REA

NPM · REA-AGENTS · SCANNED AUG 12

Reverse engineer anything from your terminal or agent with one CLI and MCP server.

Available components

82 82 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security98

No malware found by supply-chain analysis.Pass
No known CVEs affecting this package version or its production dependencies.Pass
No install/post-install scripts declared.Pass
46 of 143 dependencies flagged as unhealthy. View diagnostics → Partial

Provenance & Transparency100

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to morluto/rea). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 2 days ago).Pass
Publishes a security disclosure policy (SECURITY.md).Pass

Schema Quality & AI Usability86

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Context-footprint check failed: tool/resource definitions use about 13746 tokens (~116/item across 118 items; 116 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
Tools include usage examples.Pass

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass
Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a current MCP spec version (2026-07-28).Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · rea-agents

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add morluto-rea -- npx -y rea-agents

# add to Codex CLI

codex mcp add morluto-rea -- npx -y rea-agents

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "morluto-rea": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "rea-agents"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add morluto-rea --command npx --arg -y --arg rea-agents

# ~/.hermes/config.yaml

mcp_servers:
  morluto-rea:
    command: "npx"
    args: ["-y", "rea-agents"]

// mcp.json

{
  "mcpServers": {
    "morluto-rea": {
      "command": "npx",
      "args": [
        "-y",
        "rea-agents"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

11 Aug 26 +4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
10 Aug 26 +15
- Malware scan: unverified → pass ▲ security
9 Aug 26 63

First indexed and scored.

Show 1 earlier entry Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 12 Aug 2026 · Analysed npm/rea-agents@3.1.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result	Verified
Ecosystem	npm
Reason	Verified
Discovered via	Registry attestation endpoint
Source repo	morluto/rea
Certificate issuer	https://token.actions.githubusercontent.com
Certificate SAN	https://github.com/morluto/rea/.github/workflows/release.yml@refs/heads/main
Rekor log index	2399048204
Predicate type	https://slsa.dev/provenance/v1
Subject digest	sha512:8a9f637633af4ec2b034be57a2bf69860919a93c48fb8a08e3436bfd2743126e734d3c06bf12213b4e661d43f208e37c49c6ca7bf2826256780d320f7

Dependencies 143 packages

Packages resolved	143
Stale	46
Tree resolution	Complete

MCP tools · 116 exposed · ~13,590 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

address_name Address Name ~103

Resolve the primary analyzed name at a code or data address. Headless providers require an explicit address; GUI providers may default to their current cursor. Null means the provider has no primary name at that address.

Input Output Examples

Name	Type	Req	Description
address	string	–	A provider-normalized address; default memory uses 0x-prefixed hexadecimal
document	string	–	The document name
unknown_registry_approved	boolean	–	Explicit approval to record typed capability unavailability as a residual unknown

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	–	yes	–

{}

address_to_file_offset Address To File Offset ~98

Map one provider-normalized virtual address to its original nonnegative file offset. Unmapped addresses fail explicitly, and providers without an authoritative mapping API return typed capability unavailability.

Input Output Examples

Name	Type	Req	Description
address	string	yes	A provider-normalized address; default memory uses 0x-prefixed hexadecimal
document	string	–	The document name
unknown_registry_approved	boolean	–	Explicit approval to record typed capability unavailability as a residual unknown

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"address":"0x1000"}

analyze_function Analyze Function ~221

Preferred bounded analysis for one procedure symbol or address. Returns identity, provider-specific pseudocode, optional assembly, comments, calls, typed-or-explicitly-unavailable references, referenced strings/names, and local CFG blocks with exact truncation metadata. Providers with a structured decompiler model also expose native API boundary types, confidence, evidence, jump-table data/target addresses, and explicit decompiler-artifact labels.

Input Output Examples

Name	Type	Req	Description
assembly_offset	integer	–	Zero-based index of the first assembly to return.
collection_offset	object	–	Zero-based index of the first collection to return.
include_assembly	boolean	–	Whether to include assembly in the result.
limit	integer	–	Maximum number of results to return in this page.
max_instructions	integer	–	Maximum permitted instructions for this operation.
max_pseudocode_chars	integer	–	Maximum permitted pseudocode chars for this operation.
procedure	string	yes	A procedure name or address
pseudocode_offset	integer	–	Zero-based index of the first pseudocode to return.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"assembly_offset":0,"collection_offset":{"basic_blocks":0,"callees":0,"callers":0,"comments":0,"incoming_references":0,"outgoing_references":0,"referenced_names":0,"referenced_strings":0},"include_assembly":false,"limit":100,"max_instructions":500,"max_pseudocode_chars":20000,"procedure":"main","pseudocode_offset":0}

analyze_javascript_application Analyze Javascript Application ~192

Statically reconstruct one approved local ASAR or extracted JavaScript application without executing it. The default summary returns architecture/security counts, top evidence-backed findings, unknowns, and paged graph resource URIs; request detail=full only when the complete graph must be returned immediately. Identical inputs are deterministic, so do not repeat the call or reread full Evidence without a specific missing detail.

Input Output Examples

Name	Type	Req	Description
approved	boolean	yes	Explicit operator approval to perform this operation.
detail	string	–	summary returns bounded findings and paged graph resource URIs; full returns the complete graph only when explicitly required
format	string	–	Declared input artifact format.
input_path	string	yes	Local filesystem path for input.
limits	object	–	Bounded resource-consumption and result-size limits for this operation.
source_map_read_approved	boolean	–	Explicit operator approval for source map read.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	–	yes	–

{"approved":true,"detail":"summary","format":"auto","input_path":"/Applications/Example.app/Contents/Resources/app.asar","source_map_read_approved":false}

analyze_swift_types Analyze Swift Types ~53

Categorize exhaustively paged procedure names into Swift classes, structs, enums, protocols, extensions, and other symbols. Scans at most 5,000 names and returns at most 50 entries per category.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{}

analyze_web_bundle Analyze Web Bundle ~62

Capture explicitly approved JavaScript source from one approved CDP page and statically derive a bounded chunk graph, route and endpoint candidates, vendor fingerprints, page-declared WebMCP metadata, and optional separately approved source-map evidence. JavaScript is parsed but never executed.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"allowed_origins":["https://app.example.test"],"analysis_limits":{"max_ast_nodes":250000,"max_findings":1000,"max_original_sources":2000,"max_source_map_bytes":4194304,"max_source_map_mappings":10000,"max_source_maps":100,"max_total_source_map_bytes":16777216},"approved":true,"cdp_endpoint":"http://127.0.0.1:9222","fetch_source_maps":false,"include_accessibility_text":false,"include_script_sources":true,"include_storage_keys":false,"observation_ms":500,"source_capture_approved":true,"source_map_fetch_approved":false,"target_id":"TARGET_ID_FROM_LIST_BROWSER_TARGETS"}

batch_decompile Batch Decompile ~58

Decompile up to 20 explicit procedure symbols or addresses concurrently. Returns ordered per-item ok/error variants and aggregate counts; use analyze_function for a richer single-function dossier.

