yi-ge · Oct 11, 2026 · Oct 11, 2026
diff --git a/entries/rea-mcp/catalog-metadata.v1.json b/entries/rea-mcp/catalog-metadata.v1.json
@@ -0,0 +1,121 @@
+{
+  "$schema": "../../schemas/catalog-metadata.v1.schema.json",
+  "schemaVersion": 1,
+  "identity": {
+    "kind": "service",
+    "id": "rea-mcp"
+  },
+  "presentation": {
+    "defaultLocale": "zh-CN",
+    "i18n": {
+      "zh-CN": {
+        "name": "REA MCP",
+        "summary": "REA 逆向工程 MCP 服务：分析本地二进制、JavaScript、托管代码与浏览器；需兼容 Node.js，分析引擎按任务另行配置。",
+        "description": "固定 rea-agents@6.4.0 的本地 stdio 服务，CLI 与 MCP 共用一个发布包，无独立桌面 GUI。Node.js 要求 ^22.19.0 || ^24.11.0 || >=26.0.0。服务登记不自动安装 Ghidra、Hopper、IDA、JEB、Java、浏览器或 Android 工具；商用引擎需单独许可。仅分析获授权目标，运行、附加调试、修改文件及设备操作需明确授权。macOS 已验证无目标启动、握手和 170 项工具列表；Windows/Linux 与具体分析任务未实测。条目为独立社区收录，不代表上游背书或完整安全审计。"
+      },
+      "en-US": {
+        "name": "REA MCP",
+        "summary": "REA reverse-engineering MCP service for local binaries, JavaScript, managed code and browsers; requires compatible Node.js and task-specific analysis providers.",
+        "description": "Local stdio service pinned to rea-agents@6.4.0. CLI and MCP share one release package; there is no standalone desktop GUI. Requires Node.js ^22.19.0 || ^24.11.0 || >=26.0.0. Listing does not install Ghidra, Hopper, IDA, JEB, Java, browsers or Android tools; commercial engines require separate licenses. Analyze authorized targets only; execution, debugger attachment, file mutation and device actions require explicit authorization. Target-free startup, handshake and a 170-tool inventory were verified on macOS; Windows/Linux and actual analyses were not exercised. Independent community listing, without upstream endorsement or a complete security audit."
+      }
+    },
+    "tags": [
+      "reverse-engineering",
+      "binary-analysis",
+      "javascript",
+      "mcp"
+    ]
+  },
+  "release": {
+    "state": "known",
+    "version": "6.4.0",
+    "versionScheme": "semver"
+  },
+  "timestamps": {
+    "catalogUpdatedAt": {
+      "state": "known",
+      "value": "2026-10-11",
+      "precision": "day"
+    },
+    "releasePublishedAt": {
+      "state": "known",
+      "value": "2026-10-11T03:58:03Z",
+      "precision": "second"
+    },
+    "reviewedAt": {
+      "state": "known",
+      "value": "2026-10-11",
+      "precision": "day"
+    },
+    "upstreamObservedAt": {
+      "state": "known",
+      "value": "2026-10-11",
+      "precision": "day"
+    }
+  },
+  "provenance": {
+    "content": {
+      "kind": "package",
+      "url": "https://www.npmjs.com/package/rea-agents",
+      "ref": "6.4.0",
+      "sha256": "59eb1604b8db75f522d4a975c36ce6b4a2ad465e43bad165f9a8f728391db9b8",
+      "path": "package"
+    }
+  },
+  "governance": {
+    "availability": "installable",
+    "stewardship": "community",
+    "license": {
+      "state": "known",
+      "value": "MIT",
+      "evidencePath": "LICENSE"
+    },
+    "redistribution": "allowed",
+    "listingMaintainer": {
+      "name": "mashagua",
+      "url": "https://github.com/mashagua",
+      "verified": false
+    },
+    "upstreamMaintainer": {
+      "name": "morluto",
+      "url": "https://github.com/morluto",
+      "verified": false
+    },
+    "branding": {
+      "relationship": "independent-listing",
+      "nameUsage": "nominative",
+      "logoStatus": "not-used"
+    },
+    "compliance": {
+      "licenseEvidencePath": "LICENSE",
+      "noticePath": "LICENSE",
+      "reviewedRef": "6.4.0",
+      "reviewedAt": "2026-10-11",
+      "reviewedBy": "mashagua",
+      "upstreamEndorsed": false
+    }
+  },
+  "compatibility": {
+    "platforms": {
+      "state": "known",
+      "values": [
+        "macos",
+        "windows",
+        "linux"
+      ]
+    }
+  },
+  "spec": {
+    "kind": "service",
+    "protocol": "mcp",
+    "authType": "none",
+    "capabilities": [
+      "binary_analysis",
+      "javascript_analysis",
+      "managed_code_analysis",
+      "browser_inspection",
+      "evidence_export"
+    ],
+    "toolCount": 170
+  }
+}
diff --git a/entries/rea-mcp/install.md b/entries/rea-mcp/install.md
@@ -0,0 +1,76 @@
+# REA MCP 安装 / Installation
+
+本条目提供 `rea-agents@6.4.0` 的本地 stdio MCP 服务。CLI 与 MCP 来自同一个包，不需要分别安装；它不是独立桌面 GUI。市场中的 `reverse-engineer-anything` 是配套使用指南，安装该 Skill 不等于安装 REA 服务。
+
+This entry provides the local stdio MCP service from `rea-agents@6.4.0`. CLI and MCP share one package; this is not a standalone desktop GUI. The separate `reverse-engineer-anything` Market Skill is a usage guide, not a runtime installation.
