4 tools · 139 capabilities · depth-1 schemas

rea-light-mcp

Reverse-engineer shipped software with your AI agent — binaries, apps, APKs, firmware — through 4 tiny tools that strict AI models accept, with the full power of REA hidden behind them.

Install in 2 minutes Take the quiz npm package

The problem it solves

Full reverse-engineering servers expose ~139 tools with deeply nested settings (~1.9 MB of schemas, nesting up to 14 levels). Strict AI models reject any request when a single tool breaks their limits — even a plain hi:

Before: full catalog139 tools · ~1.9 MB schemas · depth 14 · recursive references · rejected by strict models

After: rea-light-mcp4 tools · ~1.5 KB schemas · depth 1–2 · zero references · accepted everywhere

How it works

The key trick: complex settings travel as a plain text string (args_json), so strict models only ever see flat settings. Real checking happens inside the server, unchanged.

The 4 tools

Tool	Settings (all flat)	Use it for
`rea_search`	`query`, `domain?`, `limit?`	Find what REA can do: `decompile`, `apk`, `firmware`… returns short list, no heavy schemas.
`rea_describe`	`name`	Get one tool's full settings as readable text before running it.
`rea_call`	`name`, `args_json`	Run any of the 139 REA tools. Write-actions are blocked by default.
`rea_investigate`	`target`, `question`, `depth?`	One-shot answer: point at a file, ask one question, get markdown + evidence ids.

🌱 Beginner guide — read this and you are a professional

What is MCP? A standard plug for AI assistants. A "server" is a small program that gives your assistant new skills (tools). You configure it once; every chat can then use it.

What is reverse engineering? Learning how a finished program works without its source code — which buttons do what, where data flows, how a file format is built. It uses only software you own or are allowed to examine.

Why the "light" version? The full toolset is so big that strict AI models refuse to talk while it is connected. This package shows the model 4 simple tools and keeps the other 139 behind the curtain — same power, no refusal.

Your first investigation. Install (below), then ask: "Using rea_investigate, open /usr/bin/ls and tell me what kind of binary it is." You will get format, architecture and fingerprint plus what to ask next.

The everyday loop. rea_search to find → rea_describe to learn settings → rea_call to run. After this page's quiz you will know more than most interview candidates.

Install

No install needed — run from npm

npx -y rea-light-mcp

OpenCode config (`~/.config/opencode/opencode.jsonc`)

{
  "mcp": {
    "rea":       { "type": "local", "command": ["npx", "-y", "rea-agents@6.4.0", "mcp"], "enabled": false },
    "rea-light": { "type": "local", "command": ["npx", "-y", "rea-light-mcp"], "enabled": true, "timeout": 120000 }
  }
}

Disable full rea (that is what strict models reject). Restart the session after editing. First run downloads packages — give it a minute.

Settings

Variable	Default	Meaning
`REA_COMMAND`	`npx -y rea-agents@6.3.0 mcp`	Which REA server runs behind the hub (pinned measured release).
`REA_TIMEOUT_MS`	`120000`	Per-call timeout; stdio serves calls one at a time.
`REA_LIGHT_ALLOW_WRITE`	unset (read-only)	Set to `1` to allow rename/comment tools.

Who uses it, for what

App developers"How does this feature work in the app I admire?" — trace it, see the evidence, rebuild it cleanly in your own project.

Security learnersInspect binaries you own, practice reading assembly and metadata with an AI tutor that shows its sources.

StudentsFrom "what is a binary?" to reading call graphs — the quiz below takes you from zero to pro.

Strict-model usersAnyone whose model rejects huge tool catalogs: 4 flat tools pass every known depth/size gate.

🎓 Interactive quiz — from scratch to pro

8 questions, 3 levels. Each answer explains why, so a wrong answer still teaches. Passing: 6/8.

Level 1 · Starter

Question 1/8 · Score 0

FAQ

Is this a replacement for REA?

No — it is REA, through a smaller door. Same server, same checks, same results. If you remove the size limits (another model), full REA works too.

Why do deep tools fail without extra software?

Disassembly engines (Ghidra, Hopper, IDA) are professional tools you install yourself; this package never installs them for you. Opening and fingerprinting files works with nothing extra.

Does it upload my files?

No. Everything runs on your machine; the AI model provider only sees the text you discuss.

Can I allow renaming/commenting tools?

Yes: set REA_LIGHT_ALLOW_WRITE=1 in the server environment. Default stays read-only so accidents can't happen.