README.backup.md
README.backup.md
A LM Studio plugin that exposes REA ("Reverse Engineer Anything") reverse-engineering MCP tools inside LM Studio.
rea-mcp is a lightweight TypeScript wrapper around the original
morluto/rea project. REA is a single MCP
server that lets you see how something works, down to the binary level —
static analysis of native binaries, JavaScript/Electron/web apps, .NET
assemblies, EVM bytecode, Android packages, firmware, and Apple apps — plus
dynamic tracing and capture.
This plugin does not re-implement REA. It re-declares each of REA's MCP
tools for LM Studio and delegates each call to the original REA MCP server,
spawned as a black-box child process. REA's source tree is cloned into ./REA
and is left untouched, so you can still update REA with git pull / npm upgrade independently of this plugin.
This plugin is only the LM Studio Plugin MCP server. The original REA
standaloneMCP server, CLI, and all of its tooling are not ported or maintained here — they live in and are maintained by the upstream project.
After installing, rea-mcp exposes 170+ MCP tools from REA. They fall into
roughly these groups:
| Group | What it does | Example tools |
|---|---|---|
| Native / static | Disassemble & decompile PE/Mach-O/ELF, read instructions, names, procedures, strings, data types | inspect_native_instruction, procedure_pseudo_code, list_names, read_bytes |
| Provider front-ends | Drive Hopper, Ghidra, IDA, ILSpy (.NET), or the JS/Electron/web stack | analysis_provider (configurable) |
| JavaScript / Electron / web | Analyze, bundle, diff, extract, and observe running web apps | analyze_javascript_application, analyze_web_bundle, compare_web_screenshots |
| .NET / EVM / Android / firmware / Apple | Inspect and decompile managed code, smart contracts, APKs, firmware images, IPA packages | inspect_managed_members, inspect_evm_interface, inspect_android_package, extract_firmware, |
Every tool keeps REA's original name, description, and input schema. The plugin forwards your arguments to REA and returns the formatted result (with a safety cap on output size). When an analysis tool is not reachable, REA returns an error that the plugin forwards to you.
npm install).Then load the compiled plugin in LM Studio, or expose it as an external MCP server (see Development).
./REA is the original morluto/rea source
tree, cloned and left untouched — so you keep REA's own history and can update
it independently of this plugin. This plugin re-declares REA's tools at each
load, so new / renamed / removed tools show up automatically once REA's
compiled runtime is rebuilt (see step 2–3 below).
setup.cjsinstalls REA withgit clone --depth 1, sogit pullupdates the shallow head. To follow the full history / tags, deep-clone instead:git clone --depth 100 https://github.com/morluto/rea REA(thengit pull).
REA's dist/main.js is gitignored build output (.gitignore → dist/). A
git pull only changes the source; the compiled server stays stale until
you rebuild it. Without a rebuild, new tools will NOT appear.
If npm run compile fails (e.g. a pinned / patched TypeScript), invoke the pinned
compiler directly — exactly as setup.cjs does:
lms dev hot-reloads the plugin — no restart needed.rea-mcp).Each reload re-queries REA (tools/list) and re-declares its tools, so the new
tools are available immediately.
Re-running the plugin's install re-does everything for you — it pulls and rebuilds REA:
| What you run | Effect | New tools appear? |
|---|---|---|
cd REA && git pull | updates source only (dist is gitignored) | No — must rebuild |
cd REA && npm run compile | rebuilds dist/main.js | Yes, on next reload |
cd .. && npm install | git pull and rebuilds REA | Yes, on next reload |
Tips
binary_session / binary_overview to confirm the target and
provider, then list_names, list_procedures, procedure_pseudo_code.All settings are global (apply to every chat). Leave a field blank to use REA's platform default. Open Plugins → rea-mcp → Settings.
| Setting | Purpose |
|---|---|
| Native analysis provider | hopper | ghidra | ida | dotnet | javascript | auto. Blank = auto. |
| Hopper launcher path | Absolute path to the Hopper executable. Blank = default. |
| Ghidra install dir | Absolute path to a Ghidra installation. Blank = default. |
| JAVA_HOME | Path to a JDK (Ghidra needs one). Blank = default. |
| IDA MCP config path | Path to an idamcp.json for IDA. Blank = default. |
| ILSpy command path | Path to the ILSpy CLI for .NET. Blank = default. |
| Ghidra NativeAOT jar |
Security: no API keys or secrets are stored by this plugin. Never paste secrets into tool arguments you don't want the model to see.
