Table of contents
17
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: In March 2026 Hex-Rays listed its IDA Pro AI plans as a roadmap. By 26 October most of the practical part had shipped with IDA 9.5: an official MCP server, a built-in agent called Assist, and a headless edition for agent fleets. The parts that are still roadmap are the Knowledge and Semantic Engines and the HexAI platform.
- The IDA Pro AI server is free and open source. Hex-Rays’ official server (MIT, about 1,500 GitHub stars) connects Claude Code, Codex, GitHub Copilot and others to IDA, and needs IDA 9.4 or later with idalib.
- IDA Pro AI’s Assist agent is included, not sold separately. It comes with IDA Pro and IDA Home from 9.4 SP1, uses your own model key or subscription, and sends data only to the provider you configure.
- You have to turn IDA Pro AI privacy on. Assist’s confidentiality rules start empty, so a fresh install redacts nothing, and Hex-Rays says to run the MCP server in a sandbox because IDA does not yet isolate its Python interpreter.
- Still roadmap in IDA Pro AI: the Knowledge and Semantic Engines have no product pages that I could find, and the combined HexAI platform is planned for early 2027.
- No benchmark settles IDA versus Ghidra. I found no independent test with an agent in the loop, so the choice comes down to licence, architecture coverage and scale.
If you searched for IDA Pro AI a year ago, the honest answer was a few community plugins and a lot of “vibe reversing” videos. Today the vendor itself ships the pieces, which changes the question from “can I make this work” to “which of the five ways to do it should I trust with a sensitive binary”.
This guide separates what is shipped in IDA Pro AI from what is promised, shows what each piece costs and where your data goes, and gives a plain way to choose between IDA and Ghidra when an agent does part of the work. I read Hex-Rays’ blog, documentation, pricing and release notes, the official and community MCP repositories, and two practitioner write-ups on 6 November 2026. I did not benchmark any of it myself, and Hex-Rays’ performance claims are labelled as the vendor’s own.
Hex-Rays shipped three IDA Pro AI items, IDA MCP, Assist and IDA Pro Headless, with IDA 9.5 on 26 October 2026, and it has not shipped the Knowledge Engine, the Semantic Engine or the HexAI platform. The blog post announcing 9.5 describes the first three as “major companion capabilities designed for the agentic AI era”.
| Item | Status | What it is | Cost |
|---|---|---|---|
| IDA MCP | Shipped, announced 25 Sep, in 9.5 notes | Official MCP server that lets AI agents work on IDA databases | Free, open source (MIT) |
| Assist | Shipped with 9.5 | An AI harness built into IDA that reads the database and proposes changes you approve | Included with IDA Pro and Home, no separate price |
| IDA Pro Headless | Shipped with 9.5 | IDA without the GUI, built for pipelines and agent fleets, with a license server agents can borrow from | “Contact us” |
| Malware Analysis add-on | Shipped with 9.5 | Unpacking, emulated stepping and import of runtime artifacts from sandboxes such as VMRay and Speakeasy | $1,999 per year |
| Claude Code skills for IDA, IDA Chat, IDA Terminal | Shipped in 2025, per the March roadmap post | Earlier plugins, now mostly overtaken by MCP and Assist | See the Hex-Rays GitHub |
| Knowledge Engine, Semantic Engine | Beta by invitation, no product pages found | Code similarity, recognition and semantic tooling with LLM-friendly APIs | Not published |
| HexAI platform | Planned for early 2027 | Joint platform after Hex-Rays acquired HexAI, announced 22 October | Not published |
The March IDA Pro AI roadmap said “priorities may evolve and timelines may shift”, and the shipped items are not the ones it named. It named the Engines. What arrived first was MCP and Assist, which is a useful reminder that vendor roadmaps are a statement of intent.
IDA MCP is the first-party IDA Pro AI route for putting an agent in IDA, and it works with the IDA you already own. Hex-Rays describes it as model-agnostic, working with any capable model “whether deployed locally or accessed through a cloud provider”. It runs fully locally, and can share many databases across many agents and a human at the same time. If IDA is open in the GUI, an agent’s renames and comments show up immediately. If it is not, the server spawns a headless idalib session.
