Core tools: functions, globals, imports, and health

The core tools cover everything you need to orient yourself in a database: health checks and warmup, listing and searching functions and globals, querying imports, number conversion, and saving the IDB. Most tools accept either a single item or a list, and paginated results use next_offset to resume enumeration.

`server_health`

Returns a live snapshot of the MCP server and the currently open IDB. Call this first to confirm the server is reachable and to discover the database being analysed. Parameters: none Returns: ServerHealthResult

status

string

required

Always "ok" when the server is running.

uptime_sec

number

required

Seconds elapsed since the server process started.

idb_path

string | null

required

Absolute path to the open .idb/.i64 file, or null if not available.

module

string

required

Root filename of the analysed binary.

input_path

string

required

Full path to the original input file.

imagebase

string

required

Image base address in hex (e.g. "0x400000").

auto_analysis_ready

boolean | null

required

Whether IDA’s auto-analysis queue is drained. null if the API is unavailable.

hexrays_ready

boolean

required

Whether the Hex-Rays decompiler is initialised.

strings_cache_ready

boolean

required

Whether the strings cache has been built.

strings_cache_size

integer

required

Number of strings currently in the cache.

result = mcp.call_tool("server_health", {})
print(result["module"], result["imagebase"])

`server_warmup`

Initialises IDA subsystems to eliminate first-call latency and transient failures. Run this once at the start of a session — especially before calling decompile or find_regex.

wait_auto_analysis

boolean

default:"true"

Wait for IDA’s auto-analysis queue to drain before returning.

build_caches

boolean

default:"true"

Build the strings cache used by find_regex.

init_hexrays

boolean

default:"true"

Initialise the Hex-Rays decompiler plugin.

Returns: ServerWarmupResult

boolean

required

true if all requested steps succeeded.

steps

array

required

List of step results, each with step (name), ok (bool), ms (duration), and an optional error string.

health

object

required

A ServerHealthResult snapshot taken after warmup completes.

result = mcp.call_tool("server_warmup", {
    "wait_auto_analysis": True,
    "build_caches": True,
    "init_hexrays": True,
})
print(result["ok"], result["steps"])

`lookup_funcs`

Resolves one or more function queries to their Function records. Each query can be:

A hex address like "0x401000"
An auto-named symbol like "sub_401000"
A named symbol like "main" or "check_password"
"*" or "" to return up to 1 000 functions

queries

string | list[string]

required

Address(es) or name(s) to look up. Accepts a comma-separated string or a JSON array.

Returns: list[LookupFuncResult]

query

string

required

The original query string.

object | null

required

A Function record with addr, name, and size fields, or null on failure.

error

string | null

required

Error description when fn is null, otherwise null.

results = mcp.call_tool("lookup_funcs", {"queries": ["main", "0x401234"]})
for r in results:
    if r["fn"]:
        print(r["fn"]["name"], r["fn"]["addr"])

`list_funcs`

Lists all functions with optional name filtering and offset/count pagination. Each query in the batch is evaluated independently against the same function list.

queries

ListQuery | list[ListQuery]

required

One or more pagination queries. Each ListQuery supports:

Show ListQuery fields

filter

string

Glob pattern applied to function names (e.g. "check_*"). Empty or "*" matches all.

offset

integer

default:"0"

Zero-based index of the first result to return.

count

integer

default:"100"

Maximum number of results. Use 0 to return all.

Returns: list[Page[Function]] — each page has data (list of Function) and next_offset (integer | null).

# First page of all functions
page = mcp.call_tool("list_funcs", {"queries": [{"offset": 0, "count": 50}]})[0]
print(page["data"])         # list of {addr, name, size}
print(page["next_offset"])  # null if this is the last page

# Paginate to the next page
if page["next_offset"] is not None:
    next_page = mcp.call_tool("list_funcs", {
        "queries": [{"offset": page["next_offset"], "count": 50}]
    })[0]

`func_query`

Richer function filtering than list_funcs. Supports size bounds, type info requirements, regex on names, and explicit sort order.

queries

FunctionQuery | list[FunctionQuery]

required

One or more FunctionQuery objects.

Show FunctionQuery fields

filter

string

Glob/substring filter on function name.

name_regex

string

Regular expression matched against function names.

min_size

integer

Minimum function size in bytes (inclusive).

max_size

integer

Maximum function size in bytes (inclusive).

has_type

boolean

When true, only return functions that have type information; false returns those without.

sort_by

string

default:"addr"

Sort key: "addr", "name", or "size".

descending

boolean

default:"false"

Reverse the sort order.

offset

integer

default:"0"

Pagination offset.

count

integer

default:"50"

Maximum results per page.

Returns: list[FunctionQueryPage] — each page has data, next_offset, and an optional error.

# Find large functions without type info, sorted by size descending
results = mcp.call_tool("func_query", {
    "queries": [{
        "min_size": 200,
        "has_type": False,
        "sort_by": "size",
        "descending": True,
        "count": 20,
    }]
})
for fn in results[0]["data"]:
    print(fn["name"], fn["size"])

`list_globals`

Lists named global variables (all IDA names that are not function starts) with optional filtering and pagination. Accepts the same ListQuery shape as list_funcs.

queries

ListQuery | list[ListQuery]

required

Pagination queries; the same filter, offset, count fields as ListQuery.

