A modern ecosystem for discovering, installing, and sharing IDA plugins
The IDA community has created more than 800 plugins and extensions over the years. Today, we're introducing the IDA Plugin Manager - a modern, self-service ecosystem that makes extending IDA as simple as this:
Browse over 180 active plugins at plugins.hex-rays.com, install them with automatic dependency resolution, and publish your own plugins through a transparent, self-service ecosystem built on GitHub.
The Plugin Manager is currently built into HCLI, Hex-Rays' command-line tool.
I always used to have a love-hate relationship with IDA plugins: the right plugin could make my analysis so much easier, but initially finding it and then keeping it updated was almost impossible. I’d rely on tips from my friends for the best plugins, but that surely meant missing new ideas. And when migrating to a new system, I could rarely remember where to download the plugin and how I had configured it.
The new IDA Plugin Manager addresses these challenges: it provides a centralized place to explore what’s available and makes installation, configuration, and updating single commands and/or button clicks. Buckle up and strap in as we tour the key commands, overall architecture, specific design points and enhancements, and the pending roadmap.
To get started, visit plugins.hex-rays.com to browse the updated Plugin Repository in your web browser. You can explore plugins by category, search by keyword, and read detailed descriptions. Look for the "Plugin Manager Compatible" badge on plugin entries to identify which plugins support easy installation. This number grows weekly as more authors package their plugins and as Hex-Rays proposes packaging changes via PRs under our HexRays-plugin-contributions GitHub account.
From the command line, searching is equally straightforward. Use the Hex-Rays CLI (HCLI) tool to list all the available plugins:
The Plugin Manager automatically detects your IDA version and platform, showing you only compatible plugins. Incompatible plugins appear grayed out.
You can also search by plugin name or keyword to find plugins for specific tasks:
Once you've found a plugin, installation is a single command:
While it’s only a few lines of output, quite a bit happened:
Our goal was to take all the manual toil out of IDA plugin installation and make it as streamlined as possible. Ideally you shouldn’t have to edit Python source files or invoke pip anymore to upgrade your IDA experience.
You can check the status of installed plugins like this, which is helpful to figure out what can be upgraded to newer versions:
(As I write this blog post, I want to be able to see the plugin release notes for pending upgrades, so we’ll have to design and build that! Unfortunately the Plugin Manager doesn’t do this yet.)
And you can use hcli plugin upgrade and hcli plugin uninstall to… upgrade and uninstall plugins.
The Plugin Manager works with IDA Pro 9.0 and above, bringing modern package management to recent IDA versions.
When designing the Plugin Manager, we wanted to build an ecosystem where plugin authors can publish without gatekeeping, users can verify what they're installing, and the entire process is transparent. We've achieved this by open sourcing all the components and hosting the repository index on GitHub.
Here's how it works. The ecosystem has three core components:
We use GitHub today because it's the most prevalent platform where IDA plugins are hosted. However, we're not permanently tied to GitHub - it's simply the starting point. As the ecosystem grows and we hear from users who prefer other platforms, we can extend the indexer to support additional code forges.
One of the most significant improvements brought about by the Plugin Manager is automatic Python dependency installation. Plugin authors declare their requirements in ida-plugin.json, and the Plugin Manager handles installation automatically.
The plugin repository contains an explicit denylist for malicious or problematic plugins. All moderation actions are visible in the repository's git history as edits to the file - no behind-the-scenes removals. If you encounter a suspicious plugin, report it through the repository's issue tracker or support@hex-rays.com, and the Hex-Rays team will investigate.
We're also designing a solution for centralized plugin configuration. Many plugins need access to API keys, preferences, or other settings. Historically, each plugin handled this differently, some by asking users to edit source files, while others used configuration files stored in various locations.
We’ll introduce a standardized approach in which plugins can declare their settings in ida-plugin.json, and the manager prompts users during installation. Settings are stored in a central location ($IDAUSR/ida-config.json) and can be managed through HCLI or (eventually) through a GUI within IDA itself. This means:
This infrastructure is actively being developed using the ida-settings library.
The Plugin Manager ecosystem is growing rapidly, with dozens of plugins already available and more being packaged right now. If you've developed an IDA plugin, or are thinking about creating one, now is the perfect time to join the ecosystem. We think the Plugin Manager will bring some immediate benefits:
Plus, upcoming initiatives will further boost visibility. The IDA Plugin Contest will require Plugin Manager-compatible submissions, meaning all contest entries will be immediately installable by the community. Every interesting tool from the contest will be just one command away.
By the way, the Plugin Contributor Program provides free IDA licenses to plugin researchers, developers, and maintainers who are actively building tools for the community. If you’d like to take part in the IDA plugin community, but don’t have a license, reach out to contributor@hex-rays.com!
Publishing an IDA plugin via the Plugin Repository is self-service and requires three steps:
As described on docs.hex-rays.com, each plugin needs an ida-plugin.json metadata file that describes your plugin. Here’s a basic example:
The required fields are name, version, entryPoint, urls.repository, and authors. Everything else is optional but recommended for better discoverability. Additional fields let you target specific versions and/or platforms, show up in more search results, declare settings fields, and more.
