REA

Traverse the bound provider's caller or callee relationships from one symbol or address for at most five levels. Every node has an ok/error status and failures use safe typed projections; unresolved indirect calls may be missing and results are not a whole-program CFG.

{"address":"0x1000","depth":2,"direction":"forward"}

Compose the selected document, current address, and containing/current procedure into one provider-neutral result. The result reflects sequential provider observations, not an atomic cursor snapshot; a cursor outside any procedure returns procedure: null. Scalar navigation getters remain available for evaluation and compatibility.

{}

Discover and deduplicate Objective-C class labels after exhaustively paging names, optionally filtering by literal substring. Returns at most 100 classes; inspect matching metadata and references next.

{"pattern":""}

Discover and deduplicate Objective-C and Swift protocol labels after exhaustively paging names. Returns at most 100 entries; use xrefs or analyze_function to connect a protocol to implementations.

{}

Move Hopper's GUI cursor to a hexadecimal address and return the resolved address. This changes navigation state but not analysis data; use explicit-address tools for headless workflows.

{"address":"0x1000"}

Read a bounded local JSON bundle beneath an operator-approved root, validate every Evidence v2 ID and canonical manifest, then atomically merge it. Imported content is data only and is never executed.

{"path":"evidence.json"}

Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited member-result-v1 decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.

{"decompiler":{"executable_sha256":null,"family":"ilspy","name":"ilspycmd","options":["--disable-updatecheck","--type","Example.Program"],"version":"9.1.0.7988"},"methods":[{"normalized_il_sha256":"5555555555555555555555555555555555555555555555555555555555555555","reconstruction":{"end_line":1,"kind":"decompiled-csharp","language":"csharp","source_path":"/examples/Example.Program.cs","start_line":1,"text":"internal static void Main() { }"},"signature_sha256":"3333333333333333333333333333333333333333333333333333333333333333","token":"0x06000001"}],"notes":["Synthetic example only; decompiler output is imported as inference."],"static_members_evidence_id":"ev_4871226711dcb86d73cebb54bc54c6e1d6cf227c94c7cf67685dc5d805511493"}

Read the inline instruction comment at an address, defaulting to the current cursor. Returns null when absent; use set_inline_comment to write one.

{}

Inspect one explicit reproducible address for its analyzed name, containing procedure, regular and inline comments, and matching bookmarks. Each unsupported facet returns a typed unavailable outcome; xrefs, assembly, and pseudocode remain separate bounded follow-ups.

{"address":"0x1000"}

After open_binary binds a local archive, application package, or other artifact—or when one is already active—inspect it through one bounded, cancellable inventory substep. This tool accepts no path; in a target-free session open the target first. Returns the full substep Evidence and its ID, observations, derived relationships, hypotheses, contradictions, unexplored branches, limitations, and format-specific next probes. Any substep failure fails the whole call.

{}

Passively inspect one approved Electron file page through CDP. Returns root-confined frames, DOM structure, resource paths, and scripts without evaluating renderer JavaScript or invoking Electron APIs; script contents require separate approval.

{"allowed_file_roots":["/Applications/Example.app/Contents/Resources"],"approved":true,"cdp_endpoint":"http://127.0.0.1:9223","include_script_sources":false,"limits":{"max_dom_nodes":2000,"max_frames":200,"max_resources":2000,"max_script_source_bytes":1048576,"max_scripts":500,"max_total_script_source_bytes":4194304,"max_workers":500},"observation_ms":100,"source_capture_approved":false,"target_id":"TARGET_ID_FROM_LIST_ELECTRON_TARGETS"}

Inspect Mach-O slices, load commands, imports, exports, dependencies, build metadata, segments, sections, permissions, and exact command provenance without launching Hopper.

{}

Open and classify an explicit managed PE/CLI path, or inspect the active managed target, then inventory exact assembly/module identity, target framework evidence, references, resources, and custom attributes without loading or executing target code. Returns bounded pages and explicit partial or malformed coverage.

{"path":"/tmp/Example.dll"}

Inspect bounded PE/CLI metadata members, signatures, raw CIL hashes, limited member-result-v1 decoded-instruction-tuple hashes, separately reported exception regions, call edges, and field-access anchors without loading or executing target code. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID; the v1 tuple hash does not resolve them or fully commit control flow.

{"edge_limit":100,"method_limit":25}

Inspect PE/CLI ModuleRef, ImplMap/PInvoke declarations, CLI native-header indicators, and non-IL method implementation flags without loading or executing target code. Results are managed declarations and degraded native-boundary observations, not verified native exports or addresses.

{"implementation_limit":50,"import_limit":50}

Reconstruct one native function boundary through inspectable substeps. Returns structured inferred return/parameter types with confidence and evidence, jump-table dispatch/data/target mappings, explicit decompiler-artifact labels, unsupported branches, and residual unknowns.

{"max_instructions":500,"max_pseudocode_chars":20000,"procedure":"main"}

Parse a plist at a bounded relative path beneath the active artifact container. Symlink and traversal escapes are rejected; output is normalized JSON rather than plutil text.

