REA

Read at most 4,096 analyzed bytes from one provider-normalized virtual address. The hexadecimal payload reports the exact returned length; incomplete reads remain explicit and unsupported provider APIs return typed capability unavailability.

{"address":"0x1000","length":16}

Read one offset-paginated window of raw instructions for an analyzed procedure without decompilation, caller discovery, or whole-program string/name scans. Use this fast path for instruction-level orientation; follow next_offset when truncated.

{"limit":64,"offset":0,"procedure":"main"}

Reconcile verified static JavaScript application graphs with existing passive web/Electron CDP, passive V8 Inspector, or provider-owned active Electron Evidence. Active Electron captures contribute an explicitly partial target-only runtime record; they never invent renderer scripts, frames, workers, or execution claims. Exact captured-source digests take priority over caller-declared file/URL mappings; target, frame, script, and worker ambiguity remains explicit, and source-map authority stays separate.

{"runtime_observations":[{"authority":"external-service","confidence":"observed","environment":null,"evidence_id":"ev_e9ffe953ecde3cee6f8b1e2e2fc8be64bf58d17b3c680d1230587294f6b02c3a","evidence_links":[],"limitations":["Artifact identity is unavailable for this observation."],"locations":[],"normalized_result":{"browser":{"js_version":"1","product":"Electron/example","protocol_version":"1.3","revision":"example","user_agent":"Electron example"},"capture_window":{"ended_at":"2026-07-15T00:00:00.100Z","observation_ms":100,"started_at":"2026-07-15T00:00:00.000Z"},"completeness":{"attach_limited_sections":[],"conditions":["complete_within_window"],"dropped_events":{"console_events":0,"network_requests":0,"scripts":0,"timeline_events":0,"total":0,"webmcp_tools":0,"websocket_connections":0,"websocket_frames":0},"excluded":[],"policy_filtered_sections":[],"status":"complete_within_window","truncated_sections":[],"unavailable_sections":[]},"dom":{"nodes":[],"total_nodes":0},"frames":[],"limitations":["Example passive capture."],"resources":[],"schema_version":1,"scripts":{"items":[{"cdp_hash":"example","file_path":"/Applications/Example.app/Contents/Resources/app/renderer.js","frame_id":null,"is_module":true,"language":"JavaScript","length":29,"script_key":"electron_script_4444444444444444444444444444444444444444444444444444444444444444","source":{"artifact":{"bytes":29,"charset":"utf-8","media_type":"text/javascript","sha256":"c4c0d760a4c84f0e182de99f6ef89ef10831f8170e486c4d4bd934924151ba64","text":"export const example = true;\n","uri":"rea://web-content/sha256/c4c0d760a4c84f0e182de99f6ef89ef10831f8170e486c4d4bd934924151ba64"},"included":true}}],"total":1},"target":{"attached":false,"file_path":"/Applications/Example.app/Contents/Resources/app/index.html","target_id":"example-target","title":"Example","type":"page"},"workers":[]},"operation":"inspect_electron_page","parameters":{"allowed_file_roots":["/Applications/Example.app/Contents/Resources/app"],"cdp_endpoint":"http://127.0.0.1:9223","include_script_sources":true

Create one deterministic residual unknown and immutable mutation evidence. Requires approved: true, validates all evidence and relationship references, and rejects duplicate stable identity.

{"approved":true,"contradicting_evidence_ids":[],"domain":"protocol","question":"Does this branch require an unavailable external service?","recommended_probes":[{"operation":"capture_process_scenario","rationale":"Replay branch."}],"relationships":[],"required_authority":"controlled-replay","required_confidence":"observed","required_environment":null,"severity":"medium","supporting_evidence_ids":[]}

Release one immutable session-retained Evidence v2 bundle by exact digest. This is the recovery operation when bounded bundle retention is exhausted; releasing an unknown digest is idempotent and reports released: false.

{"bundle_digest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}

Resolve an arbitrary address, including an interior instruction or exact external entry, to its provider-analyzed containing procedure. A negative result distinguishes outside segments from not in a procedure and is never guessed from nearby symbols.