+
+## 环境要求 / Prerequisites
+
+- Node.js：`^22.19.0 || ^24.11.0 || >=26.0.0`，以及该运行时配套的 npm/npx。Node.js 23、25 不在上游支持范围内。不要为本条目自动升级用户的 Node.js 或 npm。
+- MCP 宿主需支持 stdio，能找到 `npx`，并允许启动本地工具进程。第一次获取 npm 依赖需要网络。
+- 不设置 `HOPPER_TARGET_PATH`，即可先做无目标连接检查。已有 REA/引擎环境变量需要先复核，不能把用户的旧目标当作本次授权。
+- 服务启动不代表分析引擎就绪。原生分析按任务需要 Hopper、Ghidra 或 IDA；Android 按流程需要 JADX、Java、ADB 或 Apktool；浏览器流程需要兼容浏览器。固件、托管代码与运行时流程也有各自依赖。具体要求见[固定版本的安装指南](https://github.com/morluto/rea/blob/a56f7bb668ab23fec8d33f7af353ac7ed2fe1895/docs/installation.md)。
+- Hopper、IDA、JEB 等商业产品的许可和费用独立于 REA 的 MIT 许可。第三方引擎及依赖适用各自条款，不得用 REA 的许可覆盖它们。
+
+Requires Node.js `^22.19.0 || ^24.11.0 || >=26.0.0`, npm/npx, network access for initial acquisition, and a host that supports local stdio processes. Do not automatically upgrade the user's runtime or reuse a configured target as authorization. Analysis providers, Java, Android tools and browsers must be prepared separately for the selected workflow. Commercial providers require their own licenses and may incur fees.
+
+## 固定制品与校验 / Pinned artifact
+
+| 项目 / Field | 固定值 / Value |
+| --- | --- |
+| Package | `rea-agents@6.4.0` |
+| 发布包 / Artifact | `https://registry.npmjs.org/rea-agents/-/rea-agents-6.4.0.tgz` |
+| SHA-256 | `59eb1604b8db75f522d4a975c36ce6b4a2ad465e43bad165f9a8f728391db9b8` |
+| 文件大小 / Bytes | `1825761` |
+| 发布代码 / Release commit | `a56f7bb668ab23fec8d33f7af353ac7ed2fe1895` |
+
+推荐需要明确制品校验的安装流程：在用户选择的独立安装目录下载上述文件，先核验 SHA-256，再安装。以下 macOS/Linux 示例在当前目录创建一个新目录；若同名目录已存在，先检查现有安装，不覆盖它。
+
+```sh
+mkdir rea-mcp-6.4.0 && cd rea-mcp-6.4.0
+curl --fail --location --proto '=https' --proto-redir '=https' \
+  --output rea-agents-6.4.0.tgz \
+  https://registry.npmjs.org/rea-agents/-/rea-agents-6.4.0.tgz
+```
+
+macOS 校验：
+
+```sh
+printf '%s  %s\n' \
+  59eb1604b8db75f522d4a975c36ce6b4a2ad465e43bad165f9a8f728391db9b8 \
+  rea-agents-6.4.0.tgz | shasum -a 256 --check
+```
+
+Linux 使用同一校验行，将 `shasum -a 256 --check` 换为 `sha256sum --check`。Windows 可以用 `Invoke-WebRequest` 获取同一 HTTPS 文件，再用 `Get-FileHash -Algorithm SHA256` 比较上述值。**下载失败或摘要不一致时停止，不执行包。**
+
+仅在摘要通过后运行：
+
+```sh
+npm install --ignore-scripts --no-audit --no-fund ./rea-agents-6.4.0.tgz
+node ./node_modules/rea-agents/scripts/rea.mjs --version
+```
+
+应输出 `6.4.0`。连接验证后的副本时，用 `node` 的绝对路径作 `command`，用安装目录下 `node_modules/rea-agents/scripts/rea.mjs` 的绝对路径和 `--mcp` 作 `args`，不依赖宿主工作目录。禁止为连接这条服务执行 `rea setup` 或覆盖其他客户端配置。
+
+The explicit verification path downloads the pinned HTTPS tarball, checks SHA-256, and only then installs it in a separate directory with lifecycle scripts disabled. A mismatch must stop installation. `--version` must return `6.4.0`. Connect this verified copy using absolute Node and script paths, followed by `--mcp`. Do not run `rea setup` or replace unrelated client configurations.