Input Output Examples

Name	Type	Req	Description
addresses	array	–	Ordered provider-normalized procedure addresses to analyze.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"addresses":[]}

binary_overview Binary Overview ~70

Use immediately after opening a target to summarize document, exhaustive procedure/string counts, and a bounded segment sample. detail controls segment fields and limit controls only the returned segment sample.

Input Output Examples

Name	Type	Req	Description
detail	string	–	Requested response detail level.
limit	integer	–	Maximum number of results to return in this page.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"detail":"concise","limit":10}

binary_session Binary Session ~191

Report compact target, provider, and alignment state without starting analysis. The default summary is the routing check agents should use; detail=capabilities returns one family-filtered availability page, while detail=full is reserved for complete provider diagnostics.

Input Output Examples

Name	Type	Req	Description
capability_family	string	–	Optional tool family for detail=capabilities
cursor	integer	–	Zero-based capability cursor for detail=capabilities
detail	string	–	summary returns routing state; capabilities returns one filtered tool-availability page; full returns complete diagnostics only when required
expected_catalog_digest	string	–	Expected catalog digest used to reject stale or mismatched input.
expected_package_version	string	–	Expected package version used to reject stale or mismatched input.
expected_server_path	string	–	Expected server path used to reject stale or mismatched input.
limit	integer	–	Maximum number of results to return in this page.

Name	Type	Req	Description
result	–	yes	–

{"cursor":0,"detail":"summary","limit":25}

build_call_path Build Call Path ~165

Build bounded shortest-first direct-callee paths from explicit analyze_function Evidence groups using exact canonical addresses. Missing dossiers, incomplete callee pages, provider mixing, and depth frontiers remain unknown; every node and edge cites source Evidence.

Input Output Examples

Name	Type	Req	Description
functions	array	yes	Value for functions.
goal	object	yes	Value for goal.
limit	integer	–	Maximum number of results to return in this page.
max_depth	integer	–	Maximum permitted depth for this operation.
max_paths	integer	–	Maximum permitted paths for this operation.
offset	integer	–	Zero-based index of the first result to return.
start	object	yes	Value for start.
unknown_registry_approved	boolean	–	Explicit approval to record bounded residual uncertainty in the session registry.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"functions":[{"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_ff8eed2e28fd9549add0c20d7573566358ad228b980f538e2e0709155a456e1e","evidence_links":[],"limitations":[],"locations":[],"normalized_result":{"assembly":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false},"basic_blocks":{"items":[{"end":"0x1001","start":"0x1000","successors":[]}],"next_offset":null,"returned":1,"total":1,"truncated":false},"callees":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false},"callers":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false},"comments":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false},"incoming_references":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false},"instruction_scan":{"scanned":1,"truncated":false},"outgoing_references":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false},"procedure":{"address":"0x1000","locals":[],"name":"main","signature":"int main(void)"},"pseudocode":{"next_offset":null,"returned_chars":9,"text":"return 0;","total_chars":9,"truncated":false},"referenced_names":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false},"referenced_strings":{"items":[],"next_offset":null,"returned":0,"total":0,"truncated":false}},"operation":"analyze_function","parameters":{"assembly_offset":0,"collection_offset":{"basic_blocks":0,"callees":0,"callers":0,"comments":0,"incoming_references":0,"outgoing_references":0,"referenced_names":0,"referenced_strings":0},"include_assembly":false,"limit":100,"max_instructions":500,"max_pseudocode_chars":20000,"procedure":"main","pseudocode_offset":0},"predicate_type":"rea.analysis/v2","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"schema_version":2,"subject":{"architecture":null,"digest":{"sha256":"0000000000000000000000000000000000000000000000000000000000000000"},"format":"mach-o","local_path":"/tmp/function-0","name":"functio

build_reconstruction_obligation_ledger Build Reconstruction Obligation Ledger ~162

Generate one deterministic page of a ReconstructionObligationLedger/v1 from an authenticated Evidence v2 bundle, reviewed obligations, and an explicit reconstruction manifest. Static candidates remain candidates; duplicate ownership, missing original or reconstruction cases, missing parser/type, weak verifier authority, unenumerated claims, contradictions, dependencies, and residual unknowns fail closed. Every page carries the same full-ledger closure digest and typed per-obligation diagnostics.

Input Output Examples

Name	Type	Req	Description
evidence_bundle	object	yes	Value for evidence bundle.
limits	object	yes	Bounded resource-consumption and result-size limits for this operation.
manifest	object	yes	Value for manifest.
page	object	yes	Value for page.
reviewed_obligations	array	yes	Value for reviewed obligations.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"evidence_bundle":{"artifacts":[],"bundle_version":2,"captures":[],"environments":[],"providers":[],"records":[],"scenarios":[],"unknowns":[]},"limits":{"max_obligations":1000},"manifest":{"bindings":[],"contradictions":[],"schema_version":1},"page":{"limit":50,"offset":0},"reviewed_obligations":[]}

capture_browser_scenario Capture Browser Scenario ~266

Run one approved, bounded browser scenario through Playwright. Launch mode owns and terminates a temporary browser profile; connect mode attaches to one exact loopback CDP target and disconnects without terminating the external browser. Only the fixed action vocabulary is accepted. Navigation, storage, requests, redirects, secrets, redaction, captures, and limits must be declared before execution. Returns step-indexed Evidence with screenshots, DOM, accessibility, URL/history/storage state, runtime events, explicit missing/truncated sections, and equality eligibility.

