MIT 许可的 AI 代理逆向工程工具包（CLI + MCP）；README 未提及 DeepSeek Harness，通过标准 MCP 服务器注册的方式接入 DSH。
DSH 适配
兼容
作者声明
安全审计
未审计
最后核验
2026-08-21
许可证
MIT
01它能帮你完成什么？
Investigate how an application feature works — from app behavior down to native binaries — using an agent
Agent explanations of feature internals backed by pseudocode, strings, cross-references and call graphs, recorded as reproducible Evidence v2 records
Developers, security and interop engineers who want a coding agent to understand closed-source or undocumented software
Recreate an investigated feature in your own project during the same coding session
A version of the feature adapted to your stack, interface, and requirements, built by the agent with its normal file-editing tools
Product developers porting or reimplementing a feature whose source code they do not have
Analyze proprietary binaries locally without sending the app to a hosted service
Local decompilation, artifact inventory and observation results; evidence and snapshots stay on the local host
Teams handling proprietary or sensitive binaries that cannot leave the machine
02如何接入 DeepSeek Harness？
前置条件
- Node.js 22.19+ or 24.11+ (including newer releases) and npm
- macOS 12 or newer, Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux (Windows x64 only for the experimental, Ghidra-only native PE P0 boundary)
- For deep binary analysis: Hopper (separate desktop application with its own license) or a bring-your-own Ghidra 12.1.2 installation with 64-bit JDK 21 on Linux x64
- An MCP-capable agent (e.g. DeepSeek Harness) — setup auto-detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI and Windsurf; other agents use manual MCP configuration
安装步骤
- 01
Install the CLI globally: `npm install --global rea-agents` (or run without installing via `npx --yes rea-agents@latest setup`)
$ npm install --global rea-agents
- 02
Run `rea setup` (or `npx --yes rea-agents@latest setup`), review the printed plan, and choose Agent Integration — REA installs the pinned MCP registration and its matching routing skill as one transaction
$ npx --yes rea-agents@latest setup
- 03
Restart the configured agent so it loads REA
- 04
For agents not auto-detected (e.g. DeepSeek Harness), add the manual MCP config: `{ "mcpServers": { "rea": { "command": "npx", "args": ["-y", "rea-agents@3.1.0", "mcp"] } } }`
验证接入成功
- Run `rea doctor` (or `npx -y rea-agents@latest doctor`): a read-only diagnostic that distinguishes unsupported hosts, missing dependencies, a missing local analysis engine, configuration drift, and healthy checks
- After a successful setup, REA reports the capabilities now ready to use and a concrete next step, and only claims an integration is ready when setup's final diagnostic check verified it
回滚
- `rea uninstall` removes only REA-owned MCP registrations and the managed skill (`--purge-data` also removes ~/.rea/cache and ~/.rea/state); Hopper, Node.js, evidence, unrelated skills and other MCP servers are preserved
03DSH 适配与能力边界
Standard MCP server registered via manual mcpServers config (`npx -y rea-agents@<version> mcp`); the README does not mention DeepSeek Harness, so integration is generic MCP rather than an officially documented DSH plugin.
Native binary analysis via Hopper / Ghidra
Mach-O, ELF, PE, .app, ZIP, APK, IPA, ASAR, plist, JavaScript and source-map targets→Pseudocode, assembly, strings, names, callers/callees, xrefs, call graphs and bounded function dossiers
Launches and controls Hopper (or a caller-selected Ghidra bridge) locally; Hopper may come to the foregroundWrites Evidence v2 records and optional analysis snapshots to operator-approved local rootsJavaScript / Electron / browser observation
Local JavaScript/Electron app directories or ASAR archives; a user-owned Chrome-family browser on a loopback CDP endpoint→Static application mapping without execution, passive CDP page capture, and bounded source-map reconstruction
Browser and V8 Inspector observation are disabled by default and require explicit environment-variable approvalPlaywright scenario capture is a separately approved, explicitly mutating boundaryReproducible Evidence v2 records
Every successful analysis result→Deterministic Evidence v2 bundles with artifact and provider identity, confidence, authority, limitations and locations; import/export/compare across sessions
Writes evidence bundles only to operator-approved absolute roots; imports never execute bundle contentSame workflows over CLI and MCP
Any agent that supports local MCP servers, or a terminal→Identical reverse-engineering workflows from CLI and MCP, six guided MCP prompt workflows, and setup that auto-configures Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI and Windsurf
`rea setup` writes additive, backup-first MCP registrations into detected agent configuration files
04适合谁？何时不该用？
适合
- Developers, security and interop engineers who want a coding agent to understand closed-source or undocumented software
- Product developers porting or reimplementing a feature whose source code they do not have
- Teams handling proprietary or sensitive binaries that cannot leave the machine
不适合
- Supported hosts are macOS 12+, Ubuntu 24.04+, Fedora 41+ or 64-bit Arch Linux; Windows x64 is limited to the experimental, Ghidra-only native PE P0 boundary, and some current workflows still require Hopper and macOS.
