Sign inSign up

tenox7/rea

By tenox7

•Updated 1 day ago

REA reverse-engineering MCP server + Ghidra 12.1.4, native linux/arm64

Image
0

55

tenox7/rea repository overview

⁠rea

REA⁠ reverse-engineering MCP server (rea-agents 6.3.0) with Ghidra 12.1.4, for Claude Code and other MCP clients. The image is native linux/arm64, and Ghidra's ARM native parts are built inside it.

⁠Add to Claude Code

claude mcp add-json -s user rea "{\"type\":\"stdio\",\"command\":\"docker\",\"args\":[\"run\",\"-i\",\"--rm\",\"--init\",\"-v\",\"$HOME:$HOME:ro\",\"-v\",\"rea-home:/home/rea\",\"tenox7/rea\"]}"

Check it with claude mcp get rea, which should show ✔ Connected. Restart Claude Code to load the tools.

  • Paths: mount every folder you want analyzed at the same path inside the container (-v /dir:/dir:ro). Claude passes host paths, and REA only sees what's mounted.
  • Read-only: tools that write output (extract_firmware, export_evidence_bundle) need a writable mount.
  • rea-home: this volume keeps REA's state between runs.
  • macOS: don't mount all of /Volumes. Docker's VM then holds SD cards and USB disks open, so they won't eject.

⁠Add REA's skill

The skill teaches Claude the reverse-engineering workflow. Copy it out of the image:

mkdir -p ~/.claude/skills && docker run --rm --entrypoint tar tenox7/rea -C /opt/rea/node_modules/rea-agents/skills -cf - reverse-engineer-anything | tar -xf - -C ~/.claude/skills

Ignore its npx rea-agents and rea setup lines. The setup above replaces them.

⁠CLI

docker run --rm -v $HOME:$HOME:ro -v rea-home:/home/rea tenox7/rea doctor --provider ghidra
docker run --rm -v $HOME:$HOME:ro -v rea-home:/home/rea tenox7/rea function /abs/path/prog _main --provider ghidra

⁠Notes

  • Platforms: arm64 only.
  • Providers: Ghidra only. Hopper and IDA are not included.
  • Speed: the first Ghidra call takes about 7 s; later calls reuse the import. Ghidra's 7-Zip archive support has no ARM build, so it's off.
  • Doctor: a hopper, ida-registration or skill:identity result that isn't a pass is expected. healthy: true for the ghidra scope is what counts.
  • Mach-O symbols: they have a leading underscore (_main).
  • Source: the Dockerfile is in the image at /opt/rea/Dockerfile.

Tag summary

Content type

Image

Digest

sha256:5ad52af6a…

Size

755 MB

Last updated

1 day ago

docker pull tenox7/rea