morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #754] [MERGED] feat(ida): add read-only GUI and headless MCP providers #2215

New issue

Closed

opened 2026-10-16 21:15:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:48 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/754
Author: @N0zoM1z0
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/ida-mcp-provider

📝 Commits (1)

54c80a1 feat(ida): add read-only GUI and headless MCP providers

📊 Changes

50 files changed (+3770 additions, -43 deletions)

View changed files

📝 .oxlintrc.json (+2 -1)
📝 AGENTS.md (+2 -2)
📝 README.md (+20 -4)
📝 docs/architecture.mermaid (+7 -0)
➕ docs/ida-provider.md (+111 -0)
📝 docs/product-catalog.json (+21 -2)
📝 docs/testing.md (+32 -1)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 package.json (+1 -0)
📝 scripts/lib/catalog-builders.mjs (+4 -0)
📝 scripts/lib/catalog-core.mjs (+1 -0)
➕ scripts/verify-real-ida.mjs (+256 -0)
📝 skills/reverse-engineer-anything/SKILL.md (+15 -3)
📝 src/application/AnalysisProvider.ts (+2 -0)
📝 src/application/AnalysisSnapshotCache.ts (+1 -0)
📝 src/application/BinarySession.ts (+10 -0)
📝 src/application/DirectAnalysis.ts (+29 -18)
📝 src/application/Doctor.ts (+1 -1)
➕ src/application/FunctionAnalysisEvidence.ts (+54 -0)
📝 src/application/runtime.ts (+6 -1)

...and 30 more files

📄 Description

Summary

Fixes #747.

Reuse an existing mrexodia/ida-pro-mcp registration as REA's ida deep-analysis provider. An analyst connects to REA once, opens the original binary, and uses existing REA function/string tools. The attached profile reads the current GUI database; the headless profile opens and releases its own database automatically.

Problem and expected behavior

REA previously had no IDA provider, so agents had to configure and manage a second MCP surface. Existing IDA users should keep their upstream installation and select IDA through the same CLI/MCP contracts as other deep providers.

Change and scope

Add src/ida/ boundaries for registration parsing, pinned SDK transport, upstream producer normalization, analysis operations, protected workspaces, and database ownership/cleanup.
Support the legacy 1.4 attached profile and the modern database-supervisor headless profile. Admit read-only operations through a closed adapter map; upstream mutation, debugging, GUI navigation, and arbitrary Python tools are not forwarded.
Reuse upstream installation/configuration and document both profiles. Setup retains only REA_IDA_MCP_CONFIG; doctor validates registration without launching IDA.
Keep live IDA results out of snapshot replay. Preserve canonical function entries, raw observations, external callees, source locations, unknown facets, and upstream truncation reasons.
Share function Evidence presentation between CLI and MCP, preserving actual provider identity, profile, raw result, locations, and limitations instead of replacing them with a derived wrapper.

Contract and boundary impact

Semantic owner and earliest changed stage: provider configuration/admission and upstream MCP producer parsing in src/ida/; generic live-cache policy and function Evidence presentation in the application layer.
CLI and MCP/tool-catalog contract: no new tools or required tool arguments. Select ida with --provider, REA_ANALYSIS_PROVIDER, or open_binary.provider_id. Existing named output schemas remain canonical; direct callers are unavailable in the modern profile because code xrefs do not prove call edges.
Provider, bridge, target-format, or platform compatibility: upstream legacy GUI tools or modern supervisor tools are required. Admit original executable inputs, not .idb/.i64 files. Headless REA and upstream share native filesystem paths. Real workflows cover Windows; other engine/platform combinations are explicitly unverified.
Evidence, artifact, provenance, or reconstruction contract: function Evidence now identifies the actual deep provider consistently in both adapters, including Hopper/Ghidra. Adapter version is distinct from unknown IDA/distribution versions. Database revision, patches, complete body ranges, typed edges, CFG, and other unsupported facets remain unknown.
Process execution, authorization, cleanup, or containment impact: no new approval flags. Headless uses a digest-verified protected copy, force_headless, a unique requested session ID, verified worker ownership, explicit database arguments, and idb_close(save: false). Unconfirmed open/release retains the workspace and reports incomplete cleanup. Attached close releases the connection/proxy and leaves the GUI database open. Detached upstream workers do not have a REA Job Object containment claim.
Generated metadata (docs/product-catalog.json), package, or installation impact: regenerate provider/configuration catalog and related metadata; update README, architecture, testing guide, and bundled skill. No new runtime dependencies, engine installation, activation changes, or vendored upstream server.