Input Output Examples

Name	Type	Req	Description
actions	array	yes	Value for actions.
allowed_origins	array	yes	Value for allowed origins.
approved	boolean	yes	Explicit operator approval to perform this operation.
browser	–	yes	Value for browser.
capture	object	yes	Value for capture.
environment	object	yes	Value for environment.
limits	object	yes	Bounded resource-consumption and result-size limits for this operation.
redaction	object	yes	Value for redaction.
request_replay	–	yes	Value for request replay.
schema_version	number	yes	Version of this structured result schema.
secrets	array	–	Value for secrets.
start_url	object	yes	Value for start url.
storage	object	yes	Value for storage.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"actions":[{"action":"wait_for","locator":{"kind":"test_id","value":"application-ready"},"state":"visible","step_id":"ready"}],"allowed_origins":["https://app.example.test"],"approved":true,"browser":{"cleanup":"close-and-delete-profile","executable_path":"/opt/chromium/chrome","headless":true,"mode":"launch","user_data":"temporary-owned"},"capture":{"after_each_step":["screenshot","url","accessibility"],"at_end":["dom","history","storage"],"events":["console","page-errors","network","websockets"]},"environment":{"color_scheme":"light","locale":"en-US","reduced_motion":"reduce","service_workers":"block","timezone":"UTC","viewport":{"device_scale_factor":1,"height":720,"width":1280}},"limits":{"action_timeout_ms":5000,"max_accessibility_nodes":10000,"max_dom_nodes":10000,"max_duration_ms":60000,"max_events":2000,"max_frames":100,"max_popups":10,"max_screenshot_bytes":4194304,"max_screenshots":16,"max_storage_entries":256,"max_total_metadata_bytes":4194304,"max_websockets":100,"max_workers":20,"navigation_timeout_ms":10000},"redaction":{"header_names":["authorization","cookie","proxy-authorization","set-cookie"],"query_parameter_names":[],"secret_values":"replace-with-secret-reference"},"request_replay":{"mode":"disabled"},"schema_version":1,"secrets":[],"start_url":{"query":[],"url":"https://app.example.test/"},"storage":{"cookies":[],"local_storage":[],"session_storage":[]}}

capture_electron_scenario Capture Electron Scenario ~241

Use this for an explicitly approved, provider-owned Electron run when passive CDP or Inspector observation cannot exercise application behavior. REA owns startup and teardown, accepts bounded click/wait actions plus window-targeted renderer reload/crash and synthetic open-url/second-instance delivery, and returns correlated window/WebContents/process/preload/session/navigation/shell/IPC evidence without retaining payload values. Results identify observed and unavailable event families, coverage status, action targets, and truncation. External shell, navigation, permission, download, popup, updater, and OS-integration effects are blocked and recorded. Use passive Electron tools for observation-only work.

Input Output Examples

Name	Type	Req	Description
actions	array	–	Value for actions.
application_path	string	yes	Local filesystem path for application.
application_root	string	yes	Approved canonical filesystem application root.
approved	boolean	yes	Explicit operator approval to perform this operation.
args	array	–	Value for args.
executable_path	string	yes	Local filesystem path for executable.
limits	object	–	Bounded resource-consumption and result-size limits for this operation.
schema_version	number	yes	Version of this structured result schema.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"actions":[{"kind":"click","selector":"#run","step_id":"exercise-ipc"}],"application_path":"/Applications/Example.app/Contents/Resources/main.js","application_root":"/Applications/Example.app/Contents/Resources","approved":true,"args":[],"executable_path":"/Applications/Electron.app/Contents/MacOS/Electron","limits":{"action_timeout_ms":5000,"max_actions":20,"max_duration_ms":60000,"max_ipc_events":2000,"max_processes":32,"max_windows":32},"schema_version":1}

capture_process_scenario Capture Process Scenario ~373

Run one bounded process under a PTY using operator-approved executable and working roots. Produces Process Capture v4; legacy v3 captures cannot be upgraded and must be recaptured with this tool. Requires approved: true; unknown_registry_approved: true separately records capture residuals. Captures raw and xterm-rendered terminal frames, scripted interactions, lifecycle filesystem checkpoints, process ownership, declarative command shims, and loopback replay. Disabled unless operator policy enables it; not a security sandbox.

Input Output Examples

Name	Type	Req	Description
approved	boolean	yes	Explicit per-call acknowledgement that this operation launches the target
arguments	array	–	Value for arguments.
checkpoints	array	–	Value for checkpoints.
command_shims	array	–	Value for command shims.
environment	object	–	Value for environment.
events	array	–	Value for events.
executable	string	yes	Approved absolute path of the executable to run.
filesystem_roots	array	–	Approved canonical filesystem filesystem roots.
idle_timeout_ms	integer	–	Value for idle timeout ms.
inherit_environment	array	–	Value for inherit environment.
limits	object	–	Bounded resource-consumption and result-size limits for this operation.
network_access	string	–	Value for network access.
normalization	object	–	Value for normalization.
reactive	–	–	Value for reactive.
replay	object	–	Value for replay.
secret_aliases	array	–	Value for secret aliases.
settle_ms	integer	–	Value for settle ms.
terminal	object	–	Value for terminal.
timeout_ms	integer	–	Value for timeout ms.
unknown_registry_approved	boolean	–	Explicit approval to record capture residuals durably
working_directory	string	yes	Value for working directory.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"approved":true,"arguments":[],"checkpoints":[],"command_shims":[],"environment":{},"events":[],"executable":"/usr/bin/true","filesystem_roots":[],"idle_timeout_ms":30000,"inherit_environment":[],"limits":{"connections":100,"file_bytes":10000000,"files":10000,"filesystem_depth":16,"frames":10000,"output_bytes":1000000,"processes":1000,"protocol_body_bytes":1000000,"protocol_events":10000},"network_access":"host","normalization":{"paths":true,"patterns":[],"pids":true,"ports":true,"time_bucket_ms":10},"reactive":null,"replay":{"http":[],"machine":null,"websocket_connections":[],"websocket_messages":[]},"secret_aliases":[],"settle_ms":100,"terminal":{"columns":80,"rows":24,"scrollback":1000},"timeout_ms":30000,"working_directory":"/tmp"}

capture_web_screenshot Capture Web Screenshot ~138

Capture the current visible viewport of one approved page as a bounded, content-addressed PNG artifact. Screenshot capture requires separate explicit approval and never scrolls, navigates, or evaluates page JavaScript.