- Deep binary analysis requires a separate provider: Hopper (its own license, optionally installed by setup) or bring-your-own Ghidra 12.1.2 with JDK 21 — REA never downloads Ghidra or installs Java.
- REA's shipped providers, passive observers and Process Capture are not security sandboxes — providers and launched targets run with the current user's permissions; dynamic capabilities are disabled by default and require operator policy plus explicit per-call approval.
05兼容性、维护与安全提示
- Supported hosts are macOS 12+, Ubuntu 24.04+, Fedora 41+ or 64-bit Arch Linux; Windows x64 is limited to the experimental, Ghidra-only native PE P0 boundary, and some current workflows still require Hopper and macOS.
- Deep binary analysis requires a separate provider: Hopper (its own license, optionally installed by setup) or bring-your-own Ghidra 12.1.2 with JDK 21 — REA never downloads Ghidra or installs Java.
- REA's shipped providers, passive observers and Process Capture are not security sandboxes — providers and launched targets run with the current user's permissions; dynamic capabilities are disabled by default and require operator policy plus explicit per-call approval.
MIT · actively maintained (latest release rea-agents-3.1.0, 2026-08-09)
06常见问题
REA 如何接入 DeepSeek Harness？
README 没有针对 DeepSeek Harness 的专门集成说明，但 REA 是标准 MCP 服务器，任何支持本地 MCP 服务器的代理都能使用。运行 `npx --yes rea-agents@latest setup` 并选择 Agent Integration，或手动添加指向 `npx rea-agents mcp` 的 mcpServers 配置，然后重启代理即可。
需要什么前置条件？
Node.js 22.19+ 或 24.11+ 和 npm；系统需 macOS 12+、Ubuntu 24.04+、Fedora 41+ 或 64 位 Arch Linux（Windows x64 仅限实验性的 Ghidra PE 边界）。深度二进制分析还需 Hopper（单独授权）或自备 Ghidra 12.1.2 + JDK 21。
REA 会把我的应用上传到云端吗？
不会。REA 没有托管分析服务，所有 provider 都在本地分析构件和捕获行为。不过你的代理或模型提供商可能有自己的数据政策，需要另行确认。
能恢复出原始源代码吗？
任何反编译器都无法保证还原原始源码。REA 向代理提供伪代码、汇编、符号、字符串、元数据与关系，让代理据此解释行为或兼容地重建功能。
如何验证安装成功？
运行 `npx -y rea-agents@latest doctor`——这是一个只读诊断，能区分不受支持的主机、缺失依赖、缺失本地分析引擎、配置漂移与健康检查。
07相关的 DSH 工作流
ruflo
作者 ruvnet
原版智能体元框架（meta-harness）：支持多智能体集群部署、自主工作流编排与对话式 AI 系统构建，内置自适应记忆、自学习智能与 RAG 检索，原生集成 Claude Code / Codex / Hermes 等大量工具。
app
作者 reactive-resume
隐私优先的开源简历制作插件，支持自定义、便携部署和永久免费使用，适合直接生成并管理求职简历。
everos
作者 evermind-ai
为所有 AI 智能体提供的便携统一记忆层，本地优先、Markdown 原生、数据归用户所有，跨应用与工作流自进化。
yao
作者 yaoapp
在桌面、移动端、浏览器或 API 上统一管理你的智能体与工作区，看板式任务追踪，支持自托管。
08数据与来源
Any agent that supports local MCP servers can use REA with the configuration below.
"args": ["-y", "rea-agents@3.1.0", "mcp"]
页面基于项目公开文档、仓库元数据和 DSH Plugins 的结构化解析生成；最后核验于 2026-08-21。发现错误？提交更正。
最佳 DeepSeek Harness 插件
从全目录挑出的 12 个值得优先安装的插件，覆盖各个分类。