Goal: make REA usable as an LM Studio Plugin MCP server while keeping the original REA source tree pristine and updatable.
Approach — a thin wrapper, no re-implementation:
Standalone MCP is intentionally not ported. This repo maintains only the
LM Studio Plugin entry (dist/index.js → toolsProvider). The upstream REA
standalone server, CLI, and bridges remain in and are maintained by
morluto/rea.
Build / verify:
Tip: This plugin re-declares REA's tools at each load, so to pick up upstream changes, update the cloned REA — see Updating REA.
To run the plugin as an external MCP server for other hosts, add your
project's dist/index.js (or the plugin's tool entry) to the host's mcp.json
command/args. (This repo's canonical entry point is the LM Studio Plugin.)
rea-mcp is a wrapper around morluto/rea.
We strongly thank morluto and the REA contributors for building and
maintaining REA — an open, local, and powerful "reverse engineer anything" MCP
server and CLI. This plugin exists only to surface REA's tools inside LM Studio;
all tool logic, documentation, and the original source tree belong to the
upstream project. See REA/ for the untouched original.
This project is licensed under the MIT License, consistent with the original REA project (also MIT).
See LICENSE for the full text.
A LM Studio plugin that exposes REA ("Reverse Engineer Anything") reverse-engineering MCP tools inside LM Studio.
rea-mcp is a lightweight TypeScript wrapper around the original
morluto/rea project. REA is a single MCP
server that lets you see how something works, down to the binary level —
static analysis of native binaries, JavaScript/Electron/web apps, .NET
assemblies, EVM bytecode, Android packages, firmware, and Apple apps — plus
dynamic tracing and capture.
This plugin does not re-implement REA. It re-declares each of REA's MCP
tools for LM Studio and delegates each call to the original REA MCP server,
spawned as a black-box child process. REA's source tree is cloned into ./REA
and is left untouched, so you can still update REA with git pull / npm upgrade independently of this plugin.
This plugin is only the LM Studio Plugin MCP server. The original REA
standaloneMCP server, CLI, and all of its tooling are not ported or maintained here — they live in and are maintained by the upstream project.
After installing, rea-mcp exposes 170+ MCP tools from REA. They fall into
roughly these groups:
| Group | What it does | Example tools |
|---|---|---|
| Native / static | Disassemble & decompile PE/Mach-O/ELF, read instructions, names, procedures, strings, data types | inspect_native_instruction, procedure_pseudo_code, list_names, read_bytes |
| Provider front-ends | Drive Hopper, Ghidra, IDA, ILSpy (.NET), or the JS/Electron/web stack | analysis_provider (configurable) |
| JavaScript / Electron / web | Analyze, bundle, diff, extract, and observe running web apps | analyze_javascript_application, analyze_web_bundle, compare_web_screenshots |
| .NET / EVM / Android / firmware / Apple | Inspect and decompile managed code, smart contracts, APKs, firmware images, IPA packages | inspect_managed_members, inspect_evm_interface, inspect_android_package, extract_firmware, |
Every tool keeps REA's original name, description, and input schema. The plugin forwards your arguments to REA and returns the formatted result (with a safety cap on output size). When an analysis tool is not reachable, REA returns an error that the plugin forwards to you.
npm install).Then load the compiled plugin in LM Studio, or expose it as an external MCP server (see Development).
