[GH-ISSUE #3672] [Feature] AI agent protocol reverse engineering: MCP, A2A, OpenAI-compatible tool calling and agent-to-tool graph reconstruction #1385

New issue

Open

opened 2026-10-16 21:04:56 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:56 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3672

Summary

Autonomous AI agents, coding assistants, multi-agent swarms, and agentic desktop extensions communicate via emerging agent communication protocols:

Model Context Protocol (MCP): Anthropic's open standard for client-server tool invocation, prompt discovery, resource subscription, and sampling handshakes over STDIO and Server-Sent Events (SSE);
A2A (Agent-to-Agent): Inter-agent delegation protocols, hierarchical supervisor-worker communications, and task handoff schemas;
OpenAI-Compatible Tool Calling: Function call round-trips (tool_calls, function_call, arguments JSON, role: "tool" responses);
Dynamic Capabilities & Handshakes: Tool capability negotiation, authorization boundaries, and session state lifecycles.

Currently, while REA implements MCP servers for reverse engineering tools, it has no capability to inspect and reverse engineer third-party AI agents, multi-agent frameworks (LangGraph, CrewAI, AutoGen), or agent protocol interactions.

This feature proposal introduces dedicated AI Agent Protocol Reverse Engineering to REA, enabling automated static extraction of agent capability manifests, tool schemas, inter-agent delegation protocols, and end-to-end agent-to-tool workflow graphs.

Technical Capabilities & Architecture

                                    +-----------------------------------------+
                                    | Input: Agent Application Artifact       |
                                    |        (JSON configs, runtime traces)   |
                                    +--------------------+--------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | MCP Protocol Inversion    |                                   | A2A Swarm & Delegation    |
           | (Tools, Prompts, Resources)                                   | Topology Parser           |
           +-------------+-------------+                                   +-------------+-------------+
                         |                                                               |
                         +-------------------------------+-------------------------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | Tool Calling & Function Schema Engine |
                                     | (Parameter Constraints, Return Types) |
                                     +-------------------+-------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | Agent State Machine &     |                                   | Security & Sandbox        |
           | Handoff Graph Synthesis   |                                   | Boundary Auditing         |
           +-------------+-------------+                                   +-------------+-------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | REA Evidence: Agent Protocol Dossier, |
                                     | Swarm Topology & Tool Execution Graph |
                                     +---------------------------------------+

1. Model Context Protocol (MCP) Inversion

Specification Decoding: Parse MCP client and server communication envelopes:
- Tool registration (tools/list): tool names, markdown descriptions, and input JSON schemas.
- Resource templates (resources/list, resources/templates): URI schemes, MIME types, and dynamic resource access rules.
- Prompt declarations (prompts/list): user prompt templates and argument schemas.
Transport Identification: Map whether the agent communicates via standard input/output (STDIO process spawning) or HTTP with Server-Sent Events (SSE).

2. A2A (Agent-to-Agent) & Swarm Delegation Topology

Hierarchical Swarms: Invert multi-agent team structures:
- Supervisor / Router agents delegating tasks to specialized subagents (Coder, Tester, Planner, Critic).
- Task completion criteria, consensus voting, and critique-refinement loops.
Message Serialization: Decode inter-agent payload formats (JSON-RPC, custom JSON envelopes, LangChain message representations).

3. Tool Calling & Function Execution Wireups

Tool Schema Extraction: Extract OpenAI-style tools: [{type: "function", function: {...}}] specifications directly from application binaries or bundles.
Round-Trip Tracking: Reconstruct the complete interaction lifecycle:
Agent Prompt -> Model Generation (Tool Call Request) -> Tool Execution -> Tool Output Payload -> Model Synthesis.

4. Security & Sandbox Boundary Auditing

Permission Boundaries: Identify which tools possess write access, shell execution permissions (bash, cmd), network access, or filesystem mutation capabilities.
Prompt Injection & Tool Shadowing Surfaces: Detect unvalidated user inputs directly passed into tool arguments without sanitization or guardrails.

Acceptance Criteria

Introduce analyze_agent_protocol in REA CLI and MCP contracts.
Ingest synthetic MCP server declarations and output structured JSON inventories of tools, prompts, and resources.
Map inter-agent delegation graphs across multi-agent swarms.
Extract tool execution schemas and parameter constraints in structured evidence.
Identify high-privilege tool capabilities (shell execution, file deletion) with explicit security warning annotations.

