{ "request": { "jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {} }, "response": { "result": { "tools": [ { "name": "annotate_native_function", "title": "Annotate Native Function", "description": "Atomically update one function name and/or entry comments, read them back, and return a refreshed complete function dossier. Ghidra changes its ephemeral session analysis database only; original executable bytes remain unchanged. Empty comment text clears that comment. Edits remain available to subsequent MCP calls until close; CLI returns the updated dossier before discarding its session. Invalid edits roll back the entire operation. Windows P0 and providers without this capability are unsupported.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_native_load_image", "title": "Inspect Native Load Image", "description": "Verify the provider's loaded DOS MZ or explicitly selected COM image against its immutable target snapshot: complete original/modified source-byte digests, header/module file mappings and memory digests, relocations and external entry. Returns measured observations and independent checks with mismatch coordinates. COM verification includes its imposed entry register context and does not claim PSP/runtime coverage. Overlay and uninitialized coverage remain explicit; other formats return unsupported. Does not execute or modify the target.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_native_data_type", "title": "Inspect Native Data Type", "description": "Inspect one recovered type by exact database category path or defined typed data address. Returns observed size, alignment, packing, fields, bitfields, enum values, and child type identities; source-level authority and flexible-tail semantics remain unknown unless substantiated.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_native_instruction", "title": "Inspect Native Instruction", "description": "Inspect one exact code or data address: decoded bytes, mnemonic, ordered operand tokens, flow, outgoing instruction references and typed incoming references where available. Incoming references preserve source, access kind, operand index and analysis provenance even at data addresses; they do not prove runtime access. Memory addressing decomposition is unavailable when the provider supplies only tokens. Data, interior instruction addresses and undecodable bytes are distinct outcomes.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "resolve_native_call_targets", "title": "Resolve Native Call Targets", "description": "Resolve one explicit static call site using typed provider call references. Preserves ambiguous targets as candidates and unresolved computed calls as unknown; does not execute code or traverse a call graph.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "address_name", "title": "Address Name", "description": "Resolve the primary analyzed name at a code or data address. Headless providers require an explicit address; GUI providers may default to their current cursor. Null means the provider has no primary name at that address.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "comment", "title": "Comment", "description": "Read the regular analysis comment at an address, defaulting to the current cursor. This is read-only and returns null when no comment exists; use set_comment to persist a finding.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "current_address", "title": "Current Address", "description": "Return Hopper's current cursor address for the selected document. Use only for interactive navigation state; prefer explicit addresses in reproducible investigations.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "current_procedure", "title": "Current Procedure", "description": "Return the analyzed procedure containing Hopper's current cursor. This uses GUI cursor state and is not a procedure-name lookup.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "current_document", "title": "Current Document", "description": "Return the document currently selected by REA's Hopper bridge.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "goto_address", "title": "Goto Address", "description": "Move Hopper's GUI cursor to a mapped address and return the observed cursor address. Interior coordinates snap to the containing analyzed object's start. Unmapped destinations fail without moving the cursor. This changes navigation state but not analysis data; use explicit-address tools for headless workflows.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inline_comment", "title": "Inline Comment", "description": "Read the inline instruction comment at an address, defaulting to the current cursor. Returns null when absent; use set_inline_comment to write one.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "list_bookmarks", "title": "List Bookmarks", "description": "List every bookmark in the selected Hopper document as address and name pairs; unnamed bookmarks retain a null name. Use bookmarks as analyst-authored navigation aids; this does not discover code references.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "list_documents", "title": "List Documents", "description": "List provider program or document identities. Hopper may expose several documents; a Ghidra headless session contains exactly its one imported Program.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "list_names", "title": "List Names", "description": "List every analyzed memory and external symbol as address/value pairs. Provider metadata distinguishes Ghidra primary, dynamic, external, type, and source facts when available.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "list_procedures", "title": "List Procedures", "description": "List every analyzed procedure as address/value pairs after provider analysis. Ghidra metadata distinguishes thunks and external functions; use returned addresses in later function operations.