./REA is the original morluto/rea source
tree, cloned and left untouched — so you keep REA's own history and can update
it independently of this plugin. This plugin re-declares REA's tools at each
load, so new / renamed / removed tools show up automatically once REA's
compiled runtime is rebuilt (see step 2–3 below).
setup.cjsinstalls REA withgit clone --depth 1, sogit pullupdates the shallow head. To follow the full history / tags, deep-clone instead:git clone --depth 100 https://github.com/morluto/rea REA(thengit pull).
REA's dist/main.js is gitignored build output (.gitignore → dist/). A
git pull only changes the source; the compiled server stays stale until
you rebuild it. Without a rebuild, new tools will NOT appear.
If npm run compile fails (e.g. a pinned / patched TypeScript), invoke the pinned
compiler directly — exactly as setup.cjs does:
lms dev hot-reloads the plugin — no restart needed.rea-mcp).Each reload re-queries REA (tools/list) and re-declares its tools, so the new
tools are available immediately.
Re-running the plugin's install re-does everything for you — it pulls and rebuilds REA:
| What you run | Effect | New tools appear? |
|---|---|---|
cd REA && git pull | updates source only (dist is gitignored) | No — must rebuild |
cd REA && npm run compile | rebuilds dist/main.js | Yes, on next reload |
cd .. && npm install | git pull and rebuilds REA | Yes, on next reload |
Tips
binary_session / binary_overview to confirm the target and
provider, then list_names, list_procedures, procedure_pseudo_code.All settings are global (apply to every chat). Leave a field blank to use REA's platform default. Open Plugins → rea-mcp → Settings.
| Setting | Purpose |
|---|---|
| Native analysis provider | hopper | ghidra | ida | dotnet | javascript | auto. Blank = auto. |
| Hopper launcher path | Absolute path to the Hopper executable. Blank = default. |
| Ghidra install dir | Absolute path to a Ghidra installation. Blank = default. |
| JAVA_HOME | Path to a JDK (Ghidra needs one). Blank = default. |
| IDA MCP config path | Path to an idamcp.json for IDA. Blank = default. |
| ILSpy command path | Path to the ILSpy CLI for .NET. Blank = default. |
| Ghidra NativeAOT jar |
Security: no API keys or secrets are stored by this plugin. Never paste secrets into tool arguments you don't want the model to see.
Goal: make REA usable as an LM Studio Plugin MCP server while keeping the original REA source tree pristine and updatable.
Approach — a thin wrapper, no re-implementation:
Standalone MCP is intentionally not ported. This repo maintains only the
LM Studio Plugin entry (dist/index.js → toolsProvider). The upstream REA
standalone server, CLI, and bridges remain in and are maintained by
morluto/rea.
Build / verify:
Tip: This plugin re-declares REA's tools at each load, so to pick up upstream changes, update the cloned REA — see Updating REA.
To run the plugin as an external MCP server for other hosts, add your
project's dist/index.js (or the plugin's tool entry) to the host's mcp.json
command/args. (This repo's canonical entry point is the LM Studio Plugin.)
rea-mcp is a wrapper around morluto/rea.
We strongly thank morluto and the REA contributors for building and
maintaining REA — an open, local, and powerful "reverse engineer anything" MCP
server and CLI. This plugin exists only to surface REA's tools inside LM Studio;
all tool logic, documentation, and the original source tree belong to the
upstream project. See REA/ for the untouched original.
This project is licensed under the MIT License, consistent with the original REA project (also MIT).
See LICENSE for the full text.
inspect_macho| Dynamic / capture | Attach to processes, ADB devices, browsers, Electron apps; trace values and calls | capture_process_scenario, trace_native_values, capture_adb_screen, observe_web_execution |
| Inspect / resolve / trace | Deep per-symbol inspection, call/reference resolution, semantic tracing | inspect_native_api, resolve_native_call_targets, trace_javascript_semantics |
| Evidence / reconstruction | Build and export evidence bundles, reconstruction ledgers, coverage | export_evidence_bundle, build_reconstruction_obligation_ledger, evaluate_reconstruction_coverage |
| Filesystem / ADB helpers | Read files, browse ADB directories, install/pull/pull packages | extract_artifact, pull_adb_package, read_adb_logcat |
rea-mcp (owner hoonowng) and click Install.postinstall script (scripts/setup.cjs), which:
https://github.com/morluto/rea into ./REA (unchanged, git-updatable),Start the LM Studio local server:
Install and enable the rea-mcp plugin (Plugins tab).
