kniko/rea

How kniko/rea works

REA is a local reverse-engineering toolkit exposed through MCP and CLI workflows. An agent or terminal user asks about a target; REA routes analysis to applicable providers and returns findings with evidence and limitations. The README documents native, JavaScript/Electron, managed, web, Android, firmware, WASM, EVM, and crash-analysis capabilities. The graph preserves these major capability branches, but sampled source does not establish all their runtime wiring; those links are therefore documented at the workflow level rather than inferred between modules.

Main entry points: evidence.ts Evidence model · AnalysisProvider.ts Provider contract · SessionProviderRouter.ts Provider routing · ProviderProcess.ts Provider process runtime

Components 27

Entry and routing

MCP server src/main.ts
Binary session src/composition/binary.ts
Provider routing src/application/binary/SessionProviderRouter.ts

Analysis workflows

Native analysis src/application/native/NativeCallRoutes.ts
JavaScript analysis src/application/javascript/JavaScriptApplicationService.ts
Web observation src/application/WebRuntimeService.ts
Android analysis src/application/android/AndroidAnalysisService.ts
Managed analysis src/application/managed/ManagedReconstructionService.ts
Firmware analysis src/application/firmware/FirmwareAnalysisService.ts
WASM inspection src/application/wasm/WasmArtifactService.ts
EVM inspection src/application/evm/EvmInterfaceService.ts
Crash analysis src/application/binaryDiagnostics/RecordedCrashService.ts
Semantic graph src/domain/javascript/javascriptSemanticGraph.ts

Analysis providers

Provider contract src/application/AnalysisProvider.ts
Hopper adapter src/hopper/HopperClient.ts
Ghidra adapter src/ghidra/GhidraProviderClient.ts
IDA adapter src/ida/IdaSessionClient.ts
JavaScript worker src/javascript/analysis/JavaScriptAnalysisWorker.ts

Evidence and results

Evidence model src/domain/evidence.ts
Analysis result src/domain/result.ts
JSON boundary src/domain/jsonValue.ts
Typed errors src/domain/analysisErrorBase.ts

Runtime foundations

Provider process runtime src/process/ProviderProcess.ts
Process ownership src/process/ProcessOwnership.ts
Provider deadlines src/process/ProviderDeadline.ts
Private runtime root src/process/PrivateRuntimeRoot.ts

Other components

Agent or CLI user

Connections 30

Agent or CLI user → MCP server: requests analysis README.md
MCP server → Binary session: creates session src/main.ts
MCP server → Provider routing: serves tools
MCP server → Agent or CLI user: returns findings README.md
Binary session → Provider routing: routes analysis
Provider routing → Provider contract: selects provider src/application/binary/SessionProviderRouter.ts
Provider routing → Native analysis: dispatches native work
Provider routing → JavaScript analysis: dispatches app work
JavaScript analysis → Semantic graph: builds semantic graph
JavaScript analysis → JavaScript worker: runs analysis
Provider contract → Hopper adapter: implemented by
Provider contract → Ghidra adapter: implemented by src/ghidra/GhidraProviderClient.ts
Provider contract → IDA adapter: implemented by src/ida/IdaSessionClient.ts
Native analysis → Evidence model: reports findings
JavaScript analysis → Evidence model: reports findings
Web observation → Evidence model: reports observations
Android analysis → Evidence model: reports findings
Managed analysis → Evidence model: reports findings
Firmware analysis → Evidence model: reports findings
WASM inspection → Evidence model: reports findings
EVM inspection → Evidence model: reports findings
Crash analysis → Evidence model: reports observations
Provider contract → Analysis result: returns execution src/application/AnalysisProvider.ts
Analysis result → JSON boundary: validates values
Provider contract → Typed errors: returns failures src/application/AnalysisProvider.ts
Hopper adapter → Provider process runtime: manages process src/hopper/HopperClient.ts
Ghidra adapter → Provider process runtime: uses process controls
Provider process runtime → Process ownership: tracks ownership src/process/ProviderProcess.ts
Provider process runtime → Provider deadlines: applies deadlines
Provider process runtime → Private runtime root: uses private root

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·