ida-reverse

This module is primarily a local service orchestrator: it locates (or bootstraps) the IDA MCP server executable, kills prior instances, starts the server hidden on 127.0.0.1, and polls a localhost JSON-RPC endpoint for readiness. No direct malicious payload or external exfiltration is evident in the fragment itself. The main security risk is supply-chain execution: it runs a repo-relative bootstrap script using powershell.exe with -ExecutionPolicy Bypass, which could download/modify code depending on the bootstrap script’s integrity. Hidden server start and broad process termination are additional caution flags, but they are consistent with dev tooling.