Input Output Examples

Name	Type	Req	Description
allowed_origins	array	yes	Value for allowed origins.
approved	boolean	yes	Explicit operator approval to perform this operation.
cdp_endpoint	string	yes	Approved literal loopback Chrome DevTools Protocol endpoint.
maximum_image_bytes	integer	–	Bounded byte count for maximum image.
screenshot_approved	boolean	yes	Explicit operator approval for screenshot.
target_id	string	yes	Exact authorized CDP target identifier.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"allowed_origins":["https://app.example.test"],"approved":true,"cdp_endpoint":"http://127.0.0.1:9222","maximum_image_bytes":4194304,"screenshot_approved":true,"target_id":"TARGET_ID_FROM_LIST_BROWSER_TARGETS"}

close_binary Close Binary ~84

Optionally write a provider-neutral analysis snapshot atomically, then close the active target and every provider resource started for it. Snapshot files require an operator-approved root and explicit overwrite; a failed save leaves the session open so cached analysis is not lost.

Input Output Examples

Name	Type	Req	Description
overwrite	boolean	–	Whether an existing destination may be replaced.
snapshot_path	string	–	Local filesystem path for snapshot.

Name	Type	Req	Description
result	–	yes	–

{"overwrite":false}

comment Comment ~97

Read the regular analysis comment at an address, defaulting to the current cursor. This is read-only and returns null when no comment exists; use set_comment to persist a finding.

Input Output Examples

Name	Type	Req	Description
address	string	–	A provider-normalized address; default memory uses 0x-prefixed hexadecimal
document	string	–	The document name
unknown_registry_approved	boolean	–	Explicit approval to record typed capability unavailability as a residual unknown

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	–	yes	–

{}

commit_reconstruction_coverage Commit Reconstruction Coverage ~104

Atomically commit one canonical evidence-backed reconstruction coverage workspace revision under an approved root. CAS revisions reject lost updates; every Evidence and residual-unknown reference must resolve in the embedded canonical bundle.

Input Output Examples

Name	Type	Req	Description
approved	boolean	yes	Explicit operator approval to perform this operation.
expected_revision	–	yes	Expected revision used to reject stale or mismatched input.
workspace	object	yes	Value for workspace.
workspace_path	string	yes	Approved local path of the persistent investigation workspace.

Name	Type	Req	Description
bytes	integer	yes	–
evidence_records	integer	yes	–
revision	integer	yes	–
revision_sha256	string	yes	–
workspace_id	string	yes	–
workspace_path	string	yes	–

{"approved":true,"expected_revision":null,"workspace":{"artifacts":[],"boundaries":[],"claims":[],"contradictions":[],"evidence_bundle":{"artifacts":[],"bundle_version":2,"captures":[],"environments":[],"providers":[],"records":[],"scenarios":[],"unknowns":[]},"name":"replacement","owners":[],"package_proofs":[],"previous_revision_sha256":null,"residual_unknown_ids":[],"revision":1,"revision_sha256":"0000000000000000000000000000000000000000000000000000000000000000","schema_version":1,"surfaces":[],"verifier_contracts":[],"verifier_results":[],"workspace_id":"rcw_0000000000000000000000000000000000000000000000000000000000000000"},"workspace_path":"/approved/coverage.json"}

compare_application_versions Compare Application Versions ~80

Compare two authenticated JavaScript Application Graph versions supplied as full Evidence or Evidence IDs returned earlier in this session. Uses unique-only exact digest, module source digest, source-map identity, structural fingerprint, and non-module semantic-key tiers. Reports added, removed, changed, ambiguous, and unknown entities plus a bounded changed_from graph without fuzzy or module-ordinal pairing.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"left_evidence_id":"ev_0000000000000000000000000000000000000000000000000000000000000000","right_evidence_id":"ev_1111111111111111111111111111111111111111111111111111111111111111"}

compare_artifacts Compare Artifacts ~147

Compare two bounded sets of inventory_artifact Evidence pages by logical occurrence path, content identity, metadata, and graph relations. Pages must share and satisfy their graph commitment; every delta cites both sets, and gaps yield truncated or unknown, never equivalence.

Input Output Examples

Name	Type	Req	Description
left_evidence_ids	array	yes	Ordered Evidence v2 identifiers for the left observations.
limit	integer	–	Maximum number of results to return in this page.
offset	integer	–	Zero-based index of the first result to return.
right_evidence_ids	array	yes	Ordered Evidence v2 identifiers for the right observations.
unknown_registry_approved	boolean	–	Explicit approval to record incomplete or differing evidence

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"left_evidence_ids":["ev_b74d3ff6cdf54af4e4f3dab00965780cb5ef2b375188c75c1980d0998c5a05a4"],"limit":100,"offset":0,"right_evidence_ids":["ev_74ecec364f3987b332db851177d2117a89d49df4ba89ab5d87299940092d7bb4"]}

compare_bundles Compare Bundles ~135

Compare two canonical Evidence v2 bundles by exact record membership, explicit one-to-one observation pairs, and complete residual-unknown revision histories. Missing bundle members describe omission only, never behavioral equivalence; output is digest-anchored and deterministically paginated.

Input Output Examples

Name	Type	Req	Description
left_bundle_path	string	yes	Local filesystem path for left bundle.
limit	integer	–	Maximum number of results to return in this page.
offset	integer	–	Zero-based index of the first result to return.
record_pairs	array	–	Value for record pairs.
right_bundle_path	string	yes	Local filesystem path for right bundle.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"left_bundle_path":"/approved/left-evidence.json","limit":100,"offset":0,"record_pairs":[],"right_bundle_path":"/approved/right-evidence.json"}

compare_functions Compare Functions ~147

Compare two explicit bounded sets of analyze_function Evidence pages across identity, exact provider text, calls, references, strings, and address-normalized CFG topology. Missing or provider-incompatible facets remain truncated or unknown; every conclusion cites both Evidence sets.

