# kniko/rea architecture

> Architecture diagram of the GitHub repository kniko/rea, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kniko/rea
- Repository: https://github.com/kniko/rea

## Overview

REA is a local reverse-engineering toolkit exposed through MCP and CLI workflows. An agent or terminal user asks about a target; REA routes analysis to applicable providers and returns findings with evidence and limitations. The README documents native, JavaScript/Electron, managed, web, Android, firmware, WASM, EVM, and crash-analysis capabilities. The graph preserves these major capability branches, but sampled source does not establish all their runtime wiring; those links are therefore documented at the workflow level rather than inferred between modules.

Main entry points: [`src/domain/evidence.ts`](https://github.com/kniko/rea/blob/main/src/domain/evidence.ts) (Evidence model), [`src/application/AnalysisProvider.ts`](https://github.com/kniko/rea/blob/main/src/application/AnalysisProvider.ts) (Provider contract), [`src/application/binary/SessionProviderRouter.ts`](https://github.com/kniko/rea/blob/main/src/application/binary/SessionProviderRouter.ts) (Provider routing), [`src/process/ProviderProcess.ts`](https://github.com/kniko/rea/blob/main/src/process/ProviderProcess.ts) (Provider process runtime)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Entry and routing"]
  node_mcp["MCP server<br/>[main.ts]"]
  node_binary_session["Binary session<br/>[binary.ts]"]
  node_provider_router["Provider routing"]
end

subgraph group_analysis["Analysis workflows"]
  node_native["Native analysis"]
  node_javascript["JavaScript analysis"]
  node_web["Web observation"]
  node_android["Android analysis"]
  node_managed["Managed analysis"]
  node_firmware["Firmware analysis"]
  node_wasm["WASM inspection"]
  node_evm["EVM inspection"]
  node_crashes["Crash analysis"]
  node_semantic_graph["Semantic graph"]
end

subgraph group_providers["Analysis providers"]
  node_provider_api["Provider contract"]
  node_hopper["Hopper adapter<br/>[HopperClient.ts]"]
  node_ghidra["Ghidra adapter"]
  node_ida["IDA adapter"]
  node_js_worker["JavaScript worker"]
end

subgraph group_evidence["Evidence and results"]
  node_evidence["Evidence model<br/>[evidence.ts]"]
  node_result["Analysis result<br/>[result.ts]"]
  node_json["JSON boundary<br/>[jsonValue.ts]"]
  node_errors["Typed errors"]
end

subgraph group_runtime["Runtime foundations"]
  node_runtime["Provider process runtime<br/>[ProviderProcess.ts]"]
  node_ownership["Process ownership"]
  node_deadline["Provider deadlines"]
  node_runtime_root["Private runtime root"]
end

node_agent(("Agent or CLI user"))

node_agent -->|"requests analysis"| node_mcp
node_mcp -->|"creates session"| node_binary_session
node_mcp -.->|"serves tools"| node_provider_router
node_mcp -->|"returns findings"| node_agent
node_binary_session -.->|"routes analysis"| node_provider_router
node_provider_router -->|"selects provider"| node_provider_api
node_provider_router -.->|"dispatches native work"| node_native
node_provider_router -.->|"dispatches app work"| node_javascript
node_javascript -.->|"builds semantic graph"| node_semantic_graph
node_javascript -.->|"runs analysis"| node_js_worker
node_provider_api -.->|"implemented by"| node_hopper
node_provider_api -.->|"implemented by"| node_ghidra
node_provider_api -.->|"implemented by"| node_ida
node_native -.->|"reports findings"| node_evidence
node_javascript -.->|"reports findings"| node_evidence
node_web -.->|"reports observations"| node_evidence
node_android -.->|"reports findings"| node_evidence
node_managed -.->|"reports findings"| node_evidence
node_firmware -.->|"reports findings"| node_evidence
node_wasm -.->|"reports findings"| node_evidence
node_evm -.->|"reports findings"| node_evidence
node_crashes -.->|"reports observations"| node_evidence
node_provider_api -.->|"returns execution"| node_result
node_result -.->|"validates values"| node_json
node_provider_api -.->|"returns failures"| node_errors
node_hopper -->|"manages process"| node_runtime
node_ghidra -->|"uses process controls"| node_runtime
node_runtime -.->|"tracks ownership"| node_ownership
node_runtime -.->|"applies deadlines"| node_deadline
node_runtime -.->|"uses private root"| node_runtime_root