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "document": { "description": "The active target's provider document name; use open_binary to switch targets", "type": "string" } }, "additionalProperties": false, "examples": [ {} ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "evidence_id": { "$ref": "#/$defs/__schema0" }, "subject": { "$ref": "#/$defs/__schema1" }, "provider": { "$ref": "#/$defs/__schema6" }, "analysis_profile": { "$ref": "#/$defs/__schema7" }, "predicate_type": { "$ref": "#/$defs/__schema10" }, "operation": { "$ref": "#/$defs/__schema11" }, "parameters": { "$ref": "#/$defs/__schema9" }, "raw_result": { "$ref": "#/$defs/__schema12" }, "normalized_result": { "$ref": "#/$defs/__schema13" }, "confidence": { "$ref": "#/$defs/__schema14" }, "authority": { "$ref": "#/$defs/__schema15" }, "environment": { "$ref": "#/$defs/__schema16" }, "limitations": { "$ref": "#/$defs/__schema17" }, "relationship_coverage": { "$ref": "#/$defs/__schema18" }, "locations": { "$ref": "#/$defs/__schema30" }, "evidence_links": { "$ref": "#/$defs/__schema31" } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema1": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema2": { "type": "string", "minLength": 1 }, "__schema3": { "type": "object", "properties": { "sha256": { "$ref": "#/$defs/__schema4" } }, "required": [ "sha256" ], "additionalProperties": false }, "__schema4": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema5": { "type": "string", "pattern": "^[^\\x00]*$" }, "__schema6": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema7": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema8" }, "parameters": { "$ref": "#/$defs/__schema9" }, "digest": { "$ref": "#/$defs/__schema4" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema8": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema9": { "type": "object", "additionalProperties": {} }, "__schema10": { "type": "string", "minLength": 1 }, "__schema11": { "type": "string", "minLength": 1 }, "__schema12": { "anyOf": [ {}, { "type": "null" } ] }, "__schema13": { "type": "array", "items": { "type": "object", "properties": { "address": { "type": "string" }, "value": { "type": "string" }, "symbol": { "type": "object", "properties": { "primary": { "type": "boolean" }, "dynamic": { "type": "boolean" }, "external": { "type": "boolean" }, "type": { "type": "string" }, "source": { "type": "string", "enum": [ "default", "analysis", "ai", "imported", "user_defined" ] } }, "required": [ "primary", "dynamic", "external", "type", "source" ], "additionalProperties": false }, "procedure": { "type": "object", "properties": { "external": { "type": "boolean" }, "thunk": { "type": "boolean" }, "thunk_target": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "external", "thunk", "thunk_target" ], "additionalProperties": false }, "string": { "type": "object", "properties": { "encoding": { "type": "string" }, "termination": { "type": "string", "enum": [ "missing", "present_or_not_required" ] }, "byte_length": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "encoding", "termination", "byte_length" ], "additionalProperties": false } }, "required": [ "address", "value" ], "additionalProperties": false } }, "__schema14": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "__schema15": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "__schema16": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema17": { "type": "array", "items": { "type": "string" } }, "__schema18": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial" }, "limitations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema21" } }, "limited_directions": { "$ref": "#/$defs/__schema22" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "$ref": "#/$defs/__schema22" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema19": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema20" } }, "__schema20": { "type": "string", "minLength": 1 }, "__schema21": { "type": "string", "minLength": 1 }, "__schema22": { "anyOf": [ { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema23" } ], "items": { "$ref": "#/$defs/__schema24" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema25" } ], "items": { "$ref": "#/$defs/__schema26" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema27" }, { "$ref": "#/$defs/__schema28" } ], "items": { "$ref": "#/$defs/__schema29" }, "minItems": 2, "maxItems": 2 } ] }, "__schema23": { "type": "string", "const": "callers" }, "__schema24": { "anyOf": [ { "$ref": "#/$defs/__schema23" } ] }, "__schema25": { "type": "string", "const": "callees" }, "__schema26": { "anyOf": [ { "$ref": "#/$defs/__schema25" } ] }, "__schema27": { "type": "string", "const": "callers" }, "__schema28": { "type": "string", "const": "callees" }, "__schema29": { "anyOf": [ { "$ref": "#/$defs/__schema27" }, { "$ref": "#/$defs/__schema28" } ] }, "__schema30": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "__schema31": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "$id": "urn:rea:tool-output:sha256:a36067d5dd0aaf134c64d7563672e322c3ff188fe65d8c6edc985cfd96c0d447" } }, { "name": "list_segments", "title": "List Segments", "description": "List segments or memory blocks using exclusive end addresses. Ghidra reports block permissions, address space, image base, initialization, and overlay facts; Hopper marks unavailable permissions explicitly.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "list_strings", "title": "List Strings", "description": "List every provider-reported string object or candidate, or filter to one address, as address/value pairs with encoding, terminator status, and byte length when available. Hopper reads complete typed objects and retains its original display text as provider_value; long literals may span adjacent unterminated objects. Kuna scans mapped printable sequences of at least five characters, including unterminated fragments; references are not computed.