Input Output Examples

Name	Type	Req	Description
left_evidence_ids	array	yes	Ordered Evidence v2 identifiers for the left observations.
limit	integer	–	Maximum number of results to return in this page.
offset	integer	–	Zero-based index of the first result to return.
right_evidence_ids	array	yes	Ordered Evidence v2 identifiers for the right observations.
unknown_registry_approved	boolean	–	Explicit approval to record bounded residual uncertainty in the session registry.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"left_evidence_ids":["ev_ff8eed2e28fd9549add0c20d7573566358ad228b980f538e2e0709155a456e1e"],"limit":100,"offset":0,"right_evidence_ids":["ev_7cee7dd9a31cbb2881b2db1c9042ebb961cef07c9152da5ab533b52a0a3492e0"]}

compare_javascript_export_shapes Compare Javascript Export Shapes ~76

Compare bounded static return shapes for one exact module/export selector on each authenticated JavaScript Application Graph, supplied as full Evidence or session Evidence IDs. Variants pair only by reciprocal unique literal discriminants; dynamic values, incomplete properties, and ambiguous variants remain unknown. Reports JSON Pointer changes and recommends controlled replay separately without executing JavaScript.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"left_evidence_id":"ev_0000000000000000000000000000000000000000000000000000000000000000","left_export_name":"default","left_module_path":"parser.mjs","right_evidence_id":"ev_1111111111111111111111111111111111111111111111111111111111111111","right_export_name":"default","right_module_path":"parser.mjs"}

compare_managed_members Compare Managed Members ~156

Compare two authenticated inspect_managed_members Evidence records using unique-only decoded-CIL-v1/signature and structural method-shape tiers. Names are reported as observations but are not used as a matching basis; metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the v1 tuple digest does not itself remap them.

Input Output Examples

Name	Type	Req	Description
left_evidence_id	string	yes	Session-owned inspect_managed_members Evidence ID
limits	object	–	Bounded resource-consumption and result-size limits for this operation.
right_evidence_id	string	yes	Session-owned inspect_managed_members Evidence ID
unknown_registry_approved	boolean	–	Explicit approval to record bounded residual uncertainty in the session registry.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"left_evidence_id":"ev_45a77d52db5dc9beaf59a9b8ee062c945fda709bd0d3a91fa4e972d85a848324","limits":{"max_candidates":25,"max_field_matches":50,"max_method_matches":100},"right_evidence_id":"ev_8d6450759b2bb695b3b41b0db8d7ddc4a3e9f64a52b93194bc59d2b564c2285c"}

compare_process_captures Compare Process Captures ~167

Compare two compatible Process Capture v4 observations across terminal, interaction, lifecycle, process, filesystem, command-shim, HTTP, and WebSocket evidence. Optional trace_spec validates exact events against an explicit partial order or finite trace language; concurrency is never inferred from timestamps or broad sorting. Missing, journal-free, or truncated observations are never treated as equivalent.

Input Output Examples

Name	Type	Req	Description
left_evidence_id	string	yes	Exact Evidence v2 identifier for the left observation.
max_capture_age_ms	integer	–	Maximum permitted capture age ms for this operation.
right_evidence_id	string	yes	Exact Evidence v2 identifier for the right observation.
trace_spec	object	–	Value for trace spec.
unknown_registry_approved	boolean	–	Explicit approval to record capture disagreement durably

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"left_evidence_id":"ev_0000000000000000000000000000000000000000000000000000000000000000","right_evidence_id":"ev_1111111111111111111111111111111111111111111111111111111111111111"}

compare_source_to_bundle Compare Source To Bundle ~87

Compare a cryptographically committed HistoricalSourceGraph/v1 with authenticated JavaScript Application Graph Evidence supplied directly or by session Evidence ID. Uses explicit exact-digest, source-map path, current-path, suffix, and basename signals with stable weights. Classifies unchanged, modified, removed, split, merged, duplicated, and unknown; incomplete coverage and ambiguous weak signals never become absence or forced matches.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"application_evidence_id":"ev_0000000000000000000000000000000000000000000000000000000000000000","reference":{"authority":"historical-reference","entries":[{"classifications":["source"],"kind":"directory","limitations":[],"path":"src","tree_state":"enumerated"},{"classifications":["source"],"content_state":"hashed","kind":"file","language":"TypeScript","limitations":[],"path":"src/main.ts","sha256":"2222222222222222222222222222222222222222222222222222222222222222","size":128}],"exclusions":[],"inventory_state":"complete","languages":["TypeScript"],"limitations":[],"manifests":[],"parse_failures":[],"provenance":{"caller":"contract-example","importer":"rea","importer_version":"1"},"relationships":[],"root_alias":"$REFERENCE_ROOT","root_sha256":"683969414c3e674a368392213c78021322fb39609b0c57f346b22da6464b2110","schema":"HistoricalSourceGraph/v1","vcs":{"dirty":null,"head":null,"kind":"none"}}}

compare_web_captures Compare Web Captures ~53

Compare either passive web captures or step-indexed browser scenarios. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and exposes bounded artifact-level changes plus alignment failures. Missing or truncated evidence never proves equality.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	–	yes	–

{"after_scenario":{"browser":{"cleanup":"disconnected-external","mode":"connect","process_ownership":"external","product":"Chromium","version":"149"},"completeness":{"equality_eligible":true,"missing_sections":[],"status":"complete","truncated_sections":[]},"duration_ms":10,"events":{"dropped":0,"items":[],"retained":0},"limitations":[],"scenario":{"action_count":1,"allowed_origins":["https://app.example.test"],"secret_references":[],"start_origin":"https://app.example.test"},"schema_version":1,"steps":[{"action":"scenario_start","after_url":{"origin":"https://app.example.test","query_parameter_names":[],"redacted":false,"url":"https://app.example.test/"},"artifacts":{"accessibility":{"state":"not_requested"},"dom":{"state":"not_requested"},"history":{"state":"not_requested"},"screenshot":{"state":"not_requested"},"storage":{"state":"not_requested"},"url":{"state":"not_requested"}},"before_url":{"origin":"https://app.example.test","query_parameter_names":[],"redacted":false,"url":"https://app.example.test/"},"completeness":{"equality_eligible":true,"missing_sections":[],"status":"complete","truncated_sections":[]},"elapsed_ms":0,"error":null,"event_sequence_end":0,"event_sequence_start":1,"status":"completed","step_id":"scenario_start","step_index":0},{"action":"click","after_url":{"origin":"https://app.example.test","query_parameter_names":[],"redacted":false,"url":"https://app.example.test/"},"artifacts":{"accessibility":{"state":"not_requested"},"dom":{"state":"not_requested"},"history":{"state":"not_requested"},"screenshot":{"state":"not_requested"},"storage":{"state":"not_requested"},"url":{"state":"not_requested"}},"before_url":{"origin":"https://app.example.test","query_parameter_names":[],"redacted":false,"url":"https://app.example.test/"},"completeness":{"equality_eligible":true,"missing_sections":[],"status":"complete","truncated_sections":[]},"elapsed_ms":10,"error":null,"event_sequence_end":0,"event_sequence_start":1,"status":"completed","step_id":"open-settings","step_index":1}]},"before_scenario":{"

compare_web_screenshots Compare Web Screenshots ~95

Compare two self-verifying PNG screenshot artifacts with bounded local pixel metrics. Returns exact changed-pixel ratios and channel deltas without OCR or external services.