Evidence and regression coverage

Tests added or updated: both profiles' named public output contracts; actual SDK loopback HTTP transport/authentication/redirect handling; malformed input/output; optional-null MCP projection; canonical entries versus call sites; external callees; pagination; target switches; cancellation draining; ownership failures; retained cleanup state; and live-cache exclusion. Existing Ghidra MCP Evidence regression now checks preserved provider observations.
Base reproduction or other evidence: before this change, ida was not a registered deep candidate. Real upstream observations established the legacy call-site/interior-address semantics and the modern explicit-database lifecycle. Packaged Windows testing caught forward-slash workspace paths at the native boundary; normalization now occurs on the actual host.
User-visible CLI/MCP output: the sanitized sequence below uses existing tool contracts. Function results include complete inline Evidence and explicit unsupported facets.
Remaining proof gaps: real HTTP-supervisor operation, modern attached GUI tools, Linux/macOS headless engines, other IDA versions/architectures, and abrupt process-death cleanup are not established by this PR.

{"name":"open_binary","arguments":{"path":"/samples/program.exe","provider_id":"ida"}}
{"name":"analyze_function","arguments":{"procedure":"rea_fixture_add"}}
{"name":"search_strings","arguments":{"pattern":"license"}}
{"name":"close_binary","arguments":{}}

Sanitized response excerpt (omitted fields remain present in the actual response):

{
  "evidence": {
    "provider": {"id":"ida","name":"IDA Pro MCP adapter","version":"1"},
    "analysis_profile": {
      "parameters": {
        "version_scope":"rea-ida-adapter",
        "engine_version":null,
        "mode":"headless",
        "cache_policy":"live"
      }
    }
  },
  "result": {
    "procedure": {
      "name":"rea_fixture_add",
      "address":"0x1000",
      "body":{"available":false,"reason":"IDA MCP does not report complete function body ranges."}
    }
  }
}

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run check:changed — typecheck/lint and 2,390 affected tests passed; one unrelated test skipped after integration with the fixed main snapshot.
npm run test:focused -- <IDA conformance, SDK HTTP boundary, Ghidra/function Evidence, product catalog, direct-analysis filesystem tests> — 42 tests passed.
npx vitest run src/ida/IdaSessionClient.test.ts --maxWorkers=1 — 15 tests passed, including rejected document selection before provider startup.
npm run docs:check, npm run knip, npm run jscpd, npm run scan:todos, and npx oxfmt --check . — passed.
node scripts/verify-real-ida.mjs --target <local-input> --procedure <function> — real Windows GUI through its existing legacy stdio proxy; production CLI/MCP contract validation and parity, all admitted operations, original-input preservation, and GUI still open after close.
The same real-provider lane against a Windows-native npm-installed branch artifact — modern supervisor at upstream commit c133c3853faa111a9b00ee615c013b720d0c4acd, IDA 9.3 build 260213, a benign x64 PE fixture, protected workspace, owned database release, and workspace removal. Fixture never executed.
Validation was sequential per engine, with two-core affinity, one headless worker, and a 1 GiB Node heap. Sampled process-family memory was approximately 0.6 GiB; sampled owned processes were gone after exit. D: remained above 43 GiB free; the isolated npm installation/cache and test archive were removed after verification. Public artifacts contain synthetic paths and no machine-specific registration, raw target output, or credentials.

