IDAssist is an IDA Pro plugin that integrates LLM-powered analysis directly into IDA's interface, providing AI-assisted binary reverse engineering through configurable LLM providers, semantic knowledge graphs, RAG document search, and collaborative symbol sharing via SymGraph.

Built with Python and PySide6, IDAssist runs as a dockable panel inside IDA Pro 9.0+ and communicates with LLM providers (OpenAI, Anthropic, Ollama, LiteLLM, and more) to analyze functions, suggest renames, answer questions about code, and build a searchable knowledge graph of an entire binary.

Core Features

Function Explanation — Generate detailed natural-language explanations of decompiled functions with automatic security analysis including risk level, activity profile, security flags, and API detection.

Interactive Query Chat — Ask questions about the binary with persistent chat history. Use context macros (#func, #addr, #line, #range) to inject function code, addresses, or disassembly ranges into queries.

Automated Actions — AI-powered rename suggestions for functions, variables, and types. Review proposed changes in a table with confidence scores, then apply selected actions back to the IDB.

Semantic Knowledge Graph — Build and explore a knowledge graph of the binary's functions, call relationships, data flows, and security characteristics. Includes visual graph rendering, semantic search, and community detection.

RAG Document Search — Upload reference documents (.txt, .md, .rst, .pdf) and use them as context during LLM queries. Supports hybrid text+vector search via Whoosh indexing.

SymGraph Integration — Push and pull function names, variable names, types, and graph data to the SymGraph collaborative platform. Includes a multi-step wizard with conflict resolution for pulls.

Settings Management — Configure multiple LLM and MCP providers, manage SymGraph API credentials, customize the system prompt, and set database paths.

Advanced Capabilities

ReAct Agent

The Query tab supports an autonomous ReAct (Reasoning + Acting) agent mode. When enabled, the LLM plans an investigation strategy, executes tools to gather information, reflects on findings, and synthesizes a comprehensive answer — all automatically across multiple reasoning rounds.

Extended Thinking

Configure reasoning effort levels to control how much the LLM "thinks" before responding:

Level	Thinking Budget	Best For
None	Disabled	Fast, simple queries
Low	~2K tokens	Straightforward analysis
Medium	~10K tokens	Moderate complexity
High	~25K tokens	Deep analysis, complex code

MCP Integration

IDAssist includes a built-in MCP (Model Context Protocol) server and can connect to external MCP servers. This enables tool-augmented LLM interactions where the model can programmatically inspect functions, read disassembly, query cross-references, and modify the IDB during reasoning.

Function Calling

LLM providers with tool-calling support can invoke IDA analysis functions mid-conversation, enabling iterative investigation without manual intervention.

RLHF Feedback

Provide thumbs-up/thumbs-down feedback on explanations and query responses. Feedback is stored locally and can be used to improve prompt engineering and model selection.

Architecture

IDAssist follows an MVC (Model-View-Controller) pattern:

Views (src/views/) — PySide6 tab widgets that emit signals on user interaction
Controllers (src/controllers/) — Connect view signals to service calls, manage state
Services (src/services/) — Business logic, LLM providers, database access, graph analysis
MCP Server (src/mcp_server/) — Built-in SSE server exposing IDA functionality as MCP tools

Key design principles:

All IDA API calls execute on the main thread via execute_on_main_thread()
LLM responses stream incrementally to the UI
Local SQLite databases for persistence (no external database required)
Singleton service registry with thread-safe initialization

Quick Start

Install dependencies:
```
pip install -r requirements.txt
```

Install the plugin: Copy idassist_plugin.py and the src/ directory to your IDA plugins folder:

cp idassist_plugin.py ~/.idapro/plugins/
cp -r src ~/.idapro/plugins/

Or create file-level symlinks for development:

ln -s /path/to/IDAssist/idassist_plugin.py ~/.idapro/plugins/idassist_plugin.py
ln -s /path/to/IDAssist/src ~/.idapro/plugins/src

Open IDAssist: Launch IDA Pro, open a binary, and press Ctrl+Shift+A (or Edit > Plugins > IDAssist).
Configure a provider: Go to the Settings tab, click Add under LLM Providers, and configure your preferred provider.
Analyze a function: Navigate to any function, click the Explain tab, and press Explain Function.

For detailed setup instructions, see Getting Started.

LLM Provider Setup

IDAssist supports the following provider types:

Type	Auth Method	Notes
`anthropic_platform`	API Key	Anthropic API direct
`anthropic_oauth`	OAuth (browser)	Browser-based authentication
`anthropic_claude_cli`	Local CLI	Uses the `claude` CLI binary
`openai_platform`	API Key	OpenAI API direct
`openai_oauth`	OAuth (browser)	Browser-based authentication
`ollama`	None (local)	Self-hosted models
`litellm`	Proxy URL	Multi-provider proxy

Recommended Models

Provider	Model	Strengths
Anthropic	`claude-sonnet-4-6`	Strong code analysis, extended thinking
OpenAI	`gpt-4o`	Fast, good general analysis
OpenAI	`o1`	Deep reasoning with extended thinking
Ollama	`qwen2.5-coder:32b`	Local, no API key needed

Using the Built-in MCP Server

IDAssist runs an MCP server on port 8765 (SSE transport) that exposes IDA functionality as tools. External LLM clients can connect to http://localhost:8765/sse to use these tools:

Tool	Description
`ida_get_function_name`	Get function name at address
`ida_get_disassembly`	Get disassembly snippet
`ida_get_pseudocode`	Get Hex-Rays decompilation
`ida_get_xrefs`	Get cross-references
`ida_set_function_name`	Rename a function
`ida_add_comment`	Add comment at address

Resources are also available: binary/info, binary/functions, function/{address}.

Using the Semantic Graph

The Semantic Graph tab provides a knowledge graph of the binary:

ReIndex Binary — Extracts function structure, call graph, and cross-references
Semantic Analysis — Generates LLM summaries for each function
Security Analysis — Detects vulnerability patterns and security-relevant APIs
Network Flow — Tracks network operations across the call graph
Community Detection — Groups related functions into modules

Explore the graph via the List View (callers, callees, edges, flags), Visual Graph (interactive node diagram with N-hop expansion), or Search (7 query types including semantic search, similar functions, and call context).

Right-click in any Disassembly or Pseudocode view to access:

Action	Hotkey	Effect
Explain Function	`Ctrl+Shift+E`	Opens Explain tab and generates explanation
Ask About Selection	`Ctrl+Shift+Q`	Opens Query tab with `#func` context
Rename Suggestions	—	Opens Actions tab and generates suggestions

Requirements

IDA Pro 9.0+ with Python 3 and PySide6
Hex-Rays Decompiler (recommended for pseudocode features)
Python packages listed in requirements.txt

Documentation

Documentation Index
Getting Started
Tab References: Explain | Query | Actions | Semantic Graph | RAG | Settings
Workflows: Explain | Query | Semantic Graph

Homepage

https://symgraph.io

License

See LICENSE file for details.

README.md

IDAssist

Description