Input Output Examples

Name	Type	Req	Description
after	object	yes	The later or right-hand observation to compare.
before	object	yes	The earlier or left-hand observation to compare.
channel_threshold	integer	–	Value for channel threshold.
maximum_pixels	integer	–	Value for maximum pixels.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"after":{"bytes":70,"data_base64":"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PzWvWQAAAABJRU5ErkJggg==","media_type":"image/png","sha256":"153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c","uri":"rea://web-screenshot/sha256/153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c"},"before":{"bytes":70,"data_base64":"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PzWvWQAAAABJRU5ErkJggg==","media_type":"image/png","sha256":"153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c","uri":"rea://web-screenshot/sha256/153cf6c9a526a63053a37b10234c2fd85df38887c2dc0a800d90abfa6631d01c"},"channel_threshold":0,"maximum_pixels":16000000}

correlate_static_and_runtime Correlate Static And Runtime ~143

Evaluate explicit caller-declared hypotheses between exact static comparison findings and runtime comparison dimensions. Similar names or paths are never auto-matched, consistent cochange never proves causality, and unknown or truncated inputs remain unresolved.

Input Output Examples

Name	Type	Req	Description
limit	integer	–	Maximum number of results to return in this page.
mappings	array	yes	Value for mappings.
offset	integer	–	Zero-based index of the first result to return.
runtime_comparisons	array	yes	Value for runtime comparisons.
static_comparisons	array	yes	Value for static comparisons.
unknown_registry_approved	boolean	–	Explicit approval to record bounded residual uncertainty in the session registry.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"limit":100,"mappings":[{"hypothesis":{"expected_pattern":"static_only","statement":"Static implementation changed without terminal change."},"runtime":{"comparison_evidence_id":"ev_2ffc472e561cea4b5e65ddaf7b80bc112b7ed6d0d023f0cf7398bc2068a12e2d","dimension":"terminal"},"side_alignment":"left_to_left","static":{"comparison_evidence_id":"ev_68c195e7d5d8688f3eb0764a9a868355fcc6f8810fc9ada1a0c8579c21ea2bf8","selector":{"dimension":"pseudocode","kind":"function"}}}],"offset":0,"runtime_comparisons":[{"authority":"analyst-inference","confidence":"derived","environment":null,"evidence_id":"ev_2ffc472e561cea4b5e65ddaf7b80bc112b7ed6d0d023f0cf7398bc2068a12e2d","evidence_links":["ev_0014950a3b67b96d5d182a51c5a271959828fe6a91db55fc507dd5a9c2a5ecaf","ev_5d45bc669ea10694f3bdf3b325e2048844da96a621b717ad252d667af53df590"],"limitations":["Artifact identity is unavailable for this observation."],"locations":[],"normalized_result":{"exit":"unchanged","filesystem":"unchanged","first_divergence":{"status":"none"},"interaction":"unchanged","limitations":[],"process":"unchanged","protocol":"unchanged","shim":"unchanged","status":"unchanged","terminal":"unchanged"},"operation":"compare_process_captures","parameters":{"left_evidence_id":"ev_0014950a3b67b96d5d182a51c5a271959828fe6a91db55fc507dd5a9c2a5ecaf","left_normalization":{"paths":true,"patterns":[],"pids":true,"ports":true,"time_bucket_ms":10},"right_evidence_id":"ev_5d45bc669ea10694f3bdf3b325e2048844da96a621b717ad252d667af53df590","right_normalization":{"paths":true,"patterns":[],"pids":true,"ports":true,"time_bucket_ms":10}},"predicate_type":"rea.process-comparison/v3","provider":{"id":"rea-process","name":"REA deterministic process harness","version":"3"},"raw_result":null,"schema_version":2,"subject":null}],"static_comparisons":[{"authority":"analyst-inference","confidence":"derived","environment":null,"evidence_id":"ev_68c195e7d5d8688f3eb0764a9a868355fcc6f8810fc9ada1a0c8579c21ea2bf8","evidence_links":["ev_ff8eed2e28fd9549add0c20d7573566358ad228b980f538e2e0709155a456e1e","ev_

current_address Current Address ~66

Return Hopper's current cursor address for the selected document. Use only for interactive navigation state; prefer explicit addresses in reproducible investigations.

Input Output Examples

Name	Type	Req	Description
document	string	–	The document name
unknown_registry_approved	boolean	–	Explicit approval to record typed capability unavailability as a residual unknown

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	string	yes	–

{}

current_document Current Document ~53

Return the document currently selected by REA's Hopper bridge. Use list_documents before switching when several documents are open.

Input Output Examples

Name	Type	Req	Description
unknown_registry_approved	boolean	–	Explicit approval to record typed capability unavailability as a residual unknown

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	string	yes	–

{}

current_procedure Current Procedure ~72

Return the analyzed procedure containing Hopper's current cursor. Use procedure_info or analyze_function next; this depends on GUI cursor state and is not an exhaustive lookup.

Input Output Examples

Name	Type	Req	Description
document	string	–	The document name
unknown_registry_approved	boolean	–	Explicit approval to record typed capability unavailability as a residual unknown

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	string	yes	–

{}

demangle_swift Demangle Swift ~49

Demangle an ordered bounded batch of Swift symbols without requiring Hopper. Each input returns demangled, unchanged, or invalid status.

Input Output Examples

Name	Type	Req	Description
symbols	array	yes	Ordered bounded Swift symbols to demangle.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"symbols":["$s4Test3fooyyF"]}

discover_webmcp_tools Discover Webmcp Tools ~183

Passively inventory page-registered WebMCP tools using the experimental CDP WebMCP domain. Metadata is bounded and page-declared-untrusted; REA never registers or invokes discovered tools.