In your chat, the REA tools appear as MCP tools. Describe what you want to understand and let the model call them, e.g. "decompile this procedure" or "find all string references in this binary."
If a native/managed tool is not on your PATH, set its path in the plugin's
Settings (see Configuration).
Each tool call streams status (Working…) and returns formatted text; errors
are returned as clear messages you can act on.
| Path to a Ghidra NativeAOT jar. Blank = default. |
| Ghidra seed file | Path to a Ghidra seed file. Blank = default. |
| Ghidra startup timeout (ms) | Raise for slow/large binaries. Blank = default. |
| Log level | trace … silent. Default info. |
./REA and is never imported or modified.src/toolsProvider.ts lists REA's tools and re-declares each one for LM
Studio (same name/description/schema), then each implementation spawns REA's
MCP server (dist/main.js) and forwards the call over stdio.src/core/reaClient.ts owns the black-box MCP client: lazy connect, tool
listing, tool calling, output capping, and error formatting.src/core/schemaConverter.ts converts each tool's JSON inputSchema to the
zod shape LM Studio needs.src/core/externalConfig.ts + src/config.ts map the plugin's global
settings to REA's REA_* environment variables (empty = default).scripts/setup.cjs (postinstall) performs the clone + Node environment
setup described under Installation.git clone <this repository> rea-mcp
cd rea-mcp
npm install # triggers scripts/setup.cjs: clones REA into ./REA, npm ci, build
npm run build # compiles the plugin to dist/
cd REA
git pull # update the upstream source tree
cd REA
npm run compile # tsc -p tsconfig.build.json → regenerates REA/dist/main.js
cd REA
node node_modules/typescript/bin/tsc -p tsconfig.build.json
cd .. # back in the rea-mcp plugin directory
npm install # postinstall: git pull in ./REA + npm ci + build REA
npm run build # (re)compile the wrapper
npm run typecheck # tsc --noEmit, zero errors
npm run build # tsc → dist/
npm install # postinstall clones + sets up REA
npm run typecheck # type-check
npm run build # compile to dist/
lms dev # (if using the LM Studio dev loop) hot-reload the plugin
rea-mcp/
├── manifest.json # LM Studio plugin metadata (kebab-case: rea-mcp)
├── package.json # deps + scripts; postinstall → scripts/setup.cjs
├── tsconfig.json # TS config for the wrapper
├── LICENSE # MIT (matches original REA)
├── README.md
├── scripts/
│ └── setup.cjs # postinstall: clone REA, env, install, build
├── src/ # the wrapper (TypeScript)
│ ├── index.ts # plugin entry point
│ ├── toolsProvider.ts # re-declares every REA tool for LM Studio
│ ├── config.ts # LM Studio global settings schema
│ └── core/
│ ├── reaClient.ts # black-box MCP client to REA/dist/main.js
│ ├── schemaConverter.ts # JSON schema → zod (for LM Studio tools)
│ └── externalConfig.ts # settings → REA REA_* env vars
├── skills/
│ └── rea-mcp.md # skill for small LLMs: tool interface + examples
├── REA/ # original morluto/rea, cloned & UNTOUCHED (git-updatable)
└── dist/ # compiled JS (from `npm run build`)
inspect_macho| Dynamic / capture | Attach to processes, ADB devices, browsers, Electron apps; trace values and calls | capture_process_scenario, trace_native_values, capture_adb_screen, observe_web_execution |
| Inspect / resolve / trace | Deep per-symbol inspection, call/reference resolution, semantic tracing | inspect_native_api, resolve_native_call_targets, trace_javascript_semantics |
| Evidence / reconstruction | Build and export evidence bundles, reconstruction ledgers, coverage | export_evidence_bundle, build_reconstruction_obligation_ledger, evaluate_reconstruction_coverage |
| Filesystem / ADB helpers | Read files, browse ADB directories, install/pull/pull packages | extract_artifact, pull_adb_package, read_adb_logcat |
rea-mcp (owner hoonowng) and click Install.postinstall script (scripts/setup.cjs), which:
https://github.com/morluto/rea into ./REA (unchanged, git-updatable),Start the LM Studio local server:
Install and enable the rea-mcp plugin (Plugins tab).
