ida_domain_mcp

The server exposes powerful IDA Pro functionalities, including arbitrary assembly patching (`patch_address_assembles`) and direct access to IDA's internal APIs (`ida_tools.py` via `getattr`). An attacker or compromised client could use these capabilities to modify binaries, access local files, or potentially execute arbitrary code within the IDA Pro environment. The use of `multiprocessing.Pipe` and `getattr` for tool execution, while common, means a malicious client with access to the MCP endpoint could invoke any exposed function with arbitrary arguments. The default HTTP SSE transport binds to localhost, mitigating remote exploitation, but still poses a risk if local access is gained or if exposed externally without explicit authentication/authorization, which is not provided by the server itself. Careful consideration of client trust and network exposure is critical.