click node_mcp "https://github.com/kniko/rea/blob/main/src/main.ts"
click node_binary_session "https://github.com/kniko/rea/blob/main/src/composition/binary.ts"
click node_provider_router "https://github.com/kniko/rea/blob/main/src/application/binary/SessionProviderRouter.ts"
click node_native "https://github.com/kniko/rea/blob/main/src/application/native/NativeCallRoutes.ts"
click node_javascript "https://github.com/kniko/rea/blob/main/src/application/javascript/JavaScriptApplicationService.ts"
click node_web "https://github.com/kniko/rea/blob/main/src/application/WebRuntimeService.ts"
click node_android "https://github.com/kniko/rea/blob/main/src/application/android/AndroidAnalysisService.ts"
click node_managed "https://github.com/kniko/rea/blob/main/src/application/managed/ManagedReconstructionService.ts"
click node_firmware "https://github.com/kniko/rea/blob/main/src/application/firmware/FirmwareAnalysisService.ts"
click node_wasm "https://github.com/kniko/rea/blob/main/src/application/wasm/WasmArtifactService.ts"
click node_evm "https://github.com/kniko/rea/blob/main/src/application/evm/EvmInterfaceService.ts"
click node_crashes "https://github.com/kniko/rea/blob/main/src/application/binaryDiagnostics/RecordedCrashService.ts"
click node_provider_api "https://github.com/kniko/rea/blob/main/src/application/AnalysisProvider.ts"
click node_hopper "https://github.com/kniko/rea/blob/main/src/hopper/HopperClient.ts"
click node_ghidra "https://github.com/kniko/rea/blob/main/src/ghidra/GhidraProviderClient.ts"
click node_ida "https://github.com/kniko/rea/blob/main/src/ida/IdaSessionClient.ts"
click node_js_worker "https://github.com/kniko/rea/blob/main/src/javascript/analysis/JavaScriptAnalysisWorker.ts"
click node_semantic_graph "https://github.com/kniko/rea/blob/main/src/domain/javascript/javascriptSemanticGraph.ts"
click node_evidence "https://github.com/kniko/rea/blob/main/src/domain/evidence.ts"
click node_result "https://github.com/kniko/rea/blob/main/src/domain/result.ts"
click node_json "https://github.com/kniko/rea/blob/main/src/domain/jsonValue.ts"
click node_errors "https://github.com/kniko/rea/blob/main/src/domain/analysisErrorBase.ts"
click node_runtime "https://github.com/kniko/rea/blob/main/src/process/ProviderProcess.ts"
click node_ownership "https://github.com/kniko/rea/blob/main/src/process/ProcessOwnership.ts"
click node_deadline "https://github.com/kniko/rea/blob/main/src/process/ProviderDeadline.ts"
click node_runtime_root "https://github.com/kniko/rea/blob/main/src/process/PrivateRuntimeRoot.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_mcp,node_binary_session,node_provider_router,node_agent toneBlue
class node_native,node_javascript,node_web,node_android,node_managed,node_firmware,node_wasm,node_evm,node_crashes,node_semantic_graph toneAmber
class node_provider_api,node_hopper,node_ghidra,node_ida,node_js_worker toneMint
class node_evidence,node_result,node_json,node_errors toneRose
class node_runtime,node_ownership,node_deadline,node_runtime_root toneIndigo
```

## Components

### Entry and routing

- [MCP server](https://github.com/kniko/rea/blob/main/src/main.ts): `src/main.ts`
- [Binary session](https://github.com/kniko/rea/blob/main/src/composition/binary.ts): `src/composition/binary.ts`
- [Provider routing](https://github.com/kniko/rea/blob/main/src/application/binary/SessionProviderRouter.ts): `src/application/binary/SessionProviderRouter.ts`

### Analysis workflows

- [Native analysis](https://github.com/kniko/rea/blob/main/src/application/native/NativeCallRoutes.ts): `src/application/native/NativeCallRoutes.ts`
- [JavaScript analysis](https://github.com/kniko/rea/blob/main/src/application/javascript/JavaScriptApplicationService.ts): `src/application/javascript/JavaScriptApplicationService.ts`
- [Web observation](https://github.com/kniko/rea/blob/main/src/application/WebRuntimeService.ts): `src/application/WebRuntimeService.ts`
- [Android analysis](https://github.com/kniko/rea/blob/main/src/application/android/AndroidAnalysisService.ts): `src/application/android/AndroidAnalysisService.ts`
- [Managed analysis](https://github.com/kniko/rea/blob/main/src/application/managed/ManagedReconstructionService.ts): `src/application/managed/ManagedReconstructionService.ts`
- [Firmware analysis](https://github.com/kniko/rea/blob/main/src/application/firmware/FirmwareAnalysisService.ts): `src/application/firmware/FirmwareAnalysisService.ts`