In your chat, the REA tools appear as MCP tools. Describe what you want to understand and let the model call them, e.g. "decompile this procedure" or "find all string references in this binary."
If a native/managed tool is not on your PATH, set its path in the plugin's
Settings (see Configuration).
Each tool call streams status (Working…) and returns formatted text; errors
are returned as clear messages you can act on.
| Path to a Ghidra NativeAOT jar. Blank = default. |
| Ghidra seed file | Path to a Ghidra seed file. Blank = default. |
| Ghidra startup timeout (ms) | Raise for slow/large binaries. Blank = default. |
| Log level | trace … silent. Default info. |
./REA and is never imported or modified.src/toolsProvider.ts lists REA's tools and re-declares each one for LM
Studio (same name/description/schema), then each implementation spawns REA's
MCP server (dist/main.js) and forwards the call over stdio.src/core/reaClient.ts owns the black-box MCP client: lazy connect, tool
listing, tool calling, output capping, and error formatting.src/core/schemaConverter.ts converts each tool's JSON inputSchema to the
zod shape LM Studio needs.src/core/externalConfig.ts + src/config.ts map the plugin's global
settings to REA's REA_* environment variables (empty = default).scripts/setup.cjs (postinstall) performs the clone + Node environment
setup described under Installation.git clone <this repository> rea-mcp
cd rea-mcp
npm install # triggers scripts/setup.cjs: clones REA into ./REA, npm ci, build
npm run build # compiles the plugin to dist/
cd REA
git pull # update the upstream source tree
cd REA
npm run compile # tsc -p tsconfig.build.json → regenerates REA/dist/main.js
cd REA
node node_modules/typescript/bin/tsc -p tsconfig.build.json
cd .. # back in the rea-mcp plugin directory
npm install # postinstall: git pull in ./REA + npm ci + build REA
npm run build # (re)compile the wrapper
npm run typecheck # tsc --noEmit, zero errors
npm run build # tsc → dist/
npm install # postinstall clones + sets up REA
npm run typecheck # type-check
npm run build # compile to dist/
lms dev # (if using the LM Studio dev loop) hot-reload the plugin
rea-mcp/
├── manifest.json # LM Studio plugin metadata (kebab-case: rea-mcp)
├── package.json # deps + scripts; postinstall → scripts/setup.cjs
├── tsconfig.json # TS config for the wrapper
├── LICENSE # MIT (matches original REA)
├── README.md
├── scripts/
│ └── setup.cjs # postinstall: clone REA, env, install, build
├── src/ # the wrapper (TypeScript)
│ ├── index.ts # plugin entry point
│ ├── toolsProvider.ts # re-declares every REA tool for LM Studio
│ ├── config.ts # LM Studio global settings schema
│ └── core/
│ ├── reaClient.ts # black-box MCP client to REA/dist/main.js
│ ├── schemaConverter.ts # JSON schema → zod (for LM Studio tools)
│ └── externalConfig.ts # settings → REA REA_* env vars
├── skills/
│ └── rea-mcp.md # skill for small LLMs: tool interface + examples
├── REA/ # original morluto/rea, cloned & UNTOUCHED (git-updatable)
└── dist/ # compiled JS (from `npm run build`)
lms server start
lms server start