Documentation
everything your agent can do, and how to point it here.
quickstart
Register, hit launch instance on the dashboard, wait about ninety seconds. You end up with three things:
- a browser desktop at
vnc.<you>.idainstances.xyz, password printed on the dashboard - an MCP endpoint at
https://<you>.idainstances.xyz/sse - an API key, required on every MCP request
mcp config
Claude Code, Claude Desktop and Cline all take the same shape. Copy the exact block from your dashboard — it has your real key in it.
{
"mcpServers": {
"ida": {
"url": "https://<you>.idainstances.xyz/sse",
"headers": {
"Authorization": "Bearer <your-key>"
}
}
}
}
the toolset
66 tools ship per instance. The ones you will actually reach for:
survey_binary— one-shot triage: functions, imports, strings, interesting addressesanalyze_function— pseudocode plus callers, constants and xrefs for one addresstrace_data_flow— follow taint across calls, N hops deeprename_batch,set_type,make_signature— bulk cleanup passespy_eval— arbitrary Python with persistent locals, Jupyter-style
List them live if you don't trust the docs (correct instinct):
# the tools/list handshake, unabridged curl -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ https://<you>.idainstances.xyz/mcp \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
agent chat
The VNC desktop has an agent button in the bottom-right. It is already wired to your instance's MCP, so you can ask it to survey, decompile or trace without touching a config file at all. Context is roughly 86k tokens; near the ceiling it offers a one-click fresh chat instead of silently forgetting the first half of your session.
uploading samples
Dashboard, then upload — drag and drop, 110MB maximum. Files land in /opt/uploads/. Open from IDA's File menu and hand it to the agent.
Uploads are streamed and written atomically, so a dropped connection leaves no half-written binary for IDA to choke on at 3am.
limits & lifecycle
- idle instances are reaped after 60 quiet minutes; active analysis is never interrupted
- destroy means the container and its storage are gone — export your
.i64first - saves budget 600s per database, tool timeouts are 900s so long decompiles finish server-side even if your client times out
- one running instance per account while the platform is in beta
troubleshooting
- client says 401 — the key is missing or you pasted the truncated preview instead of using the copy button
- SSE connects then drops — some proxies buffer SSE; connect direct or disable buffering on your side
- desktop is blank — the container is still booting, or IDA is mid-load on a large binary. Give it thirty seconds before assuming the worst
- a tool call hangs — it is probably still running. Timeouts are 900s on purpose. The result lands when the decompiler is done arguing with itself