- [WASM inspection](https://github.com/kniko/rea/blob/main/src/application/wasm/WasmArtifactService.ts): `src/application/wasm/WasmArtifactService.ts`
- [EVM inspection](https://github.com/kniko/rea/blob/main/src/application/evm/EvmInterfaceService.ts): `src/application/evm/EvmInterfaceService.ts`
- [Crash analysis](https://github.com/kniko/rea/blob/main/src/application/binaryDiagnostics/RecordedCrashService.ts): `src/application/binaryDiagnostics/RecordedCrashService.ts`
- [Semantic graph](https://github.com/kniko/rea/blob/main/src/domain/javascript/javascriptSemanticGraph.ts): `src/domain/javascript/javascriptSemanticGraph.ts`

### Analysis providers

- [Provider contract](https://github.com/kniko/rea/blob/main/src/application/AnalysisProvider.ts): `src/application/AnalysisProvider.ts`
- [Hopper adapter](https://github.com/kniko/rea/blob/main/src/hopper/HopperClient.ts): `src/hopper/HopperClient.ts`
- [Ghidra adapter](https://github.com/kniko/rea/blob/main/src/ghidra/GhidraProviderClient.ts): `src/ghidra/GhidraProviderClient.ts`
- [IDA adapter](https://github.com/kniko/rea/blob/main/src/ida/IdaSessionClient.ts): `src/ida/IdaSessionClient.ts`
- [JavaScript worker](https://github.com/kniko/rea/blob/main/src/javascript/analysis/JavaScriptAnalysisWorker.ts): `src/javascript/analysis/JavaScriptAnalysisWorker.ts`

### Evidence and results

- [Evidence model](https://github.com/kniko/rea/blob/main/src/domain/evidence.ts): `src/domain/evidence.ts`
- [Analysis result](https://github.com/kniko/rea/blob/main/src/domain/result.ts): `src/domain/result.ts`
- [JSON boundary](https://github.com/kniko/rea/blob/main/src/domain/jsonValue.ts): `src/domain/jsonValue.ts`
- [Typed errors](https://github.com/kniko/rea/blob/main/src/domain/analysisErrorBase.ts): `src/domain/analysisErrorBase.ts`

### Runtime foundations

- [Provider process runtime](https://github.com/kniko/rea/blob/main/src/process/ProviderProcess.ts): `src/process/ProviderProcess.ts`
- [Process ownership](https://github.com/kniko/rea/blob/main/src/process/ProcessOwnership.ts): `src/process/ProcessOwnership.ts`
- [Provider deadlines](https://github.com/kniko/rea/blob/main/src/process/ProviderDeadline.ts): `src/process/ProviderDeadline.ts`
- [Private runtime root](https://github.com/kniko/rea/blob/main/src/process/PrivateRuntimeRoot.ts): `src/process/PrivateRuntimeRoot.ts`

### Other components

- **Agent or CLI user**

## Connections

- Agent or CLI user → MCP server: requests analysis (evidence: `README.md`)
- MCP server → Binary session: creates session (evidence: `src/main.ts`)
- MCP server → Provider routing: serves tools
- MCP server → Agent or CLI user: returns findings (evidence: `README.md`)
- Binary session → Provider routing: routes analysis
- Provider routing → Provider contract: selects provider (evidence: `src/application/binary/SessionProviderRouter.ts`)
- Provider routing → Native analysis: dispatches native work
- Provider routing → JavaScript analysis: dispatches app work
- JavaScript analysis → Semantic graph: builds semantic graph
- JavaScript analysis → JavaScript worker: runs analysis
- Provider contract → Hopper adapter: implemented by
- Provider contract → Ghidra adapter: implemented by (evidence: `src/ghidra/GhidraProviderClient.ts`)
- Provider contract → IDA adapter: implemented by (evidence: `src/ida/IdaSessionClient.ts`)
- Native analysis → Evidence model: reports findings
- JavaScript analysis → Evidence model: reports findings
- Web observation → Evidence model: reports observations
- Android analysis → Evidence model: reports findings
- Managed analysis → Evidence model: reports findings
- Firmware analysis → Evidence model: reports findings
- WASM inspection → Evidence model: reports findings
- EVM inspection → Evidence model: reports findings
- Crash analysis → Evidence model: reports observations
- Provider contract → Analysis result: returns execution (evidence: `src/application/AnalysisProvider.ts`)
- Analysis result → JSON boundary: validates values
- Provider contract → Typed errors: returns failures (evidence: `src/application/AnalysisProvider.ts`)
- Hopper adapter → Provider process runtime: manages process (evidence: `src/hopper/HopperClient.ts`)
- Ghidra adapter → Provider process runtime: uses process controls
- Provider process runtime → Process ownership: tracks ownership (evidence: `src/process/ProviderProcess.ts`)
- Provider process runtime → Provider deadlines: applies deadlines
- Provider process runtime → Private runtime root: uses private root