Skip to main content

rea-mcp

Reverse engineer anything from your terminal or agent — one CLI and one MCP server.

Attribution and disclaimer

This is an unofficial Python port of morluto/rea. The original project is a TypeScript implementation. This port exists because our Python-based AI agent products (aacode, fastclaw) need a native Python integration. Not affiliated with or endorsed by the original authors. Licensed under MIT.

See DISCLAIMER.md for responsible-use guidance and THIRD_PARTY_NOTICES.md for dependency and tool notices.

rea-mcp is a provider-neutral reverse-engineering engine that returns traceable, evidence-carrying, reusable results, exposed through a shared CLI and MCP (Model Context Protocol) server. Its design follows the ideas behind morluto/rea, including the Evidence model: every result carries its identity, confidence, authority, limitations, and unresolved unknowns, so an AI agent (or a person) can reason honestly instead of trusting a bare answer.

Status: alpha (0.1.1) — static-analysis MVP with built-in static providers, the Evidence model, snapshot caching, and the shared CLI/MCP surface.

What you can analyze

Target What rea-mcp returns Requires
ELF / PE / Mach-O Sections, segments, entrypoint, symbols, exports/imports, mitigations built-in
Go binaries Embedded compiler version, modules, replacements, build settings built-in
Rust binaries cargo-auditable dependency inventory and edges built-in
.NET assemblies PE/CLI metadata, member names, per-method IL disassembly built-in
SQLite databases Tables, columns, indexes, views, triggers built-in
Zip / tar / ASAR packages File inventory and digests built-in
Android APK Zip inventory, DEX headers, manifest package facts built-in
Flutter apps Dart AOT snapshot fingerprint and URI counts per ABI built-in
WASM modules Validation, sections, decoded WAT built-in (WAT needs WABT)
Property lists XML/binary plist and NSKeyedArchiver inventory built-in
HarmonyOS HAP Package facts and entry hashes built-in
JavaScript / Electron Module graph and IPC boundaries (directory or ASAR) built-in
PE resources Resource types and counts built-in
Reference source Source-tree inventory: files, sizes, digests, languages built-in
EVM bytecode Dispatch selectors, arguments, mutability evmole
Network captures HAR/SAZ requests, hosts, status built-in
Live traffic Capture through a proxy mitmproxy
Saved captures (pcap) Protocol hierarchy and endpoints tshark
Firmware images Region/signature scan binwalk
Native disassembly File/section headers objdump
Deep native analysis Overview, functions, pseudocode, xrefs, search Rizin (rzpipe)
Ghidra Functions and pseudocode pyhidra + Ghidra + JDK
Hopper Overview, functions, pseudocode, xrefs Hopper + bridge/hopper_bridge.py
IDA / JEB Endpoint probe REA_IDA_MCP_URL / REA_JEB_MCP_URL
Frida Device inventory frida
Browser Page observation playwright + REA_BROWSER_EXECUTABLE
Recorded crashes Register/signal extraction REA_PWNTOOLS_PYTHON + pwntools

External-tool providers are caller-supplied: rea-mcp never installs them and reports an actionable reason when one is missing (rea-mcp doctor). Cross-cutting tools: compare (Evidence diff), capture-process (bounded runtime capture), doctor (readiness), setup, update, and evidence-export / evidence-import / inspect-analysis-view (portable Evidence).

All analysis runs locally. rea-mcp never uploads your target.

Quick start

pip install rea-mcp             # PyPI distribution name is "rea-mcp"
rea-mcp --help                  # "rea" and "rea-python" are installed as alias commands too
rea-mcp inspect-binary-layout /path/to/program --json

As an MCP server (stdio) — rea-mcp, rea, and rea-python are interchangeable, as are python -m rea_mcp, python -m rea, and python -m rea_python:

rea-mcp mcp     # or: rea mcp   |   rea-python mcp
rea mcp

Import names

The implementation package is rea_mcp. Compatibility aliases make import rea and import rea_python resolve to the same module objects, so all three import paths are interchangeable:

import rea_mcp      # implementation
import rea          # alias, same objects
import rea_python   # alias, same objects

Design principles

  1. Dependencies flow inward: domain → contracts → providers → application → cli/mcp.
  2. Evidence first: observations, derivations, inferences, and unknowns are distinguished.
  3. Ownership and cleanup: resources are only cleaned by their owner; failures stay explicit.
  4. Token-first performance: summaries, paging, and retained evidence keep agent context small.

Development

python -m venv .venv && . .venv/bin/activate
pip install -e ".[dev]"
pytest
ruff check .
mypy

License

MIT. rea-mcp is an independent, unofficial Python port; it is not affiliated with or endorsed by the authors of REA. See LICENSE and DISCLAIMER.md.

Metadata

Release files for rea-mcp 0.1.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for rea-mcp 0.1.1
File Size Uploaded
rea_mcp-0.1.1.tar.gz 97.5 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for rea-mcp 0.1.1
File Interpreter ABI Platform
rea_mcp-0.1.1-py3-none-any.whl Python 3 none any Details

Total release size: 223.6 kB

Release files / rea_mcp-0.1.1.tar.gz

Download URL rea_mcp-0.1.1.tar.gz
Size 97.5 kB
Tags Source
SHA-256 checksum
How to use checksums
293cc688ea1561c65c1245e38274665e716c1d0ba27177ff9f8095d4789d581d
BLAKE2b-256 checksum
How to use checksums
822764c26cac0b0d66e895dfc2266cbd430b7c82f0839585d78e3e688a6d24b5
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.12.6

Release files / rea_mcp-0.1.1-py3-none-any.whl

Download URL rea_mcp-0.1.1-py3-none-any.whl
Size 126.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
c69dc32d3eed3fc7518e86fe509b9e83a7199b39246d5396b7c13fe310dce5f2
BLAKE2b-256 checksum
How to use checksums
7b4d3d38695a0a326adcf9d0355ee578c58295a1165cdf5a213363d6730cebac
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.12.6

Release history Release notifications | RSS feed

0.1.3

2 release files

0.1.2

2 release files

This release

0.1.1 This release

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page