For a complete reference of all available fields, see:
For Pure Python Plugins (the easy path):
Most Python plugins require minimal work. Add ida-plugin.json to your repository, and GitHub's automatically generated source archive becomes your plugin archive. That's it.
If your plugin depends on external Python packages, declare them:
For Native (C/C++) Plugins:
Compiled plugins require building .dll, .so, and .dylib files for different platforms. GitHub Actions provides the best experience that I’ve found, though it's not strictly required - any CI/CD system that produces ZIP artifacts can work. Ultimately, you'll need to archive the native shared library with the ida-plugin.json metadata file and distribute it via GitHub Releases.
We provide workflow templates and are happy to help. See Hex-Rays-maintained BinDiff build workflow as a reference implementation. It uses HCLI to fetch IDA SDKs, ida-cmake for configuration, and builds across Windows, Linux, and macOS runners.
Tag your release following semantic versioning (e.g., v1.0.0), and attach any necessary build artifacts. For pure Python plugins, the source archive is often sufficient. For native plugins, attach the ZIP archives containing compiled assets.
The daily indexer will discover your plugin automatically.
Note on Discovery: The indexer uses GitHub's code search API to find repositories containing ida-plugin.json files. If you've published your plugin but it hasn't appeared after 24 hours, this may be due to GitHub’s indexing latency or other limitations. In these cases, you can explicitly register your repository by adding it to known-repositories.txt via pull request, which ensures your plugin is discovered on the next indexer run.
Validate your plugin locally before releasing:
The linter catches common problems: missing required fields, JSON syntax errors, incorrect entry points, invalid dependency names, and more. Fix any issues before releasing. The indexer won't add invalid plugins to the repository, so the first step to triaging a missing plugin is to ensure there are no lint failures.
Need assistance? We're here to help. The Hex-Rays team actively supports plugin authors through the packaging process. Contact us through the repository or reach out to support@hex-rays.com.
Many plugins require configuration: API keys for LLM services, custom paths, user preferences, etc. The Plugin Manager introduces a standardized configuration system that works consistently across all plugins.
When installing a plugin that requires settings, the Plugin Manager prompts you interactively:
For non-interactive environments (CI/CD, scripts), provide settings via command-line flags:
View and update plugin settings at any time:
Settings are stored in $IDAUSR/ida-config.json, making it easy for teams to script backups or version control their configurations. However, be careful: this file may contain sensitive data like API keys, so avoid committing it to public repositories.
GUI Support Coming Soon: We're developing a graphical settings editor that works directly within IDA. Install the preview with hcli plugin install ida-settings-editor to manage plugin configurations through a native IDA interface.
Plugin authors declare their settings in ida-plugin.json:
Read settings in your plugin code using the ida-settings library:
This standardized approach ensures all plugins use the same configuration mechanism, so users never need to hunt through source files or scattered config directories. Settings are portable, meaning that you can export and import them. Future versions will support editing through IDA's native GUI, bringing everything into one place.
Migrating existing plugins? Adopting the centralized settings system may require refactoring how your plugin handles configuration. We're here to help - reach out through the GitHub repository or support channels, and we'll work with you to smooth the transition.
The Plugin Manager launches with a strong foundation, but we have further plans for the ecosystem.
Native IDA GUI for Plugin Management While HCLI provides command-line functionality, we're designing a GUI within IDA Pro itself. Browse, install, upgrade, and configure plugins without leaving your analysis environment. We may have to tweak the plugin lifecycle to enable plugins to be reloaded and/or upgraded within the same IDA session.
Enhanced Settings Management Building on the ida-settings foundation, we're expanding the centralized configuration system. The ida-settings project will enable richer configuration options and seamless integration with the IDA GUI. We'd love to support hierarchical settings, layered across the: IDB, workspace, user, and/or organization. Perhaps if this is successful, we can migrate more of IDA's settings management to a similar design.
Offline Installation Support for airgapped networks and virtual machines with Host-Only networking is coming. Export a plugin bundle on a connected machine, transfer it to your isolated environment, and install without internet access. We may also distribute an initial set of plugins with the IDA installer, so you can easily bootstrap common workflows.
The plugin repository expands weekly as authors package their tools and new developers join the community. We're seeing plugins across all categories: UI improvements (ShowComments and deREferencing), mobile reversing (iOSHelper), firmware analysis (efiXplorer), vibe reversing (gepetto), and more.
This is just the beginning. The Plugin Manager provides a better foundation for an ecosystem where innovation can flourish. We're excited to see what the community builds.
Explore the plugin ecosystem by visiting plugins.hex-rays.com to browse available plugins in your browser. Then, install HCLI. For detailed installation instructions, see Introducing HCLI or visit hcli.docs.hex-rays.com.
Then, install your first plugin:
Package your plugin:
Read the packaging guide at hcli.docs.hex-rays.com/reference/packaging-your-existing-plugin
Validate before releasing:
Your users are waiting. Make your plugin discoverable, simplify installation, and reach more IDA Pro users than ever before.
Need help?
The foundation is built. The ecosystem is growing. Now it's your turn to explore, install, and create.