Introduction¶

DeepSeek Harness (DSH) extends its capabilities through a plugin mechanism and supports connecting upstream MCP services to a session. In security research and binary analysis scenarios, REA (Reverse Engineer Anything) is a commonly used toolset. Configuring REA’s MCP service directly in DSH can be cumbersome. The dsh-plugin-rea plugin injects configuration to register the local REA MCP service as mcp__rea__* tools, allowing them to be called directly within DSH workflows.

What Is This¶

This is a configuration-driven Cordis plugin package. Its package.json declares dsh.bundle.patch, and a patch file injects one line of official MCP client configuration into DSH. This configuration points to the locally installed REA MCP server (stdio mode).

The plugin does not contain any analysis code and does not maintain REA’s upstream logic. It only registers REA’s tools into DSH sessions and handles environment isolation (keeping the analysis engine’s environment variables inside the MCP child process rather than the entire Harness).

Core Features¶

The plugin registers 170+ tools, with the main capabilities as follows:

• Tool registration: Provides tools under the mcp__rea__* namespace in DSH sessions.
• Native binary analysis: Supports using Ghidra for pseudo-code and assembly analysis.
• Android analysis: Supports decompiled method analysis for APKs.
• JS/Electron analysis: Supports analysis of JavaScript modules and their dependency relationships.
• .NET analysis: Supports analysis of .NET assemblies.
• Firmware analysis: Supports firmware-level analysis capabilities.
• Configuration only: Contains only adapter configuration and no analysis code.

Installation and Enablement¶

Before installing, make sure your environment already has REA’s dependencies (such as Ghidra).

1. Ensure the REA CLI (such as rea-agents) is installed.
2. Run the installation command:

dsh plugin --profile <profile> add github:czcdr/dsh-plugin-rea

After installation, the plugin automatically registers REA’s MCP tools into the current profile’s session.

Typical Usage¶

After enabling the plugin, you can call REA tools directly in a DSH session.

1. Check session status: Request an mcp__rea__* call, for example binary_session. This returns the REA engine’s check results (configuration / installation / headless / native_decompiler / java); all statuses should show as ok: true.
2. Open a file: Use open_binary to specify the path of the file to analyze (for example, a PE file).
3. View results: Use binary_overview to view the file overview, and use procedure_pseudo_code to view the decompiled pseudo-code.

Configuring environment variables:
REA reads the GHIDRA_INSTALL_DIR environment variable by default. To avoid leaking machine-local sensitive paths into the plugin configuration, it is recommended to override it in the profile’s cordis.patch.yml:

- id: mcp-rea
  config:
    env:
      GHIDRA_INSTALL_DIR: '<your Ghidra 12.1.x directory>'

Applicable Scenarios and Caveats¶

The plugin exposes REA tools directly to DSH. When using it, note the following:

• Result limitations: Complete source code cannot be recovered. For binary files, the result is pseudo-code or assembly; for APKs, the result is decompiled methods. Results include confidence and limitation markers (such as observed / derived / inferred) and should be treated as evidence rather than original source code.
• Permissions and security: REA has 170+ tools, and the tool list expands over the course of a session. At plugin startup, failOnStartupError: false is set, meaning that REA not being installed does not block DSH from starting. However, some REA tools may start processes, write files, or access the network, so pay attention to DSH’s permission policies.
• Authorization compliance: Only analyze artifacts that you are authorized to analyze.
• Licenses: The adapter is under the MIT license, upstream REA is under the MIT license, and Ghidra is under the Apache-2.0 license.

Conclusion¶

dsh-plugin-rea solves the configuration challenge of integrating REA into DeepSeek Harness workflows. Through pure configuration, it allows DSH to directly invoke REA’s powerful reverse engineering analysis capabilities, making it suitable for scenarios requiring binary, mobile application, or firmware analysis in an agent environment.

• Plugin directory: https://www.skillhub.cn/plugins/czcdr/dsh-plugin-rea
• GitHub repository: https://github.com/czcdr/dsh-plugin-rea