Reverse Engine Anything Plus

Reverse Engine Anything Plus

One MCP server for reverse engineering — live Windows debugging plus a 161-tool static-analysis suite for PE/ELF, Mach-O, .NET, APK, IL2CPP, WASM/EVM, firmware, and the web.

Your agent asks questions; rea-plus inspects the binary and answers with evidence, not guesses.

Install · Clients · Docker · Features · Tools · How it works · Security · Roadmap · FAQ

---

✨ Why rea-plus?

• 🐞 Real debugging, not screenshots — x64dbg, cdb (WinDbg), and Frida engines behind one frozen 30-tool core: breakpoints, stepping, registers, memory, call stacks, time-travel checkpoints.
• 🧰 161 static tools — Ghidra headless, rizin/radare2, .NET CIL (dnfile) and ILSpy, jadx/apktool/adb, WASM + EVM, firmware, browser/HAR, UPX, PE/ELF/Mach-O readers, and more.
• 🤝 Honest by design — a missing backend answers capability_unsupported with an install hint. Nothing fakes a result, errors come back as proper MCP isError, and mutating live-debug calls require confirm:true.
• 🧩 191 tools, 2 resources, 7 prompts — the full generated catalog lives in docs/TOOLS.md; REA_TOOLSETS lets small-context clients load only a profile slice (see Configuration). Without an HTTP token, only a 44-tool read-only allowlist is registered instead of the full surface.
• 🔌 Two transports — stdio for local agents, streamable HTTP (/mcp + /health, bearer token, localhost Host/Origin validation) for shared setups.
• 🧪 Proven, not promised — a 91-file default test lane, Ubuntu CI for the released line, and protocol tests that drive the real compiled server.

$ rea-plus-cli doctor            # what is installed on this machine, what is missing

$ rea-plus-cli analyze-evm "transfer(address,uint256)" transfer(address,uint256) -> 0xa9059cbb

// One MCP call your agent makes:

{ "name": "rea_investigate", "arguments": { "path": "sample.exe" } } // -> sniff + confidence + provider plan + evidence bundle, in one answer

🚀 Install

Requirements: Node.js ≥ 20. Everything else (Ghidra, rizin, jadx, Frida tooling, …) is optional — tools light up as backends appear; run doctor to see your machine's map. Windows is required for the live debuggers (x64dbg/cdb/Frida attach); static analysis runs anywhere.

One-click (Cursor / VS Code)

Setup wizard (standalone download)

No npm? Download setup.mjs (+ Windows setup.ps1) from the latest release — needs only Node.js 20+:

node setup.mjs --list        # detect installed clients

node setup.mjs --dry-run # preview without writing node setup.mjs --yes # write MCP config (asks unless --yes)

.\setup.ps1 --list

.\setup.ps1 --yes

Or inside the package: npx -y rea-plus rea-plus-cli setup (same wizard).

npx (no clone)

Any stdio MCP client can launch it straight from the npm registry:

{

"mcpServers": { "rea-plus": { "command": "npx", "args": ["-y", "rea-plus"] } } }

Publishing status: rea-plus@0.13.0 is live on the npm registry and io.github.Alyhnte/rea-plus is published on the MCP Registry. The supported installs are npx -y rea-plus (above) and GHCR (see Docker).

Clone & build

git clone https://github.com/Alyhnte/ReaPlus.git

cd ReaPlus npm ci npm run build # tsc + runtime assets (frida-agent.js, Ghidra scripts) -> dist/ npm start # stdio server (dist/server.js)

Optional HTTP transport:

node dist/server.js --transport http --port 3848

-> GET http://127.0.0.1:3848/health

-> POST http://127.0.0.1:3848/mcp

Optional extras

# Browser tools (Playwright is an optional dependency, loaded lazily):

npm i playwright && npx playwright install chromium

Then point your agent at it and ask it to inspect something.

🔌 Client setup

Every client below gets the same server. Ready-made files live in configs/.

Claude Desktop

Add to claude_desktop_config.json (see configs/claude-desktop/):

{

"mcpServers": { "rea-plus": { "command": "npx", "args": ["-y", "rea-plus"] } } }

Claude Code

claude mcp add rea-plus -- npx -y rea-plus

Or drop configs/claude-code/.mcp.json into your project root.

Cursor

Click Add to Cursor above, or use configs/cursor/mcp.stdio.json (clone path form) / mcp.http.json (HTTP form).

VS Code

Click Install in VS Code above, or copy configs/vscode/mcp.json to .vscode/mcp.json in your workspace.

Windsurf

Use configs/windsurf/mcp_config.json as your mcp_config.json.

Codex

Append configs/codex/config.toml to ~/.codex/config.toml:

[mcp_servers.rea-plus]

command = "npx" args = ["-y", "rea-plus"]

opencode / generic HTTP

DBG_BRIDGE_TOKEN=your-secret node dist/server.js --transport http --port 3848

clients connect to http://127.0.0.1:3848/mcp with Authorization: Bearer

See configs/opencode/ for stdio and HTTP variants.

🐳 Docker

# Build locally (works today):

docker build -t rea-plus .

stdio (for MCP clients that spawn containers):

docker run -i --rm rea-plus

HTTP:

docker run -p 3848:3848 -e DBG_BRIDGE_TOKEN=your-secret rea-plus --transport http --port 3848 --host 0.0.0.0

Images are published to GHCR on each release (ghcr.io/alyhnte/reaplus). Windows-only debuggers (x64dbg/cdb) report capability_unsupported inside a Linux container; static analysis, the CLI, and both transports work.

🧰 Features

The complete, generated reference — 191 tools + 2 resources (`rea-plus://server-info`, `rea-plus://capabilities-safety`) + 7 prompts (`packer-triage`, `dotnet-malware-triage`, `android-triage`, `pe-crash-triage`, `elf-linux-triage`, `binary-diff`, `evidence-report`) — is in docs/TOOLS.md. The table below is only a domain summary.

⚙️ How it works

flowchart LR

A["AI agent / MCP client"] -->|stdio or streamable HTTP| S["rea-plus server"] S --> C["Conduit core · 30 frozen tools x64dbg · cdb · Frida · radare2"] S --> D["rea domains · 161 tools Ghidra · rizin · jadx · dnfile · wabt · Playwright"] C --> T["Target binary / live process"] D --> T C --> E["Evidence bundle + obligation ledger"] D --> E E --> A

• Frozen core. The 30 conduit tool names are immutable (src/facade/toolNamespace.ts); renames are forbidden, so existing conduit clients keep working.
• rea domains. 161 rea_* tools register centrally in src/server/registerReaTools.ts.
• Confirm gates. Live operations that mutate a target require confirm:true; otherwise you get confirmation_required, never a silent side effect.
• One catalog. mergedCatalog() (8 conduit + 16 rea prerequisite entries) is the single source doctor reads for versions and download links.
• Resources + prompts. Two static, read-only resources (rea-plus://server-info, rea-plus://capabilities-safety) and seven side-effect-free prompts (packer-triage, dotnet-malware-triage, android-triage, pe-crash-triage, elf-linux-triage, binary-diff, evidence-report) are registered alongside the tools; prompts only return text and never run a tool.
• Typed outputs (partial). structuredContent mirrors the text JSON, and coverage is deliberately partial: 187 tools declare an outputSchema and 191 tools carry annotations.