#3651 [Feature] LLM application reverse engineering
#3323 [Feature] Inspect GGUF and safetensors model files without loading them
#3599 [Feature] Passive DNS extraction and cybersecurity analysis primitives

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3672 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Autonomous AI agents, coding assistants, multi-agent swarms, and agentic desktop extensions communicate via emerging agent communication protocols: - **Model Context Protocol (MCP):** Anthropic's open standard for client-server tool invocation, prompt discovery, resource subscription, and sampling handshakes over STDIO and Server-Sent Events (SSE); - **A2A (Agent-to-Agent):** Inter-agent delegation protocols, hierarchical supervisor-worker communications, and task handoff schemas; - **OpenAI-Compatible Tool Calling:** Function call round-trips (`tool_calls`, `function_call`, `arguments` JSON, `role: "tool"` responses); - **Dynamic Capabilities & Handshakes:** Tool capability negotiation, authorization boundaries, and session state lifecycles. Currently, while REA implements MCP servers for reverse engineering tools, it has no capability to inspect and reverse engineer third-party AI agents, multi-agent frameworks (LangGraph, CrewAI, AutoGen), or agent protocol interactions. This feature proposal introduces dedicated **AI Agent Protocol Reverse Engineering** to REA, enabling automated static extraction of agent capability manifests, tool schemas, inter-agent delegation protocols, and end-to-end agent-to-tool workflow graphs. --- ## Technical Capabilities & Architecture ``` +-----------------------------------------+ | Input: Agent Application Artifact | | (JSON configs, runtime traces) | +--------------------+--------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | MCP Protocol Inversion | | A2A Swarm & Delegation | | (Tools, Prompts, Resources) | Topology Parser | +-------------+-------------+ +-------------+-------------+ | | +-------------------------------+-------------------------------+ | v +---------------------------------------+ | Tool Calling & Function Schema Engine | | (Parameter Constraints, Return Types) | +-------------------+-------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | Agent State Machine & | | Security & Sandbox | | Handoff Graph Synthesis | | Boundary Auditing | +-------------+-------------+ +-------------+-------------+ | v +---------------------------------------+ | REA Evidence: Agent Protocol Dossier, | | Swarm Topology & Tool Execution Graph | +---------------------------------------+ ``` ### 1. Model Context Protocol (MCP) Inversion - **Specification Decoding:** Parse MCP client and server communication envelopes: - Tool registration (`tools/list`): tool names, markdown descriptions, and input JSON schemas. - Resource templates (`resources/list`, `resources/templates`): URI schemes, MIME types, and dynamic resource access rules. - Prompt declarations (`prompts/list`): user prompt templates and argument schemas. - **Transport Identification:** Map whether the agent communicates via standard input/output (STDIO process spawning) or HTTP with Server-Sent Events (SSE). ### 2. A2A (Agent-to-Agent) & Swarm Delegation Topology - **Hierarchical Swarms:** Invert multi-agent team structures: - Supervisor / Router agents delegating tasks to specialized subagents (Coder, Tester, Planner, Critic). - Task completion criteria, consensus voting, and critique-refinement loops. - **Message Serialization:** Decode inter-agent payload formats (JSON-RPC, custom JSON envelopes, LangChain message representations). ### 3. Tool Calling & Function Execution Wireups - **Tool Schema Extraction:** Extract OpenAI-style `tools: [{type: "function", function: {...}}]` specifications directly from application binaries or bundles. - **Round-Trip Tracking:** Reconstruct the complete interaction lifecycle: `Agent Prompt -> Model Generation (Tool Call Request) -> Tool Execution -> Tool Output Payload -> Model Synthesis`. ### 4. Security & Sandbox Boundary Auditing - **Permission Boundaries:** Identify which tools possess write access, shell execution permissions (`bash`, `cmd`), network access, or filesystem mutation capabilities. - **Prompt Injection & Tool Shadowing Surfaces:** Detect unvalidated user inputs directly passed into tool arguments without sanitization or guardrails. --- ## Acceptance Criteria 1. Introduce `analyze_agent_protocol` in REA CLI and MCP contracts. 2. Ingest synthetic MCP server declarations and output structured JSON inventories of tools, prompts, and resources. 3. Map inter-agent delegation graphs across multi-agent swarms. 4. Extract tool execution schemas and parameter constraints in structured evidence. 5. Identify high-privilege tool capabilities (shell execution, file deletion) with explicit security warning annotations. --- ## Related - #3651 [Feature] LLM application reverse engineering - #3323 [Feature] Inspect GGUF and safetensors model files without loading them - #3599 [Feature] Passive DNS extraction and cybersecurity analysis primitives

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:10:56 +00:00

[PR #1385] [CLOSED] test(javascript): expect provable precision for the short-circuit mutation #2844