Awesome MCPSecurity & Reverse Engineering

mrexodia/ida-pro-mcp

⭐ 12019 Python added to this list on 2025-04-09 repository created 2025-03-25

ida-pro-mcp is an MCP (Model Context Protocol) server designed specifically for IDA Pro, a popular reverse engineering tool. This project enables advanced reverse engineering capabilities by facilitating MCP-based interactions and automation within IDA Pro. It acts as a bridge between IDA Pro and various MCP clients, allowing users to perform complex reverse engineering tasks more efficiently and interactively. The server provides a wide range of functionalities accessible through MCP commands. These include checking the connection status of the IDA plugin, retrieving metadata about the current IDB (IDA database), and accessing functions by name or address. Users can also get the current address or function selected, convert numbers between different representations, and list functions, globals, and strings with filtering and pagination support. More advanced features include decompiling functions, disassembling functions to get assembly code with comments, and retrieving cross-references to addresses or struct fields. The server supports setting comments, renaming local and global variables, changing variable types, renaming functions, setting function prototypes, and declaring or updating local types from C declarations. For debugging purposes, unsafe functions are available (requiring a special flag) that allow users to get register values, call stacks, manage breakpoints, and control the debugger process (start, exit, continue, run to address). The project requires Python 3.11 or higher and IDA Pro version 8.3 or higher (excluding IDA Free). It supports multiple MCP clients such as Cline, Roo Code, Claude, Cursor, VSCode Agent Mode, and Windsurf, among others. Installation involves pip commands and configuring the MCP servers along with installing the IDA plugin. The repository also provides guidance on prompt engineering for large language models (LLMs) to improve reverse engineering accuracy and reduce hallucinations. Additional tips include preprocessing binaries to remove obfuscation and using tools like Lumina or FLIRT to resolve open-source library code. Overall, ida-pro-mcp enhances the reverse engineering workflow in IDA Pro by integrating MCP-based automation and interaction, making it a valuable tool for security researchers and reverse engineers.

https://github.com/mrexodia/ida-pro-mcp

automationbreakpointsclinecode-analysiscross-referencescursordebuggingdecompilationdisassemblyfunction-metadatafunction-renamingfunctionsheadless-mcpida-pluginida-prollmllm-prompt-engineeringmcpmcp-clientsmcp-servermodelcontextprotocolobfuscationprompt-engineeringpythonreverse-engineeringsse-transportvariable-renamingvariables

Also in Security & Reverse Engineering

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive open-source library featuring 754 structured cybersecurity skills for AI agents, mapped to five industry frameworks to provide expert-level guidance.

NVIDIA/SkillSpector

NVIDIA security scanner for AI agent skills and MCP tooling that detects prompt injection, data exfiltration, MCP tool poisoning and least-privilege problems, and can itself be run as an MCP server inside agent sessions.

LaurieWired/GhidraMCP

GhidraMCP is an MCP server that integrates Ghidra's reverse engineering capabilities with MCP clients, enabling automated binary analysis and decompilation through large language models.

invariantlabs-ai/mcp-scan

MCP-Scan is a security tool that statically and dynamically scans and monitors Model Context Protocol (MCP) connections to detect and prevent vulnerabilities such as prompt injections, tool poisoning, and cross-origin escalations.

zinja-coder/jadx-ai-mcp

JADX-AI-MCP is a JADX plugin integrating Model Context Protocol to enable AI-powered live reverse engineering, vulnerability detection, and code analysis of Android APKs using large language models like Claude.

mariocandela/beelzebub

Beelzebub is a secure low-code honeypot framework leveraging large language models and the Model Context Protocol (MCP) to detect and analyze cyber attacks, including prompt injection attempts against LLM agents.

svnscha/mcp-windbg

mcp-windbg is a Model Context Protocol server that enables AI models to analyze Windows crash dumps using WinDBG through natural language interaction and command execution.

BlackSnufkin/LitterBox

LitterBox is a secure sandbox environment integrating with LLM agents via MCP to provide advanced malware analysis and testing capabilities for red and blue teams before deployment.