{"address":"0x1000"}

Plan or execute a content-bound extracted-module JavaScript replay inside the Linux Bubblewrap, seccomp, and cgroup boundary. Execution requires approved: true and the exact plan digest. Supports deterministic boundary cases and optional left/right differential comparison; observations have controlled-replay authority and do not claim real application runtime behavior.

{"cases":[{"arguments":[""],"case_id":"empty"}],"determinism":{"clock_iso":"2000-01-01T00:00:00.000Z","locale":"en-US","platform":"linux","random_seed":0,"timezone":"UTC"},"left":{"entry_alias":"parser","entry_export":"default","modules":[{"alias":"parser","dependencies":{},"format":"esm","path":"/approved/parser.mjs","role":"module"}]},"limits":{"cpu_quota_percent":50,"input_bytes":262144,"memory_bytes":134217728,"module_bytes":4194304,"output_bytes":524288,"protocol_bytes":16777216,"result_depth":16,"result_nodes":10000,"stderr_bytes":32768,"tasks":8,"tmpfs_bytes":16777216,"wall_time_ms":3000},"mode":"plan"}

Evaluate ordered HTTP and WebSocket events directly against one validated finite replay machine without opening sockets or launching a target. Returns every decision, a capture-value-free transition journal, one redacted action table entry per used transition, captured aliases, final state, and exact configured and consumed limits.

{"events":[{"at_ms":0,"body":"{\"token\":\"opaque\"}","connection":"not_applicable","headers":{},"method":"POST","path":"/callback","protocol":"http"}],"machine":{"initial_state":"waiting","limits":{"bytes":1000000,"connections":100,"duration_ms":30000,"messages":10000},"max_transitions":1,"states":[{"max_visits":100000,"name":"waiting","terminal":false},{"max_visits":100000,"name":"complete","terminal":true}],"transitions":[{"actions":[{"body":"","headers":{},"status":204,"type":"http_response"}],"captures":[{"sensitive":true,"value":{"path":["token"],"source":"request_json"},"variable":"token"}],"from":"waiting","guards":[],"id":"accept_callback","max_uses":1,"priority":100,"to":"complete","trigger":{"body":null,"headers":{},"method":"POST","path":"/callback","protocol":"http"}}]}}

Search analyzed procedure names using literal matching by default or regex opt-in. Providers bound search work and reject regex constructs, paths, candidates, or cumulative work outside their finite budgets. Results are deterministic and offset-paginated.

{"case_sensitive":false,"limit":100,"mode":"literal","offset":0,"pattern":"main"}

Search analyzed strings using literal matching by default or regex opt-in. Providers bound search work and reject regex constructs, paths, candidates, or cumulative work outside their finite budgets. Results are deterministic, offset-paginated, and explicitly truncated.

{"case_sensitive":false,"limit":100,"mode":"literal","offset":0,"pattern":"authorization failed"}

Assign an analyst name to one hexadecimal address and report Hopper's boolean result. This mutates analysis metadata; read it back with address_name before relying on it.

{"address":"0x1000","name":"entry"}

Assign analyst names to an address/name map and return per-address success booleans. This mutates analysis metadata; use for bounded batches and verify failures individually.

{"names":{"0x1000":"entry"}}

Create or replace a bookmark at a hexadecimal address. This mutates navigation metadata; verify with list_bookmarks and do not treat bookmarks as binary evidence.

{"address":"0x1000"}

Write a regular analysis comment at a hexadecimal address and return whether readback matched. This mutates the Hopper document; use comments to record evidence IDs or reasoning.

{"address":"0x1000","comment":"validated entry point"}

Select an already-open Hopper document by exact document name. This changes subsequent default-document routing; call list_documents first and prefer explicit document inputs where reproducibility matters.

{"document":"fixture"}

Write an inline instruction comment at a hexadecimal address and return whether readback matched. This mutates analysis metadata; confirm with inline_comment.

{"address":"0x1000","comment":"calls parser"}

Retain the current canonical Evidence v2 bundle as an immutable session resource. Returns a compact digest summary and exact opaque URI; copy that URI unchanged and call MCP resources/read (Codex: read_mcp_resource) for the full bundle. Repeating an unchanged snapshot is idempotent.

