[GH-ISSUE #1050] [Feature] Add caller-selected views for large analysis results over MCP #384

Closed
opened 2026-10-15 18:24:29 +00:00 by bsakaguchi · 3 comments
Owner

Originally created by @N0zoM1z0 on GitHub (Oct 8, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1050

Before submitting

  • Searched open and closed issues and PRs (including #99, #264, #623 and #861).
  • Included only source-owned fixtures and sanitized measurements.

Area

MCP or agent integration; Evidence, artifacts, or reconstruction.

Current limitation

Large complete analysis results are difficult for agents to consume even when decoding succeeds. Inline result, Evidence projections, text and structured output can repeat substantial data. The pinned Node MCP SDK 2.3.1 stdio client defaults to a 10 MiB receive buffer.

While verifying #1037, a source-generated ELF of about 4 MiB with a canonical extended section-name index produced 65,281 section rows. The installed CLI succeeded. An explicit 256 MiB SDK receive buffer still hit a 120-second request timeout; a separate request with a 300-second deadline passed. In the successful run, server tool execution completed in about 11.6 seconds. Transfer/client processing is therefore a material part of the workflow. Tests used one CPU and bounded heaps; input bytes were unchanged and owned descendants were released.

These measurements establish this fixture's behavior, not a universal response-size ceiling or a diagnosis of every large-result failure.

Use cases

  • Inspect one section, symbol relationship or mitigation facet of a large binary without carrying its entire inventory through model context.
  • Continue a JavaScript artifact-graph or retained-capture investigation using only the facts needed for the next question.
  • Reuse retained evidence instead of repeating an expensive provider run solely to obtain a smaller view.

Desired outcome and success criteria

  • Agents can explicitly select a useful object, relationship, facet or stable page through a documented CLI/MCP workflow.
  • Complete default results and existing exact schemas remain available; no silent truncation or automatic schema/catalog reduction.
  • A selected view retains artifact identity, source locations, relevant limitations/unknowns and its relationship to the complete Evidence record. Do not reuse a complete-record digest for different projected content.
  • Selected facts are useful inline, without requiring a second lookup just to understand the requested result.
  • Representative tasks work with ordinary client framing settings and show improved end-to-end time and agent context use. Report actual coverage rather than treating serialized bytes alone as usability.
  • Tests cover selection, stable identities, invalid/stale references, schema validity, CLI/MCP equivalence and cleanup. Keep expensive complete-transfer cases in a separate lane.

Authority boundaries and non-goals

No additional target execution, mutation, network access or permission declarations. No custom orchestration/query language, second evidence cache or universal arbitrary row cap is required by this issue. CTF is one possible application; the capability is general.

Alternatives considered

  • CLI --filter-output already supports explicit field selection, but it does not provide the same MCP workflow and may still construct the complete analysis first.
  • Increasing SDK receive buffers/timeouts permits complete transfers, as verified above, but does not make the result convenient for an agent.
  • Existing Evidence resources (#99) and discovery improvements (#264) address related surfaces; this request concerns selecting useful analysis-result content.

Possible direction

Evaluate existing retained-Evidence resources and composable object/facet inspection before adding a new tool or contract option. Choose the smallest shared application workflow that preserves analyst control and exact provenance.

References

Originally created by @N0zoM1z0 on GitHub (Oct 8, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1050 ## Before submitting - [x] Searched open and closed issues and PRs (including #99, #264, #623 and #861). - [x] Included only source-owned fixtures and sanitized measurements. ## Area MCP or agent integration; Evidence, artifacts, or reconstruction. ## Current limitation Large complete analysis results are difficult for agents to consume even when decoding succeeds. Inline `result`, Evidence projections, text and structured output can repeat substantial data. The pinned Node MCP SDK 2.3.1 stdio client defaults to a 10 MiB receive buffer. While verifying #1037, a source-generated ELF of about 4 MiB with a canonical extended section-name index produced 65,281 section rows. The installed CLI succeeded. An explicit 256 MiB SDK receive buffer still hit a 120-second request timeout; a separate request with a 300-second deadline passed. In the successful run, server tool execution completed in about 11.6 seconds. Transfer/client processing is therefore a material part of the workflow. Tests used one CPU and bounded heaps; input bytes were unchanged and owned descendants were released. These measurements establish this fixture's behavior, not a universal response-size ceiling or a diagnosis of every large-result failure. ## Use cases - Inspect one section, symbol relationship or mitigation facet of a large binary without carrying its entire inventory through model context. - Continue a JavaScript artifact-graph or retained-capture investigation using only the facts needed for the next question. - Reuse retained evidence instead of repeating an expensive provider run solely to obtain a smaller view. ## Desired outcome and success criteria - Agents can explicitly select a useful object, relationship, facet or stable page through a documented CLI/MCP workflow. - Complete default results and existing exact schemas remain available; no silent truncation or automatic schema/catalog reduction. - A selected view retains artifact identity, source locations, relevant limitations/unknowns and its relationship to the complete Evidence record. Do not reuse a complete-record digest for different projected content. - Selected facts are useful inline, without requiring a second lookup just to understand the requested result. - Representative tasks work with ordinary client framing settings and show improved end-to-end time and agent context use. Report actual coverage rather than treating serialized bytes alone as usability. - Tests cover selection, stable identities, invalid/stale references, schema validity, CLI/MCP equivalence and cleanup. Keep expensive complete-transfer cases in a separate lane. ## Authority boundaries and non-goals No additional target execution, mutation, network access or permission declarations. No custom orchestration/query language, second evidence cache or universal arbitrary row cap is required by this issue. CTF is one possible application; the capability is general. ## Alternatives considered - CLI `--filter-output` already supports explicit field selection, but it does not provide the same MCP workflow and may still construct the complete analysis first. - Increasing SDK receive buffers/timeouts permits complete transfers, as verified above, but does not make the result convenient for an agent. - Existing Evidence resources (#99) and discovery improvements (#264) address related surfaces; this request concerns selecting useful analysis-result content. ## Possible direction Evaluate existing retained-Evidence resources and composable object/facet inspection before adding a new tool or contract option. Choose the smallest shared application workflow that preserves analyst control and exact provenance. ## References - #1037: offline ELF diagnostics and source-owned extended-index fixture. - #969: modular native diagnostics/debugger roadmap. - #623 and #861: historical large JavaScript analysis/output reports (closed). - [Current client-framing documentation](https://github.com/morluto/rea/blob/main/docs/javascript-artifact-reconstruction.md).
Author
Owner

@Sravan1011 commented on GitHub (Oct 8, 2026):

@N0zoM1z0 can I try this out

<!-- gh-comment-id:6056348297 --> @Sravan1011 commented on GitHub (Oct 8, 2026): @N0zoM1z0 can I try this out
Author
Owner

@N0zoM1z0 commented on GitHub (Oct 9, 2026):

Thanks! #1180 already has an implementation, and I’m reviewing it now. Feel free to try that PR and share how it works on your targets.

<!-- gh-comment-id:6073764042 --> @N0zoM1z0 commented on GitHub (Oct 9, 2026): Thanks! #1180 already has an implementation, and I’m reviewing it now. Feel free to try that PR and share how it works on your targets.
Author
Owner

@Sravan1011 commented on GitHub (Oct 9, 2026):

@mavanhorn has created a pr

<!-- gh-comment-id:6073916918 --> @Sravan1011 commented on GitHub (Oct 9, 2026): @mavanhorn has created a pr
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#384
No description provided.