How to use the ida-reverse IDA Pro agent skill

What an agent skill is and what ida-reverse makes the agent do

An agent skill is a folder containing a SKILL.md instruction file and optional scripts and reference files. When a request matches the skill's description, the AI client loads those instructions and follows them.

Once ida-reverse is installed and IDA Pro is available, the agent can list functions, decompile them into readable pseudo-code, trace where data and calls go, and search strings. It also manages the IDA MCP server on Windows, including starting it in the background and recovering it when it hangs.

• Overview of a binary: function count, strings, segments, entry points and imports grouped by category such as encryption, network and file I/O
• Decompile and disassemble functions, and analyse a function with its strings, constants, callers and callees
• Follow cross-references, call graphs and data flow
• Search strings with regular expressions and search raw bytes with wildcards
• Read bytes, strings, integers and structs from the open database

Install the ida-reverse skill

Download the ZIP for this skill from this page. Then choose one of the two install locations below.

For a personal install available in every project, unzip the skill into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

The skill folder should contain SKILL.md, LOCAL-SETUP.md, scripts/run-supervisor.py and references/ida-mcp-cheatsheet.md.

• Personal: ~/.claude/skills/ida-reverse/
• Project: .claude/skills/ida-reverse/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Set up IDA Pro and the MCP server

The skill depends on a working IDA Pro installation with idalib support. Set the IDADIR environment variable to your IDA install directory, which must contain ida.exe or ida.dll. If IDADIR is not set, the start script also checks a portable desktop path and common install locations.

The skill's setup guide describes the MCP server as the 'idapro' HTTP server on 127.0.0.1:13337. Register only one server name for it, 'idapro', so tools are not registered twice. The setup guide also lists the install and activation steps for the ida-pro-mcp package; follow LOCAL-SETUP.md for the exact commands for your machine.

• Set IDADIR to your IDA directory
• Install the ida-pro-mcp package and activate idalib as described in LOCAL-SETUP.md
• Configure your AI client with the 'idapro' HTTP server at http://127.0.0.1:13337/mcp

Trigger the skill with natural requests

You do not need to name the skill. The skill's description covers requests about reverse engineering, decompiling, and analysing binaries such as PE, ELF, APK, DLL, SO, and SYS files, along with firmware analysis and vulnerability or malware analysis. Describe the file and what you want to know.

Name the file path in your request so the agent can open it. The skill is designed to call its own scripts for opening files, so you should not expect the agent to hand-write PowerShell for those steps.

• 'Look at C:\samples\tool.exe and tell me what it imports.'
• 'Analyse this dll and list its main functions.'
• 'Decompile the function at this address and explain what it does.'
• 'Find the strings that mention a URL or a password in this sample.'
• 'Trace where this global variable is read and written.'

Run the scripts yourself (optional)

The skill's scripts can also be run by hand from the skill folder. start.ps1 starts the HTTP server in the background and exits once it is ready. open.ps1 opens a target file through the HTTP API.

• Start the server: powershell -File "<skill-root>\ida-reverse\scripts\start.ps1"
• Open a file: powershell -File "<skill-root>\ida-reverse\scripts\open.ps1" -Path "C:\path\to\file.exe"
• For large files or GUI programs, add -TimeoutSeconds 600
• To skip automatic analysis on very large files, add -NoAutoAnalysis

Safety notes: scripts, network and untrusted files

This skill runs local PowerShell and Python scripts and opens files that may be untrusted. It also uses the network: the MCP server listens on 127.0.0.1, which is your own machine. Analysing unknown or suspicious samples on a daily-use machine is not recommended. Use an isolated virtual machine for that work.

Only analyse files you are authorised to inspect. Do not use this skill to crack software or bypass licence protection you do not own, which may be illegal where you live.

• Use an isolated VM for unknown or malicious samples
• Review scripts/start.ps1 and scripts/open.ps1 before running them if you need to know exactly what they do
• Do not kill ida.exe by process tree to recover the server; the skill's own recovery path avoids this

Tips for better results

Start with a broad overview before asking for detail. Ask for a summary of the binary first, then drill into specific functions by address. Large or GUI programs can take several minutes to open with automatic analysis, so set a longer timeout instead of assuming the script has hung. If the server stops responding in an HTTP client, run recover.ps1 from the scripts folder, which forces a restart of the managed supervisor without killing ida.exe.

• Ask for an overview first, then specific functions
• Use -TimeoutSeconds 600 for GUI programs and complex samples
• Use recover.ps1 if the idapro server shows as error in your client