{}

Discover legacy-mangled Swift class procedures after exhaustively paging analyzed procedures. Returns at most 100 entries and scans at most 5,000 symbols; use analyze_swift_types for other Swift kinds.

{"pattern":""}

Trace a typed literal seed through an authenticated JavaScript Application Graph supplied as full Evidence or an Evidence ID returned earlier in this session. Explicit direction, depth, node, edge, and path bounds apply. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.

{"application_evidence_id":"ev_0000000000000000000000000000000000000000000000000000000000000000","direction":"both","seed":{"case_sensitive":false,"kind":"module","match":"exact","value":"renderer.js"}}

Trace a deterministic bounded caller or callee path from one exact procedure address, optionally stopping at a goal. Returns visited nodes, direct-call edges, one shortest traversal path, failures, frontier, consumed limits, an Evidence ID, and explicit residual unknowns without claiming unresolved indirect calls are absent.

{"direction":"forward","goal":"0x1100","max_depth":5,"max_nodes":100,"max_operations":100,"start":"0x1000"}

Trace a bounded literal feature query through matching strings and procedures, xrefs, and truthful containing-procedure resolution. Returns the operation budget, truncation, and residual unknowns; unknown_registry_approved: true records them durably without inferring reference kinds.

{"case_sensitive":false,"limit":20,"max_operations":20,"query":"license"}

Trace bounded static JavaScript data-flow, direct call/return, and closure relations from authenticated analyze_javascript_application v2 Evidence. Queries declare direction and exact node, relation, depth, function, module, and page limits. Dynamic or unsupported semantics remain explicit unknowns; static reachability never claims runtime execution.

{"application_evidence_id":"ev_0000000000000000000000000000000000000000000000000000000000000000","query":{"direction":"backward-provenance","seed":{"kind":"semantic-node","node_id":"jsrg_node_0000000000000000000000000000000000000000000000000000000000000000"},"source_map_authority":{"authority":"none"}}}

Remove the bookmark at a hexadecimal address and return whether it is absent. This mutates navigation metadata and does not alter binary bytes.

{"address":"0x1000"}

Append one immutable full-state revision and mutation evidence. Requires approved: true and exact expected_revision; stale concurrent writers fail instead of overwriting newer analysis.

{"approved":true,"contradicting_evidence_ids":[],"expected_revision":1,"recommended_probes":[],"relationships":[],"required_authority":"controlled-replay","required_confidence":"observed","required_environment":null,"resolution":null,"severity":"medium","status":"investigating","supporting_evidence_ids":[],"unknown_id":"unk_0000000000000000000000000000000000000000000000000000000000000000"}

Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states.

{"limits":{"max_candidates_per_import":25,"max_native_observations":20},"managed_boundaries_evidence_id":"ev_5e142d4464b916bcff63fb0835c686152b5b0473a9f1d5f5060d329b1b29739d","native_observation_evidence_ids":["ev_74758ad108882d5752dae4f8fa030c1ed6c7dd62857cb9d2d3a7ce931b52ee7c"]}

Verify a finite typed behavioral and structural specification against a canonical Evidence bundle. Pass means every declared claim has complete comparable authority—not global source equivalence; changed claims fail and missing, limited, or unresolved evidence stays unknown.

{"limit":100,"offset":0,"specification":{"claims":[{"claim_id":"terminal-output","comparison_evidence_id":"ev_2ffc472e561cea4b5e65ddaf7b80bc112b7ed6d0d023f0cf7398bc2068a12e2d","dimension":"terminal","kind":"behavioral","title":"Terminal output remains equivalent"}],"name":"Terminal compatibility","schema_version":1}}

Revalidate the current residual-unknown head against live bundled evidence, exact authority/confidence/environment requirements, and revision integrity. Withdrawn and out-of-scope dispositions are not truth claims.

{"unknown_id":"unk_0000000000000000000000000000000000000000000000000000000000000000"}

Return analyzed references to a code or data address, defaulting to the current cursor. Use to connect strings, globals, selectors, and functions; bare addresses are untyped and indirect references may be incomplete.

{}