+
+## 目录默认启动方式 / Catalog launch
+
+默认 manifest 使用固定版本的 npx 启动，并关闭依赖安装生命周期脚本：
+
+```sh
+npx --yes --ignore-scripts rea-agents@6.4.0 --mcp
+```
+
+普通 `npx rea-agents@6.4.0` 是 CLI，不能替代上述 MCP 命令。默认 npx 获取过程由 npm 校验包完整性；sidecar 中的 SHA-256 是目录证据，不能据此宣称每个客户端都会强制校验它。需要此保证时采用前面的下载校验流程和绝对路径连接。固定 REA 包版本也不等于锁住或完整审计全部传递依赖；离线或可重复部署应保留安装锁文件，并按部署环境复核依赖。
+
+The default launch pins the package and disables dependency lifecycle scripts. Omitting `--mcp` selects CLI mode. npm handles integrity for npx acquisition; recording SHA-256 in the sidecar does not prove that every client enforces it. Use the verified local-copy path when that guarantee is required. The top-level pin is not a complete transitive dependency lock or security audit.
+
+## 验证、升级、卸载 / Verify, update, remove
+
+- 先检查版本，再由 MCP 宿主做 `initialize` 和 `tools/list`。本轮 macOS 无目标检查列出 170 项工具；它们的声明存在不代表相应引擎、目标或权限可用。
+- 握手或依赖检查失败时保留具体错误，不能标为可用，也不能编造分析结果。不要为“验证”自动执行目标、连接调试端口、安装设备应用或购买许可。
+- 升级时重新核对新版本制品、摘要、许可证和兼容性，提交目录更新；不改为 `latest`。
+- 卸载先停止该 MCP 进程并移除这条连接。只处理本条目拥有的安装目录；不要删除共享 npm 缓存、其他引擎、用户分析产物或整个 MCP 配置。
+
+Verify version and target-free MCP initialization/tool listing first. A published tool is not proof of provider readiness. Report dependency failures honestly. Updates require a fresh pin and evidence review. Removal stops this connection and handles only its owned installation, preserving shared caches, other providers, user evidence and unrelated client configuration.
diff --git a/entries/rea-mcp/manifest.json b/entries/rea-mcp/manifest.json
@@ -0,0 +1,49 @@
+{
+  "id": "rea-mcp",
+  "name": "REA MCP",
+  "type": "mcp",
+  "version": "6.4.0",
+  "author": "morluto",
+  "description": "REA 逆向工程 MCP 服务：分析本地二进制、JavaScript、托管代码与浏览器；需兼容 Node.js，分析引擎按任务另行配置。",
+  "tags": [
+    "reverse-engineering",
+    "binary-analysis",
+    "javascript",
+    "mcp"
+  ],
+  "icon": "terminal",
+  "platformSupport": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "capabilities": [
+    "binary_analysis",
+    "javascript_analysis",
+    "managed_code_analysis",
+    "browser_inspection",
+    "evidence_export"
+  ],
+  "toolCount": 170,
+  "install": {
+    "method": "npx",
+    "packageName": "rea-agents",
+    "command": "npx",
+    "args": [
+      "--yes",
+      "--ignore-scripts",
+      "rea-agents@6.4.0",
+      "--mcp"
+    ]
+  },
+  "connection": {
+    "transport": "stdio",
+    "command": "npx",
+    "args": [
+      "--yes",
+      "--ignore-scripts",
+      "rea-agents@6.4.0",
+      "--mcp"
+    ]
+  }
+}
diff --git a/entries/rea-mcp/review.md b/entries/rea-mcp/review.md
@@ -0,0 +1,35 @@
+# REA MCP 收录证据 / Listing evidence
+
+审核日期：2026-10-11；收录维护者：mashagua。独立社区收录，未获得上游背书，维护者身份不标记为 verified。REA 名称仅用于指称上游产品，使用通用 `terminal` 图标，不复制上游商标图形。此记录是来源、许可和有限连接检查，不是完整安全审计。
+
+Reviewed on 2026-10-11 by mashagua. Independent community listing, without upstream endorsement or verified maintainer claims. The name identifies the upstream product; the icon is generic. This is a provenance/license review and a limited connection check, not a complete security audit.
