rea-python(rea-mcp)
Reverse engineer anything from your terminal or agent — one CLI and one MCP server.
Attribution and disclaimer
This is an unofficial Python port of morluto/rea. The original project is a TypeScript implementation. This port exists because our Python-based AI agent products (aacode, fastclaw) need a native Python integration. Not affiliated with or endorsed by the original authors. Licensed under MIT.
See DISCLAIMER.md for responsible-use guidance and THIRD_PARTY_NOTICES.md for dependency and tool notices.
Lawful use
The project's position on illegal or unauthorized use covers all REA versions, distribution channels, and platforms; each copy retains its applicable licenses.
REA is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.
Commercial tools
You must legally obtain and be authorized to use commercial tools, including IDA Pro / Hex-Rays decompilers, Hopper, and JEB, under their applicable licenses. REA grants no tool license, key, or activation entitlement. Trials and demos remain subject to vendor terms, including user, feature, automation, and output sharing restrictions. Cracked copies, stolen keys, unauthorized key sharing, and bypassing license restrictions are not authorized. This guidance does not amend MIT or third-party licenses.
Deep-engine configuration
| Engine | Configure | Notes |
|---|---|---|
| IDA | REA_IDA_MCP_CONFIG (an ida-pro-mcp registration JSON), or REA_IDA_MCP_URL / REA_IDA_MCP_COMMAND |
Speaks MCP over stdio or streamable HTTP |
| JEB | REA_JEB_MCP_URL (default http://127.0.0.1:8425/mcp) |
MCP streamable HTTP |
| Hopper | REA_HOPPER_BRIDGE (socket) and REA_HOPPER_BRIDGE_TOKEN (run token) |
Run bridge/hopper_bridge.py inside Hopper |
| Kuna | REA_KUNA_COMMAND (absolute path), optional REA_KUNA_TIMEOUT_MS |
Invokes kuna decompile ... |
| Ghidra | GHIDRA_INSTALL_DIR, JAVA_HOME; optional REA_GHIDRA_BRIDGE=pyhidra|pyghidra |
Auto-selects pyhidra (≤11.3) or pyghidra (≥11.4) |
| Frida | Attach by PID/process name; --spawn --allow-execute to launch |
Needs task_for_pid permission |
| macOS UI automation | --allow-ui |
Needs Accessibility permission |
rea-python is a provider-neutral reverse-engineering engine that returns traceable, evidence-carrying, reusable results, exposed through a shared CLI and MCP (Model Context Protocol) server. Its design follows the ideas behind morluto/rea, including the Evidence model: every result carries its identity, confidence, authority, limitations, and unresolved unknowns, so an AI agent (or a person) can reason honestly instead of trusting a bare answer.
Status: alpha (0.1.5) — full original CLI/MCP surface (169 tool names, 153 CLI commands) with built-in static providers, the Evidence model, snapshot caching, deep-engine adapters, workflow/evidence tools, and gated runtime observation.
What you can analyze
| Target | What rea-mcp returns | Requires |
|---|---|---|
| ELF / PE / Mach-O | Sections, segments, entrypoint, symbols, exports/imports, mitigations | built-in |
| Go binaries | Embedded compiler version, modules, replacements, build settings | built-in |
| Rust binaries | cargo-auditable dependency inventory and edges | built-in |
| .NET assemblies | PE/CLI metadata, member names, per-method IL disassembly | built-in |
| SQLite databases | Tables, columns, indexes, views, triggers | built-in |
| Zip / tar / ASAR packages | File inventory and digests | built-in |
| Android APK | Zip inventory, DEX headers, manifest package facts | built-in |
| Android deep | apktool resources/smali, JADX class/APK decompilation | apktool / JADX + JRE |
| Android device | Devices, packages, package dumps, bounded shell | adb + device |
| Flutter apps | Dart AOT snapshot fingerprint and URI counts per ABI | built-in |
| WASM modules | Validation, sections, decoded WAT | built-in (WAT needs WABT) |
| Property lists | XML/binary plist and NSKeyedArchiver inventory | built-in |
| HarmonyOS HAP | Package facts and entry hashes | built-in |
| JavaScript / Electron | Module graph and IPC boundaries (directory or ASAR) | built-in |
| PE resources | Resource types and counts | built-in |
| Reference source | Source-tree inventory: files, sizes, digests, languages | built-in |
| EVM bytecode | Dispatch selectors, arguments, mutability | evmole |
| Network captures | HAR/SAZ requests, hosts, status | built-in |
| Live traffic | Capture through a proxy | mitmproxy |
| Saved captures (pcap) | Packet fields, endpoints, DNS queries | built-in (tshark enriches) |
| Firmware images | Region/signature scan | built-in (binwalk enriches) |
| Web runtime | Page DOM, scripts, event handlers, screenshots, scenarios | playwright + Chromium |
| Electron / JS runtime | CDP targets, pages, runtime reconciliation | CDP endpoint |
| Debug sessions | GDB batch console, Rizin debug, Cutter bridge | gdb / rizin / Cutter bridge |
| Native proxy | Navigation, comments, names, procedures, xrefs | Rizin |
| Android deep | JADX class/method/reference search | JADX + JRE |
| Workflows | Call graph/path, feature trace, bundle and capture diffs | built-in |
