dsh-rea

dsh-rea

English · 简体中文

Brings the upstream REA — Reverse Engineer Anything MCP server into DeepSeek Harness (dsh), so its tools show up in a session as mcp__rea__*.

What this is

A small DSH bundle. Its one row, rea, mounts the official MCP client plugin (@deepseek-ai/dsh-mcp-client) for the rea --mcp stdio server already installed on your machine, and adds a page to the Plugins sidebar with a setup check, example prompts, and settings. There is no analysis code here.

Third-party adapter. This repository is not part of REA, ships none of REA's code, and is not maintained by REA's authors. It connects REA and adds a setup page. Upstream: github.com/morluto/rea (MIT) · docs · 中文文档 · rea.tools · npm package rea-agents. REA's own problems go to its tracker; this plugin's problems go to this repository's issues.

It adds: the mcp__rea__* tool registration with cross-platform auto-detection of the command form, and a Plugins-page guide that tells you what is missing and how to fix it.

What it can and cannot do

The analysis is upstream's; this section only restates upstream's own contract so expectations are right.

• It cannot recover complete source code. For native binaries upstream returns pseudocode and assembly, for Android APKs decompiled methods, for JEB units pseudocode, and for JavaScript/Electron modules and their relations. Upstream's tool contract states the pseudocode "is decompiler output, not original source and not text-equivalent" to another provider's output.
• Not recoverable in practice: original identifier names, types, comments, macros and template expansion, build scripts and assets. Optimisation (inlining, reordering), symbol stripping, obfuscation, packing and VM protection only make the output worse.
• Every result carries confidence and limitations (observed / derived / inferred, plus an explicit limitations list). Read them as evidence, never as recovered source.
• Good for: understanding behaviour, locating an implementation, interoperability and compatible re-implementation, security review, migration reference. To obtain actual source code, use the legitimate route — the upstream repository, vendor authorisation, or the vendor's own SDK.

Cross-platform auto-detection

The shipped patch uses !!js expressions to pick the right command at runtime:

• Windows: cmd.exe /c rea --mcp — the npm shim is a .cmd file, so a shell is required.
• macOS / Linux: rea --mcp — the npm shim is a direct executable on PATH.

No manual editing is needed when moving between platforms. The --mcp flag is the canonical stdio-server startup form documented in rea --help.

Verified against

The shipped row was exercised live: rea --mcp answered the MCP initialize handshake and returned serverInfo: { name: "rea", version: "6.5.0" } with 207 tools. Every pattern in their input schemas (600, 45 distinct) compiles under the Rust regex engine, the check strict providers such as DeepSeek's native model apply.

Install

Prerequisites

• Node.js on a version REA accepts (^22.19.0 || ^24.11.0 || >=26.0.0).
• The REA CLI installed globally, version 6.3.0 or newer: npm i -g rea-agents@latest. Older releases advertise a tool schema with a \0 regex escape that DeepSeek's native model rejects, so every turn fails while REA is connected (see Troubleshooting).
• For native analysis, Ghidra 12.1.x (Hopper / IDA are alternatives under their own licences). Static JavaScript/Electron and .NET analysis need no engine at all.

The plugin

dsh plugin --profile <profile> add dsh-rea

Or install dsh-rea from the Plugins page in the DSH Web sidebar.

Set up and configure — on the Plugins page

Open Plugins in the DSH Web sidebar and select REA reverse engineering. The page has three parts:

1. Setup check — the REA CLI and its version (6.3.0+), whether the mcp__rea__* tools are loaded, Ghidra (optional), and Java (needed by Ghidra). Each item that needs attention says why and gives the command to fix it, with a copy button. Check again re-runs it.
2. Try it — example prompts to paste into a chat.
3. Settings — saved into your profile; REA restarts with the new values right away:

Without Ghidra, JavaScript / Electron and .NET analysis still work; native binaries (exe / ELF / Mach-O) need Ghidra 12.1.x and JDK 21+.

To pin the settings by hand instead, override the row in your profile's cordis.patch.yml:

- id: rea
  config:
    ghidraInstallDir: /Applications/ghidra_12.1.1_PUBLIC

Verify

The setup check shows green for the REA CLI and the loaded tools. Then ask in a chat, for example "Use REA to analyze the Electron app /Applications/Visual Studio Code.app". With Ghidra configured, binary_session reports the engine checks (configuration / installation / headless / native_decompiler / java), all of which should be ok: true.

Scope and caveats

REA exposes 207 tools at 6.5.0, so every session's tool list grows noticeably (disable the bundle on the Plugins page when you do not need it); the row sets failOnStartupError: false so a missing REA never blocks harness startup. Some REA tools launch processes, write files and access the network — DSH's permission policy applies. Analyse only artifacts you are authorized to inspect.

Updating — two independent things, both manual

• This plugin never updates itself: dsh plugin --profile <profile> add dsh-rea@latest (or the Plugins page). Updating REA below does not update this plugin, and updating this plugin does not touch REA.
• Upstream REA: npm i -g rea-agents@latest, then restart the harness so the MCP child respawns on the new binary. Its bin entry (scripts/rea.mjs) is stable across releases, so this needs no change here.
• Ghidra is version-gated by REA (12.1.x today): update REA first, then check that it accepts a newer Ghidra.
• DeepSeek Harness: a harness upgrade may change the MCP client's config schema — inspect the row with Config.listConfigs name=@deepseek-ai/dsh-mcp-client and adjust the field names.

Troubleshooting

Invalid schema for function 'mcp__rea__capture_process_scenario': "^[^=\\0]+$" is not a "regex" (or any mcp__rea__* schema error) — the installed REA is older than 6.3.0. Its schemas use regex syntax that DeepSeek's native model rejects, and the provider refuses the whole request. Fixed upstream in morluto/rea#1329:

npm i -g rea-agents@latest
rea --version        # 6.3.0 or newer

Then restart the harness.

No mcp__rea__* tools appear — rea is not on the PATH the harness sees (which rea), or REA failed to start; the row's failOnStartupError: false keeps the harness running and logs the error.

The bundle is skipped at startup — this release declares a @deepseek-ai/dsh-mcp-client peer range (0.2.x). A harness outside it may have changed the MCP client's config schema; update this plugin.

License

MIT (this adapter). REA is MIT and owned by its authors; Ghidra is Apache-2.0 and owned by the NSA. No upstream code is redistributed here.