dsh-rea-mcp
仅配置的 DeepSeek Harness 捆绑包，将内置 MCP 客户端桥接连接到 morluto/rea——使用代理进行任何逆向工程；不含插件代码。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:sheilacraig/dsh-rea-mcp#7db2e20d42dbbb0662c92144e1c2f6567ba2ec84Rea Mcp 以 dsh-rea-mcp 发布，当前版本为 1.0.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A config-only bridge from DeepSeek Harness to REA — Reverse Engineer Anything.
中文 · English
It mounts the MCP client bridge that ships inside DeepSeek Harness and points it at REA's MCP server over stdio. The whole integration is a single file, cordis.patch.yml — about 20 lines, no JavaScript, small enough to read in full before you install it.
DSH agent
└─ mcp__rea__analyze_binary / search / decompile / ...
└─ @deepseek-ai/dsh-mcp-client (ships with DSH)
└─ npx -y rea-agents@6.4.0 mcp (stdio child process)
└─ REA analysis engines
├─ static JavaScript / .NET (no native engine needed)
├─ native binaries (Hopper / Ghidra / IDA)
└─ runtime & web capture (your user permissions)
REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, websites, network captures, Android APKs, firmware, SQLite snapshots and more. Analysis runs locally and returns evidence and limitations behind each conclusion. This bundle wires that into DeepSeek Harness as a plugin.
These are design choices, not a list of missing features:
index.js; no code of ours ever runs inside your harness process.~/.dsh/...state.json.npm run prewarm installs and verifies the upstream server in your own terminal; it never rewrites a profile patch.dependencies is empty; nothing to compile; no allowBuilds to grant.npx from PATH; this repository's test fails the build if any machine-related path leaks into a published file.peerDependencies. The row merely names @deepseek-ai/dsh-mcp-client and never imports it; DSH resolves its bundled copy from its own install, exactly like the official templates/mcp combo bundles. A peer would impose a hard activation gate whose prerelease SemVer rules silently reject legitimate hosts; the host range lives on engines.dsh for the market card instead.screenshots.json. There is no UI to photograph.If you want an in-app dependency installer or a doctor tool, this ecosystem has plugins for that. This one trades them for "small enough to audit on one screen".
>=0.2.0-rc.1 <0.3.0-0; verified by the author on 0.2.0-rc.2 (desktop). The range is a declaration; the test is on that one build; the two are not the same thing.npx launches rea-agents, which requires Node 22.x (>=22.19), 24.x (>=24.11), or 26+ and npm. The author tested on Node 24.In-app: Settings → Plugins → Add plugin, paste one of:
dsh-rea-mcp # the npm package name
github:sheilacraig/dsh-rea-mcp # the GitHub repository
C:\path\to\a\local\checkout # a local absolute path
For a CLI-held profile:
dsh plugin --profile <profile> add dsh-rea-mcp
The Electron desktop's own desktop profile belongs to the app; use its plugin panel.
Then restart DSH so the new patch layer is composed at startup.
npx downloads rea-agents@6.4.0 and its dependencies on first use. On a slow link that is a while, and the harness gives up on the initial MCP connection long before that finishes. Cache it outside the harness first, where there is no timeout:
npm run prewarm
The script runs npx -y rea-agents@6.4.0 mcp — the same argv the bridge runs — speaks initialize + tools/list to it, prints the server identity, the latency and the full tool list, then exits. It launches the very process the bridge will launch, so success here means there is nothing left to download or discover on the harness side.
Tools arrive named mcp__rea__<Tool>. The exact set is what upstream rea-agents@6.4.0 publishes and can vary slightly by release, so this plugin does not claim a fixed count — run npm run prewarm to see the live list. Capabilities include:
| Area | What REA returns |
|---|---|
| Native binaries | pseudocode, assembly, strings, symbols, calls and references |
| Go binaries | embedded compiler version, modules, replacements, build settings |
| WASM / EVM / firmware | sections, WAT forms, dispatch selectors, region extraction |
| JavaScript / Electron | modules, imports, source maps, routes, IPC, native add-ons |
| .NET assemblies | metadata, CIL instructions, native dependencies, build comparisons |
| Android APKs / devices | manifests, decompiled methods, packages, processes, dumps |
| Websites | page structure, scripts, network observations, screenshots |
| SQLite / crashes / captures | tables, registers/signals, requests, exposed payloads, packets |
Static JavaScript and .NET inspection read the supplied files without running the app. Runtime capture and device workflows run the selected target with your user permissions; consult each REA guide before enabling those.
npm run prewarm once — it verifies the server and the exact pinned version.mcp__rea__inspect_go_binary against a Go binary you own, or a static .NET inspection.This hands an agent the ability to read and analyze binaries on your machine, and (for native analysis) to drive an installed Hopper/Ghidra/IDA.
failOnStartupError: false means a REA that cannot start logs the reason and leaves the rest of the harness working.rea-agents@6.4.0 is fixed; an upstream release cannot silently change what this bridge does. Bump it deliberately, then re-run npm run prewarm.cordis.patch.yml before installing. That file is the plugin; everything else is metadata, docs, and tests.| Symptom | Cause & fix |
|---|---|
No mcp__rea__* tools | The bridge could not start the server. Run npm run prewarm in a terminal; it fails with the same reason. Most common cause: the process that runs DSH has no usable Node/npm on PATH (a desktop shortcut or editor can carry a different PATH than your terminal). The harness log has a mcp-client(rea) line. |
| Native analysis fails with "provider unavailable" | REA found no Hopper/Ghidra/IDA for that binary format. Static JavaScript and .NET analysis do not need one. Configure a provider per REA's installation guide, or raise REA_GHIDRA_STARTUP_TIMEOUT_MS / REA_HOPPER_STARTUP_TIMEOUT_MS for large binaries. |
| Tools are missing after an upgrade | The tool set is what the pinned version publishes. Bumping the pin can rename or add tools; check npm run prewarm and your prompts. |
| A runtime-capture call exposes a file it should not | Those workflows run with your permissions. Scope what you point REA at; do not run them against sensitive targets. |
npm install # only devDependency: js-yaml, used by the test
npm test # node --test — enforces this repository's claims
npm run prewarm # install and verify the upstream REA server
npm test mechanically enforces: exactly one insert row pointing at @deepseek-ai/dsh-mcp-client; serverName follows the tool-name namespace rule; the pinned rea-agents@<x.y.z> matches the prewarm script; failOnStartupError and the timeout are the documented values; the market entry obeys the curated-list submission rules; and no published file embeds an absolute path or drive letter.
Remove this bundle under Settings → Plugins, or delete the row from your profile patch. Uninstalling revokes the whole row. No residual files: the plugin writes nothing.
MIT — see LICENSE.