ida-multi-mcp puts several running IDA Pro databases behind a single Model Context Protocol endpoint, so an agent can reason across a related set of binaries (a dropper, its payload, and a command-and-control component, for example) without configuring the client once per binary. Every IDA instance carrying the plugin registers itself in a shared file registry when a database opens and receives a short identifier that routes later calls.
A router process owns discovery, instance routing, health monitoring, a worker pool, and the headless session lifecycle, and speaks HTTP JSON-RPC to each instance. Headless analysis runs through idalib in an isolated subprocess per session. Requests to different instances run concurrently: a call to a second instance while the first was busy is reported to drop from 3.41 s to 0.01 s. The server binds to loopback only, with Host and Origin validation.
Because IDA analyses a freshly opened binary in the background, function lists, cross-references, and decompilation stay incomplete for a while. On one 8.5 MB DLL the function count rose from 9,580 to 13,252 as analysis settled. An analysis-status call returns a non-blocking snapshot of queue state and function count, an analysis-wait call drives analysis to completion in bounded slices, and the router attaches a warning to results from analysis-dependent tools while an instance is still working.
Binary code similarity detection finds the same or a similar function within one binary or across instances, for patch diffing, library-function identification, and variant hunting. The signals are instruction-shingle MinHash, IDF-weighted imported-API, string, and constant anchors, control-flow-graph structure and shape, and symbol-gated pseudocode tokens, with optional local neural recall using on-demand jTrans embeddings. Indexes are content-hash keyed and incremental, and scoring and inference stay on the machine, so no binary or database is uploaded.
The IDA-side tool implementations come from the ida-pro-mcp project, bundled as a package and synchronized selectively. Up to 76 tools reach the client through one router, spanning triage, navigation, decompilation, cross-references, search, types and stack frames, modification, memory access, similarity, multi-instance management, analysis gating, headless sessions, and an IDAPython escape hatch. It supports IDA Pro 8.5 and later, except IDA 9.0 SP0 build 240925, which shipped without APIs several tools call.
Features
- Zero-configuration discovery: each graphical instance registers itself in a shared registry when a database opens
- Instance routing: short, stable identifiers select which database a call lands on, with automatic binary-change detection
- Parallel execution: a worker pool keeps a call to one instance from blocking calls to another
- Headless sessions: a binary can be analyzed with no graphical interface, one isolated subprocess per session
- Analysis gating: status, wait, and step calls tell an agent whether results are complete
- Cross-binary similarity: function indexing, nearest-match search, pairwise comparison, and whole-binary comparison
- Name-independent signals: the core similarity signals survive stripped symbols
- Local processing: scoring, indexes, and neural inference run on the machine
- Deadline handling: timeouts fire IDA's own cancellation and label partial pages as canceled
- Version shims: a compatibility layer covers APIs that moved between IDA 8.5 and 9.3
- Local binding: loopback only, with Host and Origin validation
- Deferred writes: renames, retypes, and comments stay in memory until the database is saved