| Mach-O signatures | CodeDirectory, CDHash, team/identifier, entitlements | built-in |
| Byte tools | Address-mapped reads and byte-pattern search | built-in |
| Application graphs | Android components/permissions, Apple bundles, Harmony abilities | built-in |
| Digital signals (VCD) | Signal inventory and 8N1 UART decode | built-in |
| Crash dumps | GDB/pwndbg register and backtrace summary | built-in |
| Apple bundles | Entitlements, keyed archive, Interface Builder, asset catalog | built-in |
| Electron apps | Fuse-wire security posture | built-in |
| Reconstruction | Obligation ledger and coverage evaluation | built-in |
| Native disassembly | File/section headers | objdump |
| Deep native analysis | Overview, functions, pseudocode, xrefs, search | Rizin (rzpipe) |
| Ghidra | Functions and pseudocode | pyhidra (Ghidra ≤11.3) or pyghidra (Ghidra ≥11.4) + JDK |
| Hopper | Overview, functions, pseudocode, xrefs | Hopper + bridge/hopper_bridge.py |
| IDA / JEB | Overview, functions, pseudocode, xrefs over HTTP | REA_IDA_MCP_URL / REA_JEB_MCP_URL |
| Frida | Devices, applications, processes | frida |
| Browser | Page observation | playwright + REA_BROWSER_EXECUTABLE |
| CDP runtime (Chrome/Electron) | Target inventory, live network metadata | built-in HTTP (websocket-client for capture) |
| Recorded crashes | Register/signal extraction | REA_PWNTOOLS_PYTHON + pwntools |
External-tool providers are caller-supplied: rea-mcp never installs them and reports an actionable reason when one is missing (rea-mcp doctor). Cross-cutting tools: compare / compare-network-captures / compare-web-captures / compare-managed-members (target and Evidence diffs), build-reconstruction-obligation-ledger / evaluate-reconstruction-coverage (reconstruction), capture-process (bounded runtime capture), doctor (readiness), setup (client registration, plus --write-all and --install-skill), update, and evidence-export / evidence-import / inspect-analysis-view (portable Evidence).
All analysis runs locally. rea-mcp never uploads your target.
Client schema profiles
Tool schemas can be projected per client to fit hosts with small frame or schema limits. Set REA_MCP_CLIENT to a preset (generic, claude, cursor, opencode, vscode/code, zed, minimal), or override with REA_MCP_INPUT_SCHEMA_PROFILE (full/compact) and REA_MCP_OUTPUT_SCHEMA_PROFILE (full/off). rea-mcp schema-matrix prints the full matrix; REA_MCP_COMPACT_BUDGET_BYTES caps a single compacted schema.
Quick start
pip install rea-mcp # PyPI distribution name is "rea-mcp"
rea-mcp --help # "rea" and "rea-python" are installed as alias commands too
rea-mcp inspect-binary-layout /path/to/program --json
As an MCP server (stdio) — rea-mcp, rea, and rea-python are interchangeable, as are python -m rea_mcp, python -m rea, and python -m rea_python:
rea-mcp mcp # or: rea mcp | rea-python mcp
rea mcp
Output is JSON by default; a bare --json flag is accepted (before or after the command) for compatibility.
Import names
The implementation package is rea_mcp. Compatibility aliases make import rea and import rea_python resolve to the same module objects, so all three import paths are interchangeable:
import rea_mcp # implementation
import rea # alias, same objects
import rea_python # alias, same objects
Design principles
- Dependencies flow inward: domain → contracts → providers → application → cli/mcp.
- Evidence first: observations, derivations, inferences, and unknowns are distinguished.
- Ownership and cleanup: resources are only cleaned by their owner; failures stay explicit.
- Token-first performance: summaries, paging, and retained evidence keep agent context small.
Development
python -m venv .venv && . .venv/bin/activate
pip install -e ".[dev]"
pytest
ruff check .
mypy
License
MIT. rea-mcp is an independent, unofficial Python port; it is not affiliated with or endorsed by the authors of REA. See LICENSE and DISCLAIMER.md.
Metadata
Release files for rea-mcp 0.1.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| rea_mcp-0.1.5.tar.gz | 181.4 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| rea_mcp-0.1.5-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 396.8 kB
Release files / rea_mcp-0.1.5.tar.gz
| Download URL | rea_mcp-0.1.5.tar.gz |
|---|---|
| Size | 181.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
4ea5bec35aed632c849081f9ff4899b7da1b5cef6a53698c2042f8b4420ac32e
|
|
BLAKE2b-256 checksum How to use checksums |
c3a3407ed2e9883ebf5e437acf8746f6d39afc03532192efefb8ba23ca865f12
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.6
|
Release files / rea_mcp-0.1.5-py3-none-any.whl
| Download URL | rea_mcp-0.1.5-py3-none-any.whl |
|---|---|
| Size | 215.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
4d86a61d7418bb712a6d78eaf298498117f83cf956b4edca7156d77b2d1cb36d
|
|
BLAKE2b-256 checksum How to use checksums |
afb254b6d3afe2bbe41d8473cf0569d6c433d3f4d719ce34ec31e1c38523dac3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.6
|
Security for rea-mcp 0.1.5
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.