MCP server use by default?

The default port is **23816**, configured in `skills/ida-reverse/scripts/start.ps1`. You can modify this by editing the port parameter before launching the service.

### Can I run multiple IDA Pro instances with MCP simultaneously?

Yes. Each instance requires a unique port assignment. The `start.ps1` script accepts port parameters, and the supervisor tracks instances by their endpoint addresses for independent management.

### How does the supervisor handle IDA crashes during long analysis jobs?

The [`run-supervisor.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/run-supervisor.py) implementation detects process termination through OS-level monitoring. Upon crash, it restarts IDA, re-injects the MCP server module, and rebinds to the same port — preserving the service endpoint for reconnecting clients. Partial analysis results are lost, but the service itself recovers automatically.

### Are all 72 MCP commands available in both IDA Pro 7.x and 8.x?

Command availability depends on your specific IDA installation and license tier. The cheatsheet in [`skills/ida-reverse/references/ida-mcp-cheatsheet.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/references/ida-mcp-cheatsheet.md) documents which commands require the decompiler plugin or specific processor module support.