Returns: list[Page[Global]] — each Global has addr and name.

page = mcp.call_tool("list_globals", {"queries": [{"filter": "g_*", "count": 50}]})[0]
for g in page["data"]:
    print(g["name"], g["addr"])

`entity_query`

A unified query interface for any entity kind in the database. Supports projection (select only certain fields), address bounds, segment filtering, and sorting.

queries

EntityQuery | list[EntityQuery]

required

One or more EntityQuery objects.

Show EntityQuery fields

kind

string

required

Entity type: "functions", "globals", "imports", "strings", or "names".

filter

string

Glob/substring filter on the primary text field (name for most kinds, text for strings).

regex

string

Regular expression applied after filter.

min_addr

string

Lower address bound (hex or decimal string).

max_addr

string

Upper address bound (hex or decimal string).

segment

string

Segment name filter (applies to functions, globals, strings, names).

module

string

Import module filter (applies to imports only).

sort_by

string

default:"addr"

Sort key: "addr", "name", "size", or "length".

descending

boolean

default:"false"

Reverse the sort order.

offset

integer

default:"0"

Pagination offset.

count

integer

default:"100"

Maximum results. Use 0 for all.

fields

list[string]

Projection: restrict returned fields to this list. The "kind" field is always included.

Returns: list[EntityQueryPage] — each page has kind, data, next_offset, total, and an optional error.

results = mcp.call_tool("entity_query", {
    "queries": [{"kind": "functions", "segment": ".text", "sort_by": "size", "descending": True}]
})

`imports`

Simple paginated listing of all imported symbols with their module names.

offset

integer

required

Starting pagination index. Use 0 for the first page.

count

integer

required

Maximum number of rows to return. Use 0 to return all imports.

Returns: Page[Import] — each Import has addr, imported_name, and module.

page = mcp.call_tool("imports", {"offset": 0, "count": 100})
for imp in page["data"]:
    print(imp["module"], imp["imported_name"], imp["addr"])

`imports_query`

Richer import filtering with name and module glob patterns.

queries

ImportQuery | list[ImportQuery]

required

One or more ImportQuery objects.

Show ImportQuery fields

filter

string

Glob/substring filter on the imported symbol name.

module

string

Glob/substring filter on the module name.

offset

integer

default:"0"

Pagination offset.

count

integer

default:"100"

Maximum results per page.

Returns: list[ImportsQueryPage] — each page has data (list of Import) and next_offset.

results = mcp.call_tool("imports_query", {
    "queries": [{"module": "ntdll", "filter": "Rtl*"}]
})
for imp in results[0]["data"]:
    print(imp["imported_name"])

`int_convert`

Converts numbers to multiple representations simultaneously. This is the recommended tool when an AI needs to convert between hex, decimal, binary, or ASCII — using it avoids hallucinated conversions. Accepts any Python int() literal as input: "42", "0x2a", "0b101010", "0o52".

inputs

NumberConversion | list[NumberConversion]

required

One or more conversion requests. Each NumberConversion supports:

Show NumberConversion fields

text

string

required

Number string to convert (any base prefix understood by int(s, 0)).

size

integer

Byte width for the little-endian bytes representation. Auto-detected when omitted.

Returns: list[IntConvertResult]

input

string

required

The original input string.

result

object | null

required

A ConvertedNumber with fields decimal, hexadecimal, bytes (space-separated hex), ascii (printable ASCII or null), and binary.

error

string | null

required

Error description when conversion fails, otherwise null.

results = mcp.call_tool("int_convert", {
    "inputs": [{"text": "0x48656c6c6f", "size": 5}]
})
r = results[0]["result"]
print(r["decimal"])      # "311256516456"  (little-endian)
print(r["bytes"])        # "48 65 6c 6c 6f"
print(r["ascii"])        # "Hello"

Always use int_convert instead of asking an LLM to convert numbers. LLMs frequently make off-by-one errors and byte-order mistakes during manual conversion.

`idb_save`

Saves the active IDB database to disk. By default saves to the current IDB path; pass a destination path to save elsewhere.

path

string

default:""

Destination file path. When empty or omitted, saves to the current IDB path.

Returns: IdbSaveResult

boolean

required

true if the save succeeded.

path

string | null

required

The path the file was saved to.

error

string

Present only when ok is false.

result = mcp.call_tool("idb_save", {})
print(result["ok"], result["path"])

# Save a backup copy
mcp.call_tool("idb_save", {"path": "/backups/analysis_checkpoint.i64"})

idb_save writes to disk immediately. In headless idalib sessions, saving to the original IDB path is the only way to persist annotations across sessions.

Core & Analysis

Modification

Advanced

Core tools: functions, globals, imports, and health

`server_health`

`server_warmup`

`lookup_funcs`

`list_funcs`

`func_query`

`list_globals`

`entity_query`

`imports`

`imports_query`

`int_convert`

`idb_save`

Build docs developers (and LLMs) love

Core & Analysis

Modification

Advanced

Documentation Index

​server_health

​server_warmup

​lookup_funcs

​list_funcs

​func_query

​list_globals

​entity_query

​imports

​imports_query

​int_convert

​idb_save

Build docs developers (and LLMs) love

`server_health`

`server_warmup`

`lookup_funcs`

`list_funcs`

`func_query`

`list_globals`

`entity_query`

`imports`

`imports_query`

`int_convert`

`idb_save`