The repository (HexRaysSA/ida-mcp, MIT licence) lists the requirements: Git and uv on your path, and IDA 9.4 or higher with idalib and Python 3.11 or newer. IDA Pro, Home, Classroom and OEM are supported, and IDA Free is not listed. Installation is one command:
uvx ida-hcli mcp installFor Claude Code, the manual route uses Hex-Rays’ own plugin marketplace:
claude plugin marketplace add HexRaysSA/claude-marketplace
claude plugin install ida-mcp@HexRaysSAThe same repository documents Codex, GitHub Copilot CLI, Pi and oh-my-pi installs, and Hex-Rays says any client that supports stdio MCP servers works, including LM Studio. Hex-Rays’ recommended pairings are Opus 5.5 through Claude Code, GPT-6-Sol or Astra through Codex, or DeepSeek 4.1 Flash, Gemini 3.8 Flash, Kimi K3 or GLM 5.3 through OpenRouter. It adds a practical warning for the first one: cybersecurity safeguards frequently interrupt work, so falling back to Opus 4.6 may be necessary. That matches Anthropic’s own documentation, which says offensive security work often triggers model fallback.
The community IDA Pro AI server came first, and its author now points you away from it. mrexodia’s ida-pro-mcp (MIT, about 13,400 stars) opens with a notice recommending the official server instead, and says the older plugin approach will eventually be deprecated in favour of idalib. It supports IDA 8.3 and later, which makes it the option for teams stuck on an older IDA. Its README is honest about the limits: LLMs hallucinate, especially on number conversions, and “will not perform well on obfuscated code”. Gepetto, an older IDA plugin (GPL-3.0, about 3,500 stars), lists any local model exposed through Ollama, which matters in the privacy section below.
Assist is the IDA Pro AI agent that lives in the IDA window and asks before it changes anything. Hex-Rays calls it “a real AI harness” that reads the database, drives IDA’s own analysis engines and proposes changes you approve. The marketing page shows it tracking registers, emulating a range and using a solver to prove a loop bound.
Three facts matter before you try it:
idat batch mode. The marketing page says 9.3 and later, so trust the requirements page. Eighteen of its tools also need a Hex-Rays decompiler licence for the target architecture.For headless and scripted work the answer is IDA MCP, not Assist.
With IDA Pro AI your binary stays on your machine until you point a model at it, and then the model provider you chose sees whatever the agent reads. Hex-Rays’ pages give a clear picture for its own tools, and three gaps you should close yourself.
What the documentation says about IDA Pro AI:
The gaps:
py_eval tool that executes arbitrary Python in IDA’s context.If your samples cannot leave your network, pair IDA with a local model through Ollama or LM Studio, and block outbound traffic on the analysis host. Our guide to offline AI malware analysis covers the wider lab practice, and the MCP server security guide covers why you treat any MCP server as code you run.
The strongest public IDA Pro AI evidence says a frontier model with IDA can carry a real investigation, with a human steering. Two write-ups describe actual work with IDA.
SentinelLABS built an eight-stage investigation of a 2005 sabotage implant in IDA Pro 9.3 and had models produce annotated IDA databases. GPT-5.6 Sol was the only publicly available model to finish all eight stages, GPT-5.5 never escaped the first level, and the authors report that models declared checkpoints clean before review found problems. They conclude that senior reverse engineers remain essential. The page does not say how the models connected to IDA, so it is not evidence about any particular bridge.
Cisco Talos describes a different job. In a June 2026 post, David Zimmer used an agent to build an opcode database for the VB6 runtime, using an idalib MCP server to read the runtime’s handler functions. The post gives no model, version or cost, and says the output took hours.
Hex-Rays’ own performance claim is that IDA MCP’s “code mode” design cut token use by about 20% on an internal malware benchmark against popular alternatives. That is the vendor’s number, from a benchmark I cannot see, and token use is not accuracy.
Pick your IDA Pro AI or Ghidra stack on licence, architecture coverage and how many agents you want to run, because no independent benchmark compares the two with an agent in the loop. I looked and found none. SRE-Bench’s agent container used Ghidra, radare2, GDB and angr, and SentinelLABS used IDA, but neither tested one against the other.
| Question | IDA Pro | Ghidra |
|---|---|---|
| Licence | Commercial, sold by the year | Apache-2.0, free |
| Cost to start | IDA Home $365 per year (non-commercial); IDA Pro Essential from 1,099 per year; Expert from 4,999; Ultimate from 8,599 | $0 |
| Official AI tooling | IDA MCP, Assist, Headless (shipped in 9.5) | No first-party AI tooling that I found; community servers |
| Community AI tooling | ida-pro-mcp (about 13,400 stars), Gepetto (about 3,500) | GhidraMCP (about 11,800), ReVa (about 950), GhidrAssist (about 780) |
| Running many agents | IDA Pro Headless, price on request | Headless Ghidra, free |
| Collaboration | Teams add-on, IDA MCP shares databases across agents | Ghidra Server |
| Decompiler coverage | Many architectures, depending on plan | Broad, one decompiler |
| Air-gapped use | Possible with a local model, but check cloud decompilers on cheaper plans | Straightforward with a local model |
The IDA prices come from Hex-Rays’ pricing page, where the Pro tiers appear in euros on one page and dollars on the other, so confirm the currency at checkout. Ghidra’s figures come from GitHub on 6 November: about 98,000 stars, Apache-2.0. Our guide to AI reverse engineering covers the field more broadly.