{"relative_path":"Contents/Info.plist"}

Inspect the active artifact's code-signing identity, hashes, authorities, requirements, entitlements, hardened-runtime state, and bounded command provenance.

{}

Passively inspect one approved page target through CDP without evaluating JavaScript, navigating, clicking, closing, or mutating the page. Returns bounded DOM structure, accessibility, scripts, resources, attach-window network and console metadata, workers, and redacted storage inventory as Evidence v2.

{"allowed_origins":["https://app.example.test"],"approved":true,"cdp_endpoint":"http://127.0.0.1:9222","console_text_approved":false,"include_accessibility_text":false,"include_console_text":false,"include_json_body_shapes":false,"include_script_sources":false,"include_storage_fingerprints":false,"include_storage_keys":false,"include_websocket_shapes":false,"json_body_schema_approved":false,"limits":{"max_ax_nodes":2000,"max_ax_text_field_bytes":1024,"max_console_events":200,"max_console_text_field_bytes":1024,"max_dom_nodes":2000,"max_frames":200,"max_json_body_bytes":1048576,"max_json_shape_depth":20,"max_json_shape_nodes":5000,"max_network_events":1000,"max_resources":2000,"max_script_source_bytes":1048576,"max_scripts":200,"max_storage_keys":1000,"max_total_ax_text_bytes":65536,"max_total_console_text_bytes":65536,"max_total_json_body_bytes":4194304,"max_total_script_source_bytes":4194304,"max_total_websocket_shape_bytes":1048576,"max_websocket_events":500,"max_websocket_shape_bytes":65536,"max_workers":500},"observation_ms":500,"target_id":"TARGET_ID_FROM_LIST_BROWSER_TARGETS","websocket_shape_approved":false}

After open_binary binds a local archive, application package, or other artifact—or when one is already active—inventory it as a deterministic, content-addressed artifact graph. This tool accepts no path; in a target-free session open the target first. Returns bounded node and edge pages without extracting or mounting by default.

{}

List thin or universal Mach-O slices with offsets, sizes, alignment, explicit coverage, and bounded native-tool provenance.

{}

List every bookmark in the selected Hopper document as address and name pairs. Use bookmarks as analyst-authored navigation aids; this does not discover code references.

{}

List bounded page targets from an approved user-owned loopback Chrome DevTools Protocol endpoint. Only targets whose current URL matches an approved exact origin are returned; URL credentials, query values, and fragments are redacted.

{"allowed_origins":["https://app.example.test"],"approved":true,"cdp_endpoint":"http://127.0.0.1:9222","limit":100,"offset":0}

List provider program or document identities. Hopper may expose several documents; a Ghidra headless session contains exactly its one imported Program.

{}

List Electron file:// page targets from an approved user-owned loopback CDP endpoint. Every path is canonicalized and must remain contained by an approved filesystem root, including after symlink resolution.

{"allowed_file_roots":["/Applications/Example.app/Contents/Resources"],"approved":true,"cdp_endpoint":"http://127.0.0.1:9223","limit":100,"offset":0}

List attachable Node/Electron V8 Inspector targets from one approved literal-loopback endpoint. Only targets inside exact canonical file roots or exact HTTP(S) origins are retained; excluded target locations never enter Evidence.

{"allowed_file_roots":["/opt/example-app"],"allowed_origins":[],"approved":true,"inspector_endpoint":"http://127.0.0.1:9229","limit":100,"offset":0}

Page through analyzed memory and external symbols as address/value pairs. Provider metadata distinguishes Ghidra primary, dynamic, external, type, and source facts when available; follow next_offset before claiming exhaustive coverage.

{"limit":100,"offset":0}

Page through analyzed procedures as address/value pairs after provider analysis. Ghidra metadata distinguishes thunks and external functions; follow next_offset for exhaustive coverage and use returned addresses in later function operations.

{"limit":100,"offset":0}

List segments or memory blocks using exclusive end addresses. Ghidra reports block permissions, address space, image base, initialization, and overlay facts; Hopper marks unavailable permissions explicitly.

{}

Page through provider-defined strings, or filter to one address, as address/value pairs. Ghidra reports charset, missing-terminator status, byte length, and explicit value truncation; follow next_offset for exhaustive results.

{"limit":100,"offset":0}

List current residual-unknown heads in deterministic ID order, with optional exact status, severity, and domain filters. Pages default to 100 items; while has_more is true, pass next_offset as offset and continue until false. This is read-only; unresolved, contradicted, and non-truth dispositions remain distinct.

{"limit":100,"offset":0}

Return the next analyzed object address after an explicit address or current cursor. This is a navigation primitive, not instruction-flow or CFG analysis.

{}

Attach passively to one exact approved Node/Electron V8 Inspector target and capture bounded Debugger.scriptParsed plus Runtime execution-context events. REA sends only Runtime.enable and Debugger.enable: it never evaluates, pauses, resumes, reads source, or instruments the target. require/import edges, EventEmitter activity, and Electron IPC remain explicit unknowns; reconcile the returned Evidence with static Application Graph Evidence using reconcile_javascript_runtime.

