mrexodia/ida-pro-mcp — agentic threat model

Not certain from the listing — The agent acts as an MCP server and is model-agnostic. However, the model driving it is highly vulnerable to indirect prompt injection if malware binaries contain embedded instructions designed to hijack the decompiler's output or analysis reports.

The primary data operations involve ingesting binary files, disassembly, and decompilation outputs. The primary threat is data poisoning or malicious payloads embedded within untrusted binaries designed to exploit parser vulnerabilities in IDA Pro or the MCP bridge.

The agent framework is built on the Model Context Protocol (MCP). Insecure tool integration is a major threat, as the LLM can invoke powerful IDA Pro APIs, potentially leading to arbitrary script execution within the IDA environment if the tool inputs are not strictly sanitized.

Not certain from the listing — The deployment context of IDA Pro and the MCP server is unspecified. If run locally or in an unsandboxed environment, a compromise of the IDA Pro instance via a malicious binary could lead to host compromise and lateral movement.

Not certain from the listing — There is no mention of built-in logging, guardrails, or anomaly detection to monitor the commands sent by the LLM to the IDA Pro plugin, creating a blind spot for malicious tool usage.

Not certain from the listing — The tool lacks explicit authentication, authorization, or access control policies, relying entirely on the security of the transport layer and the host environment running the MCP server.

The agent is designed to plug into broader MCP-based multi-agent ecosystems. If another agent in the chain is compromised, it could abuse this agent to execute arbitrary reverse-engineering tasks or extract sensitive intellectual property from analyzed binaries.