My IDA Pro AI rule of thumb, which is judgment and not data: if your team already owns IDA and lives in its databases, use IDA MCP first and Assist for interactive work, because the vendor now supports both. If you need many agents running in parallel on a budget, or a fully offline stack, Ghidra’s price and openness win. If you are an individual on a hobby budget, IDA Home at $365 a year includes the AI features, but it is for non-commercial use.
In any IDA Pro AI workflow, treat the agent and the binary as two things you do not trust, and put both in a box.
uvx ida-hcli mcp install, then pick your agent’s plugin when prompted.A note on hostile samples: Check Point Research reported a 2025 sample carrying a string written to make an AI analyser answer “NO MALWARE DETECTED”. It failed against the models tested, but an agent that reads strings from a binary is reading attacker-controlled text, so keep tool permissions narrow.
Short and biased, since it is our product, and I will keep it next to IDA Pro AI rather than against it. The XHack AI agent is not a decompiler and I would not tell an IDA user to replace IDA with it. What it offers is a desktop agent for the work around the binary: recon, testing, reporting, and mobile analysis with jadx, androguard, ADB and Frida.
Its MCP connections feature lets the agent call MCP servers you run, and IDA MCP is one. We have not published a tested IDA setup, so treat that as something to try, not a promise. The agent can also run on a local model through Ollama or llama.cpp, so the offline pattern above applies to it too. Agent chats are not stored or accessible by XHack.
Plans are $20, $49 and $150 a month, with a 7-day free trial that is one per person, and exploitation features unlock once your identity is verified. See pricing and the MCP connections page. When is another route better? If your work is mostly inside IDA, Assist plus IDA MCP is the direct path and you do not need us for it. If you want people to take a binary off your hands, our researchers take scoped engagements. Prefer to talk it through first? Book a free consultation, even if that turns out not to be us. Brutal honesty is kind of our thing.
Yes, IDA Pro AI is built in since IDA 9.5 on 26 October 2026. Hex-Rays added Assist, an AI agent built into IDA, and IDA MCP, an official server that lets external agents work on IDA databases. Assist is included with IDA Pro and IDA Home from 9.4 SP1 at no extra price, and you supply your own model key, subscription or local model.
Yes. Hex-Rays’ official IDA MCP is free and open source under the MIT licence, and it works with IDA Pro, Home, Classroom and OEM. You still need a licensed IDA 9.4 or later with idalib, and you pay your model provider separately. IDA Free is not listed as supported.
IDA Pro AI via Assist has no telemetry and sends data only to the model endpoint you configure, plus an hourly update check. If you use a cloud model, whatever the agent reads goes to that provider. Its confidentiality rules start empty, so add them before the first prompt, or use a local model through Ollama to keep everything on your network.
Choose an IDA Pro AI or Ghidra setup on licence, architecture coverage and scale. IDA now has first-party AI tooling and starts at $365 a year, and Ghidra is free with strong community servers such as GhidraMCP. No independent benchmark compares them with an agent in the loop, so test both on your own samples.
Hex-Rays recommends Opus 5.5 through Claude Code, GPT-6-Sol or Astra through Codex, or cheaper models such as DeepSeek 4.1 Flash through OpenRouter, and warns that Anthropic’s safeguards often interrupt work so Opus 4.6 may be a fallback. That is the vendor’s experience, not a benchmark. Run your own tests, and count refusals as failures.
The Knowledge Engine and Semantic Engine, described in March as upcoming tools with LLM-friendly APIs, and the HexAI platform that Hex-Rays says it will release in early 2027 after acquiring HexAI. No prices or product pages exist for them yet, so plan around IDA MCP and Assist, which are available today.
The IDA Pro AI story changed in seven months from a roadmap to a toolkit: an official MCP server, a built-in agent and a headless edition, all shipping with IDA 9.5. The privacy defaults are your job, the sandbox is your job, and the verdict on every name and type is still a human’s job. Use IDA if you already live in it, use Ghidra when price or air-gapped scale decides, and treat the Knowledge Engine and HexAI as promises until Hex-Rays prices them.
Categories
Related articles
