Back in 2025, when we began integrating AI agents with IDA Pro, the upstream ida-pro-mcp project provided a great initial starting point. At the time, it did not yet offer multi-session workflows, which were essential for our daily reverse engineering needs.

To address our internal use cases, we began building experimental solutions:

• Gateway Proxy Architecture: We developed a stateless proxy layer that automatically discovers and routes tool requests across concurrent GUI and headless IDA instances. (While upstream has since added its own multi-session implementation, the two projects use fundamentally different architectural approaches).
• Relational SQL Query Engine: Answering high-level questions about a binary (e.g., finding functions with specific characteristics or exploring complex cross-reference patterns) typically required dozens of sequential API calls running on IDA's main thread. We integrated an on-demand, event-synchronized SQLite3 engine with an AST query-rewrite layer (sqlglot). Because queries execute against SQLite in worker threads, they support concurrent reads without acquiring IDA's main thread lock or blocking the UI.
• Architecture-Agnostic Tools & Bug Fixes: Several tools in the early upstream code had x86-specific assumptions or heuristics. We rewrote them to be architecture-agnostic (supporting ARM, AArch64, MIPS, PowerPC, RISC-V, etc.) and fixed various stability and synchronization edge cases.

Over time, as we added more features, optimizations, and compatibility layers across multiple IDA versions (IDA 7.7 through 9.4) and Python versions, the codebase diverged substantially into an independent project with its own design trade-offs.

We are sharing this project as an alternative, gateway- and SQL-centric approach for connecting AI agents to IDA Pro, and we remain grateful to Duncan Ogilvie and the upstream contributors for the foundational work that inspired this effort.

Key capabilities of this implementation include:

• Stateless Gateway: A proxy layer allows agents to interact with multiple IDA Pro instances (GUI and Headless) concurrently. The gateway automatically discovers and manages connections, allowing users to open and close databases without reconfiguring the client.

• Headless Mode: Perform analysis in the background without the IDA Pro GUI, suitable for automated workflows. Sessions can be managed directly by the AI agent.

• Relational SQL Engine: Integrates a read-only SQLite relational database populated on-demand and synchronized via IDA event hooks. Tables (functions, strings, names, imports, segments, local_types, xrefs, entries) support concurrent background queries without blocking IDA's main UI thread, while an AST query layer (sqlglot) handles unsigned 64-bit arithmetic, comparison rewriting, and hex literals.

• WYSIWYG Disassembly: Disassembly tools (like disassemble_function and disassemble_code) return formatted text matching the IDA Pro UI, including opcode bytes, data definitions, and comments. Includes get_ida_view for viewing arbitrary memory ranges.

• Analysis & Modification Tools: Includes tools for UI navigation (jump_to_address, set_color), memory inspection (hexdump), byte patching (patch_bytes), database exporting (export_file), cross-references (get_xrefs_from, get_data_xrefs_from), and structured data creation.

• Context-Aware Assembly Patching: Powered by Keystone at the Gateway layer, the patch_assembly tool allows assembling and applying instructions directly at target addresses. It can resolve IDA symbols (function names, labels, globals) within assembly strings and evaluate basic operand math across supported architectures (x86/x64, ARM/AArch64, MIPS, PowerPC, etc.), making it convenient for quick hotpatching, stubbing out checks, or testing alternative execution paths.

• Pagination and Caching: Implements paginated resource iteration for symbol and string listing, reducing memory overhead on large binaries.

• Security Dashboard: A web-based interface for managing permissions for "unsafe" tools (e.g., Python code execution), providing control over agent capabilities.

• Unix Domain Socket (UDS) Support: In addition to TCP, the server supports UDS for secure local communication in isolated environments (Linux/macOS).

• Configurable Tool Exposure (tool_mode): Supports three MCP tool exposure strategies via FastMCP transforms—"hybrid" (default, pins core high-frequency tools upfront and exposes the rest on-demand via BM25 search), "code_mode" (collapses tools into sandboxed Python discovery and execution), and "full" (exposes all ~68 tools upfront).

The core of this project is the Gateway Pattern. A central gateway process acts as a proxy that routes requests from the AI agent to the correct active IDA instance.

• Discovery: IDA instances (GUI or headless) register themselves by writing a metadata file to a shared directory.
• Routing: The gateway monitors this directory and manages a routing table. When a tool call arrives with a specific database_id, the gateway forwards it to the corresponding IDA process.
• Statelessness: This design decouples the agent from the backend. The agent communicates only with the gateway, and IDA instances can be opened or closed without affecting the agent's connection.

This architecture enables a multi-session analysis environment where the agent can work with multiple binaries concurrently.