{"allowed_file_roots":["/opt/example-app"],"allowed_origins":[],"approved":true,"inspector_endpoint":"http://127.0.0.1:9229","limits":{"max_events":10000,"max_execution_contexts":1000,"max_location_bytes":16384,"max_scripts":2000,"max_total_metadata_bytes":4194304},"observation_ms":100,"runtime_kind":"node","target_id":"TARGET_ID_FROM_LIST_JAVASCRIPT_RUNTIME_TARGETS"}

Arm a bounded CDP observation window while the user operates the page. Allows approved same-origin reload and SPA navigation, records ordered navigation, redirect, lifecycle, and failure metadata, and stops before retaining an out-of-policy destination.

{"allowed_origins":["https://app.example.test"],"approved":true,"cdp_endpoint":"http://127.0.0.1:9222","max_timeline_events":2000,"observation_ms":10000,"target_id":"TARGET_ID_FROM_LIST_BROWSER_TARGETS"}

Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. An optional snapshot v2 is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly.

{"path":"/tmp/fixture"}

Prepare a separately authorized managed runtime-correlation admission plan from authenticated inspect_managed_members Evidence. The operation is default-disabled, requires the managed_runtime permission ceiling and grant, locks the exact artifact SHA-256, MVID, method signature, and limited member-result-v1 decoded-IL tuple hash, distinguishes attach/load/debugger/reflection/instrumentation effects, and records that no target code was executed.

{"bounds":{"allow_network":false,"allow_ui":false,"max_output_bytes":65536,"max_threads":32,"timeout_ms":5000},"host":{"architecture":"x86_64","clr_family":"dotnet","os":"linux"},"method":{"normalized_il_sha256":"5555555555555555555555555555555555555555555555555555555555555555","signature_sha256":"3333333333333333333333333333333333333333333333333333333333333333","token":"0x06000001"},"requested_effect":"attach","static_members_evidence_id":"ev_4871226711dcb86d73cebb54bc54c6e1d6cf227c94c7cf67685dc5d805511493"}

Prepare a hash-bound Node/JavaScript characterization plan and deterministic reversible export transformation without executing target code. The exact source, selected byte range, runtime closure, sandbox profile, cases, and limits are committed for separate execution approval.

{"expected_effect":"pure","instrumentation":{"artifact_path":"/approved/bundle.js","artifact_sha256":"0000000000000000000000000000000000000000000000000000000000000000","selection":{"byte_end":120,"byte_start":100,"export_name":"selected","selected_sha256":"0000000000000000000000000000000000000000000000000000000000000000"}},"preparation_approved":true,"replay":{"cases":[{"arguments":[""],"case_id":"empty"}],"left":{"entry_alias":"bundle","entry_export":"selected","modules":[{"alias":"bundle","dependencies":{},"format":"commonjs-factory","path":"/approved/bundle.js","role":"module"}]},"mode":"plan"},"selected_alias":"bundle"}

Return the previous analyzed instruction start before an explicit address or current cursor. This is a navigation primitive and may fail at document boundaries.

{}

Resolve an unambiguous procedure symbol name or provider-normalized address to its canonical entry address. External address spaces remain explicit; use the result before xrefs, assembly, or decompilation.

{"procedure":"main"}

Return assembly for one analyzed procedure identified by symbol or hexadecimal address. Use when pseudocode loses calling-convention or instruction-level detail; output is currently returned as one unpaginated string.

{"procedure":"main"}

Return the provider's resolved direct callees for one procedure identified by symbol or address. Unresolved indirect calls may be absent; use analyze_function and typed references to preserve available edge uncertainty.

{"procedure":"main"}

Return the provider's resolved direct callers for one procedure identified by symbol or address. Results reflect completed static analysis and may omit unresolved indirect references.

{"procedure":"main"}

Return bounded metadata for one procedure identified by symbol or address: entrypoint, signature, locals, size, and block count. Follow with decompilation or assembly for behavior.

{"procedure":"main"}

Decompile one analyzed procedure by symbol name or provider-normalized address. Returns provider-specific pseudocode, never original source or cross-provider text equivalence, and may return null; request procedure_assembly when instruction precision matters.

{"procedure":"main"}

Return a bounded set of raw incoming or outgoing reference edges for one procedure. Endpoint procedures are resolved only from provider containment; Ghidra preserves observed reference kinds while providers without kind authority mark them unavailable.

{"direction":"outgoing","limit":100,"max_instructions":500,"offset":0,"procedure":"main"}

Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.

{"limits":{"max_fields":100,"max_methods":100,"max_native_implementations":100,"max_pinvoke_imports":100,"max_types":100},"managed_members_evidence_id":"ev_4871226711dcb86d73cebb54bc54c6e1d6cf227c94c7cf67685dc5d805511493"}

Evaluate one named reconstruction boundary from a canonical coverage workspace. Missing ownership or inventory is partial; stale, weak, truncated, skipped, or unresolved proof is unknown; contradictions, failed proof, missing owners, and authority routing fail closed.

{"boundary_id":"replacement.cli","workspace_path":"/approved/coverage.json"}