analysisTriage and audit IDA binaries. Use when asked to analyze a binary, find suspicious behavior, detect crypto/network activity, review decompiled code against source, or run multi-table queries.
annotationsEdit IDA databases. Use when asked to add comments, rename symbols, apply types, create bookmarks, write the database notepad, clean up decompiled code for review, or take undo checkpoints and roll edits back.
connectConnect to IDA databases and bootstrap sessions. Use when starting analysis, routing to other skills, setting up CLI/HTTP/MCP connections, or reading and changing IDA configuration options.
dataQuery IDA strings, bytes, and binary data. Use when asked to search strings, find byte patterns, rebuild string tables, or analyze binary content.
debuggerIDA debugger operations. Use when asked to set breakpoints, patch bytes, add conditions, or manage a patch inventory.
decompilerDecompile and analyze IDA functions. Use when asked for pseudocode, ctree AST analysis, local variables, labels, split expressions, or decompiler-driven cleanup.
deep-linksMake GUI-connected IDA answers clickable with ida:// deep links. Use for functions, addresses, strings, types or imports the user may want to open in IDA, pasted link results, or explicit navigation requests. For a known fully headless target, answer with plain names and addresses: no deep links, an
disassemblyQuery IDA disassembly. Use when asked about functions, segments, instructions, blocks, operands, control flow, raw code structure, or FLIRT signatures (apply / list / which functions are library code).
functionsComplete idasql SQL function reference catalog. Use when looking up function signatures, parameters, or usage examples.
grepSearch named IDA entities by pattern. Use when asked to find functions, labels, types, or members by name, or to seed xref/decompiler workflows from a name lookup.
idapythonExecute IDAPython via idasql, and query idasql from IDAPython with import idasql. Use when SQL surfaces are insufficient and direct IDA SDK access is needed via Python snippets or scripts, or when a script or plugin inside IDA needs SQL over the open database.
re-sourceRe-source IDA binaries. Use when asked for recursive annotation, structure recovery, type reconstruction, or bottom-up program understanding.
storagePersistent key-value storage in IDA databases. Use when asked to store metadata, track progress, or persist session state via netnode_kv.
typesIDA type system. Use when asked to create, modify, or apply structs, unions, enums, typedefs, or parse C declarations.
ui-contextCapture live IDA UI context. Use when the user references what's on screen, what's selected, or asks about the current view in IDA's GUI.
xrefsAnalyze IDA cross-references. Use when asked about callers, callees, imports, data refs, call graphs, or dependency chains.