Input Output Examples

Name	Type	Req	Description
allowed_origins	array	yes	Value for allowed origins.
approved	boolean	yes	Explicit operator approval to perform this operation.
cdp_endpoint	string	yes	Approved literal loopback Chrome DevTools Protocol endpoint.
max_schema_bytes	integer	–	Maximum permitted schema bytes for this operation.
max_schema_depth	integer	–	Maximum permitted schema depth for this operation.
max_schema_nodes	integer	–	Maximum permitted schema nodes for this operation.
max_tools	integer	–	Maximum permitted tools for this operation.
observation_ms	integer	–	Value for observation ms.
target_id	string	yes	Exact authorized CDP target identifier.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"allowed_origins":["https://app.example.test"],"approved":true,"cdp_endpoint":"http://127.0.0.1:9222","max_schema_bytes":262144,"max_schema_depth":20,"max_schema_nodes":5000,"max_tools":500,"observation_ms":100,"target_id":"TARGET_ID_FROM_LIST_BROWSER_TARGETS"}

evaluate_reconstruction_readiness Evaluate Reconstruction Readiness ~271

Evaluate the fixed nine-stage public reconstruction journey into a deterministic ReconstructionReadinessReport/v1. Exact capability limits, provider routing, CLI/MCP status parity, bounded authority, partial-order comparison, contradictions, obligation closure, cleanup, and replay digests fail closed. Aggregate pass is emitted only when every required stage and check passes with attributable Evidence.

Input Output Examples

Name	Type	Req	Description
capabilities	array	yes	Value for capabilities.
cleanup	array	yes	Value for cleanup.
client	object	yes	Value for client.
closure_history	array	yes	Value for closure history.
comparisons	array	yes	Validated comparison Evidence records to aggregate.
contradictions	array	yes	Value for contradictions.
delegation_checks	array	yes	Value for delegation checks.
evidence_bundle	object	yes	Value for evidence bundle.
fixtures	array	yes	Value for fixtures.
grants	array	yes	Value for grants.
identity	object	yes	Value for identity.
obligation_ledger	object	yes	Value for obligation ledger.
operation_outcomes	array	yes	Value for operation outcomes.
replay	object	yes	Value for replay.
schema_version	number	yes	Version of this structured result schema.
stages	array	yes	Value for stages.
workflow_candidates	array	yes	Value for workflow candidates.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"capabilities":[{"authority_scopes":["investigation-input"],"available":true,"bounded":true,"capability_id":"analyze-javascript-application","limits":[{"name":"max-ast-nodes","unit":"count","value":2000000}],"side_effect":"reads-target","unavailable_reason":null}],"cleanup":[{"cancelled":true,"diagnostic_evidence_ids":["ev_348db7991de053d7b032e8224d07368d0fdb33ee5794588276ba06bfe3a147c9"],"owned_resources_remaining":0,"run_id":"run.cancelled"}],"client":{"name":"synthetic-mcp-client","negotiated_capabilities":["elicitation","progress","resources"],"version":"1"},"closure_history":[{"evidence_ids":["ev_348db7991de053d7b032e8224d07368d0fdb33ee5794588276ba06bfe3a147c9"],"ledger_digest":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","newly_verified_obligation_ids":[],"required_open":1,"sequence":0,"status":"open"},{"evidence_ids":["ev_348db7991de053d7b032e8224d07368d0fdb33ee5794588276ba06bfe3a147c9"],"ledger_digest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","newly_verified_obligation_ids":["obl.readiness"],"required_open":0,"sequence":1,"status":"ready"}],"comparisons":[{"comparison_id":"comparison.concurrent","concurrent":true,"contradiction_ids":[],"deliberate_divergence_ref":null,"divergence_refs":[],"evidence_ids":["ev_348db7991de053d7b032e8224d07368d0fdb33ee5794588276ba06bfe3a147c9"],"schedule_semantics":"partial-order","truncated":false,"unavailable_authority":false,"unstable":false,"verdict":"equivalent"},{"comparison_id":"comparison.divergence","concurrent":true,"contradiction_ids":[],"deliberate_divergence_ref":"/events/primary","divergence_refs":["/events/primary"],"evidence_ids":["ev_348db7991de053d7b032e8224d07368d0fdb33ee5794588276ba06bfe3a147c9"],"schedule_semantics":"finite-traces","truncated":false,"unavailable_authority":false,"unstable":false,"verdict":"different"},{"comparison_id":"comparison.contradicted","concurrent":false,"contradiction_ids":["contradiction.artifact"],"deliberate_divergence_ref":null,"divergence_refs":[],"evidence_ids":["ev_348db7991

execute_node_characterization Execute Node Characterization ~92

Recompute and execute one separately approved exact Node characterization plan in the owned controlled-replay boundary. Returns transformation, replay, cleanup, and provider-neutral characterization Evidence v2; stale plans fail before execution.

Input Output Examples

Name	Type	Req	Description
approved_plan_sha256	string	yes	Exact SHA-256 digest of approved plan.
execution_approved	boolean	yes	Explicit operator approval for execution.
preparation	object	yes	Value for preparation.

Name	Type	Req	Description
evidence	–	yes	–
phase	string	yes	–
plan	object	yes	–
replay	object	yes	–
schema_version	number	yes	–
transformation	object	yes	–
transformation_evidence	–	yes	–

{"approved_plan_sha256":"0000000000000000000000000000000000000000000000000000000000000000","execution_approved":true,"preparation":{"expected_effect":"pure","instrumentation":{"artifact_path":"/approved/bundle.js","artifact_sha256":"0000000000000000000000000000000000000000000000000000000000000000","selection":{"byte_end":120,"byte_start":100,"export_name":"selected","selected_sha256":"0000000000000000000000000000000000000000000000000000000000000000"}},"preparation_approved":true,"replay":{"cases":[{"arguments":[""],"case_id":"empty"}],"left":{"entry_alias":"bundle","entry_export":"selected","modules":[{"alias":"bundle","dependencies":{},"format":"commonjs-factory","path":"/approved/bundle.js","role":"module"}]},"mode":"plan"},"selected_alias":"bundle"}}

export_evidence_bundle Export Evidence Bundle ~91

Atomically write the session's deterministic Evidence v2 bundle beneath an operator-approved root. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering. For an in-session read, use snapshot_evidence_bundle and read its exact resource URI instead.