Compatibility, safety, and release

Breaking changes or migration steps: no tool schema or required-input migration. analyze_function Evidence provenance now preserves its actual provider instead of a workflow wrapper; consumers should use the returned provider/profile rather than assuming rea-workflow.
Real Hopper/Ghidra, browser, or OS coverage: real IDA GUI and Windows-native headless/package workflows performed. Hopper/Ghidra engines and browser runtime were not executed for this provider change; relevant deterministic Ghidra/MCP regressions passed.
Package or release metadata impact: additive provider/configuration/verification lane and updated bundled skill. The branch artifact is not the published package; documentation distinguishes repository support from released versions.
Security, privacy, process, or containment review: existing GUI never closed/saved; original target unchanged; only verified owned workers receive close; POSIX 0700/Windows private DACL reused; transport authentication redacted from SDK diagnostics; ambient environment not persisted; no GUI/mutation/Python forwarding. Cleanup uncertainty remains visible rather than guessing ownership or deleting working files.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/754 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/ida-mcp-provider` --- ### 📝 Commits (1) - [`54c80a1`](https://github.com/morluto/rea/commit/54c80a15b0655916a51ff860938a0916a09d2d25) feat(ida): add read-only GUI and headless MCP providers ### 📊 Changes **50 files changed** (+3770 additions, -43 deletions) <details> <summary>View changed files</summary> 📝 `.oxlintrc.json` (+2 -1) 📝 `AGENTS.md` (+2 -2) 📝 `README.md` (+20 -4) 📝 `docs/architecture.mermaid` (+7 -0) ➕ `docs/ida-provider.md` (+111 -0) 📝 `docs/product-catalog.json` (+21 -2) 📝 `docs/testing.md` (+32 -1) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `package.json` (+1 -0) 📝 `scripts/lib/catalog-builders.mjs` (+4 -0) 📝 `scripts/lib/catalog-core.mjs` (+1 -0) ➕ `scripts/verify-real-ida.mjs` (+256 -0) 📝 `skills/reverse-engineer-anything/SKILL.md` (+15 -3) 📝 `src/application/AnalysisProvider.ts` (+2 -0) 📝 `src/application/AnalysisSnapshotCache.ts` (+1 -0) 📝 `src/application/BinarySession.ts` (+10 -0) 📝 `src/application/DirectAnalysis.ts` (+29 -18) 📝 `src/application/Doctor.ts` (+1 -1) ➕ `src/application/FunctionAnalysisEvidence.ts` (+54 -0) 📝 `src/application/runtime.ts` (+6 -1) _...and 30 more files_ </details> ### 📄 Description ## Summary Fixes #747. Reuse an existing `mrexodia/ida-pro-mcp` registration as REA's `ida` deep-analysis provider. An analyst connects to REA once, opens the original binary, and uses existing REA function/string tools. The attached profile reads the current GUI database; the headless profile opens and releases its own database automatically. ## Problem and expected behavior REA previously had no IDA provider, so agents had to configure and manage a second MCP surface. Existing IDA users should keep their upstream installation and select IDA through the same CLI/MCP contracts as other deep providers. ## Change and scope - Add `src/ida/` boundaries for registration parsing, pinned SDK transport, upstream producer normalization, analysis operations, protected workspaces, and database ownership/cleanup. - Support the legacy 1.4 attached profile and the modern database-supervisor headless profile. Admit read-only operations through a closed adapter map; upstream mutation, debugging, GUI navigation, and arbitrary Python tools are not forwarded. - Reuse upstream installation/configuration and document both profiles. Setup retains only `REA_IDA_MCP_CONFIG`; doctor validates registration without launching IDA. - Keep live IDA results out of snapshot replay. Preserve canonical function entries, raw observations, external callees, source locations, unknown facets, and upstream truncation reasons. - Share function Evidence presentation between CLI and MCP, preserving actual provider identity, profile, raw result, locations, and limitations instead of replacing them with a derived wrapper. ## Contract and boundary impact - Semantic owner and earliest changed stage: provider configuration/admission and upstream MCP producer parsing in `src/ida/`; generic live-cache policy and function Evidence presentation in the application layer. - CLI and MCP/tool-catalog contract: no new tools or required tool arguments. Select `ida` with `--provider`, `REA_ANALYSIS_PROVIDER`, or `open_binary.provider_id`. Existing named output schemas remain canonical; direct callers are unavailable in the modern profile because code xrefs do not prove call edges. - Provider, bridge, target-format, or platform compatibility: upstream legacy GUI tools or modern supervisor tools are required. Admit original executable inputs, not `.idb`/`.i64` files. Headless REA and upstream share native filesystem paths. Real workflows cover Windows; other engine/platform combinations are explicitly unverified. - Evidence, artifact, provenance, or reconstruction contract: function Evidence now identifies the actual deep provider consistently in both adapters, including Hopper/Ghidra. Adapter version is distinct from unknown IDA/distribution versions. Database revision, patches, complete body ranges, typed edges, CFG, and other unsupported facets remain unknown. - Process execution, authorization, cleanup, or containment impact: no new approval flags. Headless uses a digest-verified protected copy, `force_headless`, a unique requested session ID, verified worker ownership, explicit database arguments, and `idb_close(save: false)`. Unconfirmed open/release retains the workspace and reports incomplete cleanup. Attached close releases the connection/proxy and leaves the GUI database open. Detached upstream workers do not have a REA Job Object containment claim. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: regenerate provider/configuration catalog and related metadata; update README, architecture, testing guide, and bundled skill. No new runtime dependencies, engine installation, activation changes, or vendored upstream server. ## Evidence and regression coverage - Tests added or updated: both profiles' named public output contracts; actual SDK loopback HTTP transport/authentication/redirect handling; malformed input/output; optional-null MCP projection; canonical entries versus call sites; external callees; pagination; target switches; cancellation draining; ownership failures; retained cleanup state; and live-cache exclusion. Existing Ghidra MCP Evidence regression now checks preserved provider observations. - Base reproduction or other evidence: before this change, `ida` was not a registered deep candidate. Real upstream observations established the legacy call-site/interior-address semantics and the modern explicit-database lifecycle. Packaged Windows testing caught forward-slash workspace paths at the native boundary; normalization now occurs on the actual host. - User-visible CLI/MCP output: the sanitized sequence below uses existing tool contracts. Function results include complete inline Evidence and explicit unsupported facets. - Remaining proof gaps: real HTTP-supervisor operation, modern attached GUI tools, Linux/macOS headless engines, other IDA versions/architectures, and abrupt process-death cleanup are not established by this PR. ```json {"name":"open_binary","arguments":{"path":"/samples/program.exe","provider_id":"ida"}} {"name":"analyze_function","arguments":{"procedure":"rea_fixture_add"}} {"name":"search_strings","arguments":{"pattern":"license"}} {"name":"close_binary","arguments":{}} ``` Sanitized response excerpt (omitted fields remain present in the actual response): ```json { "evidence": { "provider": {"id":"ida","name":"IDA Pro MCP adapter","version":"1"}, "analysis_profile": { "parameters": { "version_scope":"rea-ida-adapter", "engine_version":null, "mode":"headless", "cache_policy":"live" } } }, "result": { "procedure": { "name":"rea_fixture_add", "address":"0x1000", "body":{"available":false,"reason":"IDA MCP does not report complete function body ranges."} } } } ``` - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check:changed` — typecheck/lint and 2,390 affected tests passed; one unrelated test skipped after integration with the fixed main snapshot. - `npm run test:focused -- <IDA conformance, SDK HTTP boundary, Ghidra/function Evidence, product catalog, direct-analysis filesystem tests>` — 42 tests passed. - `npx vitest run src/ida/IdaSessionClient.test.ts --maxWorkers=1` — 15 tests passed, including rejected document selection before provider startup. - `npm run docs:check`, `npm run knip`, `npm run jscpd`, `npm run scan:todos`, and `npx oxfmt --check .` — passed. - `node scripts/verify-real-ida.mjs --target <local-input> --procedure <function>` — real Windows GUI through its existing legacy stdio proxy; production CLI/MCP contract validation and parity, all admitted operations, original-input preservation, and GUI still open after close. - The same real-provider lane against a Windows-native npm-installed branch artifact — modern supervisor at upstream commit `c133c3853faa111a9b00ee615c013b720d0c4acd`, IDA 9.3 build 260213, a benign x64 PE fixture, protected workspace, owned database release, and workspace removal. Fixture never executed. - Validation was sequential per engine, with two-core affinity, one headless worker, and a 1 GiB Node heap. Sampled process-family memory was approximately 0.6 GiB; sampled owned processes were gone after exit. D: remained above 43 GiB free; the isolated npm installation/cache and test archive were removed after verification. Public artifacts contain synthetic paths and no machine-specific registration, raw target output, or credentials. ## Compatibility, safety, and release - Breaking changes or migration steps: no tool schema or required-input migration. `analyze_function` Evidence provenance now preserves its actual provider instead of a workflow wrapper; consumers should use the returned provider/profile rather than assuming `rea-workflow`. - Real Hopper/Ghidra, browser, or OS coverage: real IDA GUI and Windows-native headless/package workflows performed. Hopper/Ghidra engines and browser runtime were not executed for this provider change; relevant deterministic Ghidra/MCP regressions passed. - Package or release metadata impact: additive provider/configuration/verification lane and updated bundled skill. The branch artifact is not the published package; documentation distinguishes repository support from released versions. - Security, privacy, process, or containment review: existing GUI never closed/saved; original target unchanged; only verified owned workers receive close; POSIX `0700`/Windows private DACL reused; transport authentication redacted from SDK diagnostics; ambient environment not persisted; no GUI/mutation/Python forwarding. Cleanup uncertainty remains visible rather than guessing ownership or deleting working files. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:48 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:03:46 +00:00

[PR #2215] [CLOSED] fix(frida): validate caller-selected script file before starting a session #5089

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2215

No description provided.

Rows
Columns