# rea-plus Conduit live-debug core + Rea static domains. 30 frozen tools + prefixed rea domains over stdio/HTTP. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.12.0 - **Author:** io.github.Alyhnte - **License:** MIT - **npm:** rea-plus - **Source:** https://github.com/Alyhnte/ReaPlus - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-10-20T04:42:49.056Z - **Version scanned:** 0.13.0 - **CVEs:** none found by OSV at scan time ## Tools 30 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `debug_open` — Open a PE target for live debugging on this session's debug engine. Auto-detects x86/x64 and leaves the debuggee paused. x64dbg breaks on entry; cdb stops at th - `debug_attach` — Attach by pid, or, on a frida session, connect to a listening Frida Gadget (gadget host:port) or a running mobile package on USB (usb + package). The target kee - `debug_close` — Tear down the hidden x64dbg process held by a session. Launched targets are stopped; attached targets are detached and left running. - `debug_state` — Report live debug state (running/paused/terminated + pause reason) and the open target, if any. - `debug_breakpoint` — Set, remove, or list breakpoints. Address may be hex, a number, or an x64dbg expression. - `debug_continue` — Resume the debuggee until the next breakpoint, single-step, or exit. The stop posts an event (debug.breakpoint_hit / debug.exited / debug.paused) retrievable vi - `debug_step` — Single-step the debuggee (into or over calls) and report the new location. - `debug_pause` — Asynchronously break a running debuggee. Idempotent when already paused. - `debug_registers` — Read debuggee registers (general + flags; segment/debug optionally). - `debug_callstack` — Read the current thread's call stack (address, module, function per frame). - `debug_memory` — Live process memory: read, search, or dump. Requires confirm:true. Without it the call returns confirmation_required and does not touch the debuggee. - `debug_code` — Live code: disassemble at an address (default: the stopped instruction pointer), assemble one instruction, or run until an address. Requires confirm:true. - `debug_thread` — Live threads: list, select, freeze, thaw, or read one thread's context. The id is the value returned by list (cdb index, x64dbg/frida OS thread id). Requires co - `debug_plugin` — x64dbg Scylla and ScyllaHide. status reports files on disk. dump and hide do not open a window: a missing headless plugin returns engine_unavailable with the pl - `debug_time` — Checkpoint snapshot, the checkpoint timeline, and rewind of one checkpoint. A checkpoint is the active thread's registers, the thread list, and one memory windo - `explain` — Short Turkish explanation of an assembly window: what the region does, where it jumps, and which calls notify the user or the system. - `prerequisites` — Check the programs Conduit uses (radare2, x64dbg, cdb, Python, Frida, Graphviz, ScyllaHide). - `health` — Report bridge liveness. Does not touch a debugger engine. - `session_open` — Open an application session for an engine. Returns session_id for later tool arguments. - `session_close` — Drop an application session and its event buffer. - `session_list` — List application sessions held in this process. - `events_pull` — Pull events stored for one application session since a sequence number. This does not subscribe to push notifications. - `static_info` — Report radare2 static-engine capabilities, r2 availability, and the open target (if any). - `open_target` — Open a binary target for static analysis in a radare2 session. Only mode 'static' is supported; anything else is a capability error. Requires r2 on PATH. - `close_target` — Release the binary target (and its radare2 process) held by a session. - `disassemble` — Disassemble instructions at an address (linear, `count` ops) or a whole function. Defaults to the entry function. - `get_cfg` — Control-flow graph of a function as JSON and/or Graphviz DOT. Defaults to the entry function. - `xrefs` — Cross-references to and/or from an address (code and data). - `strings` — Strings found in the binary (address, section, length, text). - `dump` — Read raw bytes at an address as hexdump text or a JSON byte array. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"rea-plus\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"rea-plus\"\n ]\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on your machine; read-only tool surface. - Floor 12, ceiling 30 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/rea-plus - Install plan: https://forgeregistry.com/api/v1/packages/rea-plus/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/rea-plus - HTML page: https://forgeregistry.com/registry/rea-plus - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.