Commands and tools used in this manual
Every rea command and MCP tool the captures ran, with what it answers, the capture file that holds its output, and the section that explains it.
rea 6.7.0 has 153 CLI commands and 207 MCP tools. binary_session reports these counts in its catalog (the capture). The capture kit ran 17 one-shot commands and 13 tools, plus rea mcp and the two MCP methods that every session starts with. CLI names join words with - and MCP names with _. Three native commands map to tools with other names: function calls analyze_function, decompile calls procedure_pseudo_code, and analyze calls binary_overview. The capture passed --format json to every command and --filter-output with a key list where a record was too large to keep whole (the capture).
The output flags --format, --filter-output, --token-limit, and --token-offset accept the form --flag=value, as in --format=json. The setup runs used the same form for --skill=false.
CLI commands
| Command | Answers | Recorded output | Section |
|---|---|---|---|
rea doctor --provider ghidra | whether the provider and its environment are healthy, one check per row | output | 2.2 |
rea capabilities | the operations of each provider in groups, with the availability, the effects, and the limitations of each group, and the availability of each provider | output | 2.3 |
rea inspect-artifact <path> | the content-addressed artifact graph of a file or package | output | 3.1 |
rea inspect-binary-layout <path> | ELF sections, symbols, and relocations through the pwntools profile, Linux x64 only, so it fails on macOS with capability_unavailable | output | 3.2 |
rea inspect-macho <path> | Mach-O load commands, segments, sections, imports, exports, and build metadata | output | 3.2 |
rea analyze <path> --provider ghidra | binary_overview: the document, its segments, and the procedure and string counts | output, output | 3.4 |
rea function <path> <name> --provider ghidra | the analyze_function dossier of one procedure | outputs | 4.6 |
rea decompile <path> <name> --provider ghidra | the procedure_pseudo_code of one procedure | outputs | 4.6 |
rea address-to-file-offset <path> <address> --provider ghidra | the file offset of one virtual address | output | 3.3 |
rea inspect-evidence-bundle '{"path":..., "detail": "summary"}' | one row per record of a bundle, without the payloads | outputs | 5.4 |
rea evidence-export <bundle> <out> | a canonical copy of a bundle, keys sorted | output, output | 5.4 |
rea evidence-import <bundle> | validation of every record id and manifest in a bundle, and the refusal of a bundle whose ids do not verify | output, output | 5.4 |
rea compare <left> <right> | the two bundles by record membership and unknown revisions | output | 5.5 |
rea analyze-javascript-application <dir> | the application graph of a JavaScript or Electron application, without running it | output, output | 6.1 |
rea inspect-analysis-view <request.json> | a summary or one page of a saved record | output, output | 6.1 |
rea inspect-wasm-artifact <path> | the validation result, the sections, and the import and export interface of one WebAssembly module, from WABT 1.0.42 | output | 6.2 |
rea setup --client claude_code --skill=false | the plan or the result of writing the rea entry into the Claude Code configuration | output, output, output | 8.1 |
rea mcp | the MCP server over stdio | outputs, output | 8.1 |
The CLI documents its exit status. It is 0 when the operation completed, with partial evidence or open questions allowed. It is 1 when it could not complete, and 128 + N when signal N ended the process. Three commands exited 1 in the capture. They are inspect-binary-layout on a Mach-O file, evidence-import on a bundle from rea 6.5.0, and one setup dry run. An explicit --provider wins over REA_ANALYSIS_PROVIDER, and with neither set rea uses the single available provider that supports the target.
MCP methods and tools
| Name | Answers | Hints | CLI command | Recorded output | Section |
|---|---|---|---|---|---|
initialize | the negotiated protocol version, the server capabilities, serverInfo, and the instruction string | method | output | 8.1 | |
tools/list | all 207 tools with schemas and annotations | method | output | 8.1 | |
open_binary | the opened target: path, format, kind, SHA-256, architecture, with the provider bound and not started | open world | none | output, output | 4.1 |
binary_session | the current target, binding, run id, tool availability, client features, and server identity | open world | none | output | 8.1 |
list_procedures | every analyzed procedure as address and name, with thunk and external flags | none | output | 4.2 | |
procedure_assembly | the assembly of one procedure as one string | none | output | 4.3 | |
xrefs | the addresses that reference one address | rea xrefs | output | 4.4 | |
list_strings | every defined string with encoding, termination, and byte length | none | output | 4.5 | |
analyze_function | the dossier of one procedure | rea function | output, output, output, output, output, output, output | 4.6 | |
export_evidence_bundle | the path, byte count, record count, and unknown count of the bundle it wrote | destructive | none | output, output | 5.4 |
import_evidence_bundle | the records imported and the new total | none | output | 5.4 | |
compare_functions | two dossiers in eight dimensions | none | output, output | 5.5 | |
verify_reconstruction | pass, fail, or unknown for each declared claim | none | output | 7.1 | |
close_binary | null, after the provider and the ephemeral project are gone | destructive, not idempotent | none | output, output | 4.1 |
inspect_wasm_artifact | the WABT validation, sections, and interface of one WebAssembly module, as Evidence | open world | rea inspect-wasm-artifact | output | 6.2 |
The hints column reads the four annotations of each tool in tools/list: readOnlyHint, destructiveHint, idempotentHint, and openWorldHint. An empty cell means read-only false, destructive false, idempotent true, and open world false, which is the shape of most analysis tools. "None" in the CLI column means the tool is one of the 65 that have no CLI command.
Environment variables the capture set
| Variable | Effect at 6.7.0 | Documented in |
|---|---|---|
GHIDRA_INSTALL_DIR | the Ghidra installation, an absolute path | |
JAVA_HOME | the JDK, an absolute path | |
REA_GHIDRA_STARTUP_TIMEOUT_MS | the startup deadline, 330,000 ms by default | |
REA_ANALYSIS_PROVIDER | the standing provider choice that --provider and provider_id override | |
REA_MCP_INPUT_SCHEMA_PROFILE | compact renders every advertised input schema within 13,312 bytes | |
REA_MCP_MAX_RESPONSE_BYTES | the response budget, at least 10,485,760, read at startup | |
REA_WABT_BIN_DIRECTORY | the absolute directory that holds wasm-validate, wasm-objdump, and wasm2wat from WABT 1.0.42 | rea docs/wasm-artifacts.md, Offline WebAssembly artifacts |
HOME and CLAUDE_CONFIG_DIR | for the setup runs only, a private work directory, so setup found and wrote only the copied test file |
The capture kit also removed PWD and JAVA_TOOL_OPTIONS from the environment of every rea process (the capture). The paths in the records and the Java launch then stayed the same from run to run.
The kit did not set REA_KUNA_COMMAND, the absolute path of a kuna executable that you supply. Without it the Kuna provider reports not_configured (Section 2.3).
rea (rea-agents) with the Ghidra provider rea-agents 6.7.0, Ghidra 12.1.4 · 27dc42d · 2026-10-18 · Edition 2026.10