Input Output Examples

Name	Type	Req	Description
overwrite	boolean	–	Whether an existing destination may be replaced.
path	string	yes	Local filesystem path used by this operation.

Name	Type	Req	Description
result	object	yes	–

{"overwrite":false,"path":"/tmp/evidence.json"}

extract_artifact Extract Artifact ~206

Extract selected graph artifacts beneath an explicit output root. Requires approval, rejects traversal and symlink escapes, never overwrites, enforces bomb limits, and verifies cleanup.

Input Output Examples

Name	Type	Req	Description
approved	boolean	yes	Explicit operator approval to perform this operation.
limit	integer	–	Maximum number of results to return in this page.
max_compression_ratio	number	–	Maximum permitted compression ratio for this operation.
max_depth	integer	–	Maximum permitted depth for this operation.
max_entries	integer	–	Maximum permitted entries for this operation.
max_entry_bytes	integer	–	Maximum permitted entry bytes for this operation.
max_path_bytes	integer	–	Maximum permitted path bytes for this operation.
max_total_bytes	integer	–	Maximum permitted total bytes for this operation.
occurrence_ids	array	yes	Value for occurrence ids.
offset	integer	–	Zero-based index of the first result to return.
output_root	string	yes	Approved canonical filesystem output root.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"approved":true,"occurrence_ids":["occ_0000000000000000000000000000000000000000000000000000000000000000"],"output_root":"/tmp/rea-extracted"}

find_changed_behavior Find Changed Behavior ~129

Aggregate validated comparison Evidence, or automatically run and resume a persistent cross-version artifact investigation beneath an approved evidence root. Runtime observations remain distinct from static behavior candidates; missing or incomplete comparisons produce unresolved findings, never causal claims.

Input Output Examples

Name	Type	Req	Description
comparisons	array	–	Validated comparison Evidence records to aggregate.
investigation_run	–	–	Value for investigation run.
limit	integer	–	Maximum number of results to return in this page.
offset	integer	–	Zero-based index of the first result to return.
unknown_registry_approved	boolean	–	Explicit approval to record bounded residual uncertainty in the session registry.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"comparisons":[{"authority":"analyst-inference","confidence":"derived","environment":null,"evidence_id":"ev_68c195e7d5d8688f3eb0764a9a868355fcc6f8810fc9ada1a0c8579c21ea2bf8","evidence_links":["ev_ff8eed2e28fd9549add0c20d7573566358ad228b980f538e2e0709155a456e1e","ev_7cee7dd9a31cbb2881b2db1c9042ebb961cef07c9152da5ab533b52a0a3492e0"],"limitations":["Artifact identity is unavailable for this observation."],"locations":[],"normalized_result":{"changes":{"items":[{"conclusion_kind":"derived_relationship","dimension":"pseudocode","evidence_links":["ev_ff8eed2e28fd9549add0c20d7573566358ad228b980f538e2e0709155a456e1e","ev_7cee7dd9a31cbb2881b2db1c9042ebb961cef07c9152da5ab533b52a0a3492e0"],"left_count":9,"left_digest":"64abdfe133a114158fa0e185d0edec784e6ccf13a166a0fed8bc18bb0cc72554","limitations":[],"right_count":9,"right_digest":"c8e26d77640903b2d4c765ebcb7f7170b64dd320dd3911abbe8346e07cd593d1","status":"changed","text_delta":{"added_lines":1,"hunks":2,"removed_lines":1}},{"conclusion_kind":"unresolved_branch","dimension":"assembly","evidence_links":["ev_ff8eed2e28fd9549add0c20d7573566358ad228b980f538e2e0709155a456e1e","ev_7cee7dd9a31cbb2881b2db1c9042ebb961cef07c9152da5ab533b52a0a3492e0"],"left_count":0,"left_digest":null,"limitations":["Assembly is opaque provider text; relocation normalization is unavailable."],"right_count":0,"right_digest":null,"status":"unknown","text_delta":null}],"limit":100,"next_offset":null,"offset":0,"total":2},"dimensions":[{"conclusion_kind":"derived_relationship","dimension":"identity","evidence_links":["ev_ff8eed2e28fd9549add0c20d7573566358ad228b980f538e2e0709155a456e1e","ev_7cee7dd9a31cbb2881b2db1c9042ebb961cef07c9152da5ab533b52a0a3492e0"],"left_count":null,"left_digest":"dd190a914de1bdf8f4bba97a2e74b439585874c567f28eb0ff41bc5388c66d65","limitations":[],"right_count":null,"right_digest":"dd190a914de1bdf8f4bba97a2e74b439585874c567f28eb0ff41bc5388c66d65","status":"unchanged","text_delta":null},{"conclusion_kind":"derived_relationship","dimension":"pseudocode","evidence_links":["ev_ff8eed2e2

find_code_for_string Find Code For String ~138

Resolve one literal string query to bounded analyzed string entries, xrefs, and truthful containing-procedure candidates. Returns an Evidence ID, exact operation budget, truncation, and residual unknowns; it never infers reference kinds or runtime reachability.

Input Output Examples

Name	Type	Req	Description
case_sensitive	boolean	–	Whether text matching distinguishes uppercase and lowercase.
limit	integer	–	Maximum number of results to return in this page.
max_operations	integer	–	Maximum permitted operations for this operation.
query	string	yes	Non-empty feature or text query to investigate.
unknown_registry_approved	boolean	–	Explicit approval to record bounded residuals durably

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	object	yes	–

{"case_sensitive":false,"limit":20,"max_operations":20,"query":"authorization failed"}

find_xrefs_to_name Find Xrefs To Name ~68

Resolve an exact name through the bound provider's exhaustively paged name inventory and return a resolved or unresolved result. Unresolved names use the stable name_not_found reason; this compact xref workflow returns address-only projections.

Input Output Examples

Name	Type	Req	Description
name	string	yes	Exact name used by this operation.

Name	Type	Req	Description
evidence_id	string	yes	–
evidence_uri	string	yes	–
result	–	yes	–

{"name":"malloc"}

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

9 Aug 12 Aug