+
+## 来源与许可 / Provenance and license
+
+- [上游发布 rea-agents 6.4.0](https://github.com/morluto/rea/releases/tag/rea-agents-6.4.0)：发布时间 `2026-10-11T03:58:03Z`。
+- 发布 tag 指向 `a56f7bb668ab23fec8d33f7af353ac7ed2fe1895`；npm 元数据的 `gitHead` 相同。未使用浮动 `main` 或 `latest`。
+- [npm 固定版本元数据](https://registry.npmjs.org/rea-agents/6.4.0)和[固定 tarball](https://registry.npmjs.org/rea-agents/-/rea-agents-6.4.0.tgz)已读取；实际下载 `1825761` 字节。
+- 实测 SHA-256：`59eb1604b8db75f522d4a975c36ce6b4a2ad465e43bad165f9a8f728391db9b8`。同时核对 npm `dist.shasum` 的 SHA-1 与 `dist.integrity` 的 SHA-512，均匹配下载字节。未验证 npm 签名或 SLSA provenance，不宣称完成该层认证。
+- 内容根为 tarball 的 `package/`。Sidecar 的 `ref`/`reviewedRef` 都是包版本 `6.4.0`；许可证证据 `LICENSE` 相对于该内容根，已核对包内实际文本与[发布代码的 LICENSE](https://github.com/morluto/rea/blob/a56f7bb668ab23fec8d33f7af353ac7ed2fe1895/LICENSE)，均为 MIT。
+- Sidecar 的 `kind: package` URL 标识 npm 包 `rea-agents`；`ref` 固定版本，SHA-256 固定该版本的 tarball 字节，不是包主页 HTML 的摘要。实际下载 URL 见上文与 install.md。以客户端真实包身份、一致性和获取准入函数复查通过；直接把 tarball URL 当作包身份会被该客户端拒绝，因此未采用这种形态。
+- 保留 REA 版权和许可声明，以及包内 `third_party/evmole/LICENSE`、`third_party/pwndbg/LICENSE.md` 和 `licenses/nativeaot-parser-MIT.txt` 等适用声明。外部 Python 包、分析引擎和 npm 依赖仍遵循其各自许可；REA 的 MIT 不授予商业引擎许可。
+- registry 只收 manifest、sidecar 和说明，不复制源码、发布包、引擎、原始验收日志或本机配置。
+
+The release tag and npm `gitHead` match the pinned commit. The downloaded tarball matched the recorded SHA-256 and npm SHA-1/SHA-512 integrity values. npm signatures and SLSA provenance were not verified. License evidence paths refer to the tarball's `package/` content root; preserve bundled notices and review external dependencies separately. No upstream source or runtime artifact is vendored here.
+
+## 运行检查 / Runtime check
+
+macOS、Node.js `24.18.0`。在独立临时工作目录安装已核验 tarball，关闭安装生命周期脚本；未执行上游构建或全量测试。
+
+- `--version`：输出 `6.4.0`，退出码 0。
+- 生产入口 `--mcp`：完成 MCP `initialize`，返回 `serverInfo.name: rea`、`version: 6.4.0`；协议协商为 `2025-11-25`。
+- `tools/list`：170 项，名称唯一，每项含 `inputSchema`。只验证目录声明，没有调用分析工具。
+- 关闭 stdin：服务正常退出，退出码 0；检查使用的临时资源目录没有残留条目。
+- 默认 `npx --yes --ignore-scripts rea-agents@6.4.0 --mcp` 也完成同样的检查；使用临时目录内已安装的核验包，未覆盖首次远程获取场景。npx 的 Node 编译缓存仍存在，这不同于 REA provider 资源泄漏。
+- 未调用 `rea setup`，未打开目标、启动分析引擎、附加浏览器/调试器、操作设备或修改用户 MCP 配置。
+
+The target-free macOS smoke check verified version, production MCP initialization and a unique 170-tool inventory, with clean EOF shutdown. No analysis tool, setup operation or target was invoked. Windows/Linux, provider-specific analyses and DesireCore desktop installation were not exercised. Listing availability is not a ready connection or client upgrade.
+
+`compatibility.platforms` 表示上游公布的服务适用平台，不代表本轮做过三平台验收。`availability: installable` 表示具备目录要求的固定来源、许可和治理证据，不代表运行时及全部 provider 已就绪。客户端必须按自己支持的 registry/schema 与服务连接契约读取；目录 PR 不会升级客户端，也不能补齐缺失依赖。
+
+Platform metadata records upstream applicability, not three-platform acceptance. Installable catalog evidence does not establish runtime/provider readiness. Clients must support the relevant Registry and connection contracts; publishing this entry neither upgrades them nor provisions missing analysis dependencies.