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "document": { "description": "The active target's provider document name; use open_binary to switch targets", "type": "string" }, "address": { "type": "string", "description": "A provider-normalized address; default memory uses 0x-prefixed hexadecimal" } }, "additionalProperties": false, "examples": [ {} ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "evidence_id": { "$ref": "#/$defs/__schema0" }, "subject": { "$ref": "#/$defs/__schema1" }, "provider": { "$ref": "#/$defs/__schema6" }, "analysis_profile": { "$ref": "#/$defs/__schema7" }, "predicate_type": { "$ref": "#/$defs/__schema10" }, "operation": { "$ref": "#/$defs/__schema11" }, "parameters": { "$ref": "#/$defs/__schema9" }, "raw_result": { "$ref": "#/$defs/__schema12" }, "normalized_result": { "$ref": "#/$defs/__schema13" }, "confidence": { "$ref": "#/$defs/__schema17" }, "authority": { "$ref": "#/$defs/__schema18" }, "environment": { "$ref": "#/$defs/__schema19" }, "limitations": { "$ref": "#/$defs/__schema20" }, "relationship_coverage": { "$ref": "#/$defs/__schema21" }, "locations": { "$ref": "#/$defs/__schema33" }, "evidence_links": { "$ref": "#/$defs/__schema34" } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema1": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema2": { "type": "string", "minLength": 1 }, "__schema3": { "type": "object", "properties": { "sha256": { "$ref": "#/$defs/__schema4" } }, "required": [ "sha256" ], "additionalProperties": false }, "__schema4": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema5": { "type": "string", "pattern": "^[^\\x00]*$" }, "__schema6": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema7": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema8" }, "parameters": { "$ref": "#/$defs/__schema9" }, "digest": { "$ref": "#/$defs/__schema4" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema8": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema9": { "type": "object", "additionalProperties": {} }, "__schema10": { "type": "string", "minLength": 1 }, "__schema11": { "type": "string", "minLength": 1 }, "__schema12": { "anyOf": [ {}, { "type": "null" } ] }, "__schema13": { "type": "array", "items": { "type": "object", "properties": { "address": { "type": "string" }, "value": { "type": "string" }, "provider_value": { "description": "Original provider display text, which may shorten the typed object.", "$ref": "#/$defs/__schema14" }, "decoding": { "description": "When present, value retains native display text because typed bytes could not be decoded.", "$ref": "#/$defs/__schema15" }, "string": { "type": "object", "properties": { "encoding": { "type": "string", "minLength": 1 }, "encoding_status": { "description": "Whether the provider declares the encoding or REA infers it from the typed bytes and native display. This does not establish the original source's intended encoding.", "$ref": "#/$defs/__schema16" }, "termination": { "type": "string", "enum": [ "missing", "present_or_not_required" ] }, "byte_length": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "encoding", "termination", "byte_length" ], "additionalProperties": false } }, "required": [ "address", "value" ], "additionalProperties": false } }, "__schema14": { "type": "string" }, "__schema15": { "type": "object", "properties": { "available": { "type": "boolean", "const": false }, "reason": { "type": "string" } }, "required": [ "available", "reason" ], "additionalProperties": false }, "__schema16": { "type": "string", "enum": [ "observed", "inferred" ] }, "__schema17": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "__schema18": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "__schema19": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema20": { "type": "array", "items": { "type": "string" } }, "__schema21": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete" }, "diagnostics": { "$ref": "#/$defs/__schema22" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial" }, "limitations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema24" } }, "limited_directions": { "$ref": "#/$defs/__schema25" }, "diagnostics": { "$ref": "#/$defs/__schema22" } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "$ref": "#/$defs/__schema25" }, "diagnostics": { "$ref": "#/$defs/__schema22" } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema22": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema23" } }, "__schema23": { "type": "string", "minLength": 1 }, "__schema24": { "type": "string", "minLength": 1 }, "__schema25": { "anyOf": [ { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema26" } ], "items": { "$ref": "#/$defs/__schema27" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema28" } ], "items": { "$ref": "#/$defs/__schema29" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema30" }, { "$ref": "#/$defs/__schema31" } ], "items": { "$ref": "#/$defs/__schema32" }, "minItems": 2, "maxItems": 2 } ] }, "__schema26": { "type": "string", "const": "callers" }, "__schema27": { "anyOf": [ { "$ref": "#/$defs/__schema26" } ] }, "__schema28": { "type": "string", "const": "callees" }, "__schema29": { "anyOf": [ { "$ref": "#/$defs/__schema28" } ] }, "__schema30": { "type": "string", "const": "callers" }, "__schema31": { "type": "string", "const": "callees" }, "__schema32": { "anyOf": [ { "$ref": "#/$defs/__schema30" }, { "$ref": "#/$defs/__schema31" } ] }, "__schema33": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "__schema34": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "$id": "urn:rea:tool-output:sha256:19b6b7d573c731198f840701a9a5779a253e2cf722a15ec3a19f20547aa9ffd9" } }, { "name": "next_address", "title": "Next Address", "description": "Return the next analyzed object address after an explicit address or current cursor. This is a navigation primitive, not instruction-flow or CFG analysis.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "prev_address", "title": "Prev Address", "description": "Return the previous analyzed object start before an explicit address or current cursor. This is a navigation primitive and may fail at document boundaries; data objects and instructions remain distinct from control flow.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "procedure_address", "title": "Procedure Address", "description": "Resolve an unambiguous procedure symbol name or provider-normalized address to its canonical entry address. External address spaces remain explicit.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "procedure_assembly", "title": "Procedure Assembly", "description": "Return assembly for one analyzed procedure identified by symbol or hexadecimal address. Use when pseudocode loses calling-convention or instruction-level detail; output is currently returned as one unpaginated string. Ghidra terminal-call assumptions that may cut the analyzed body are reported in Evidence limitations.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "procedure": { "type": "string", "description": "The procedure name or address" }, "document": { "description": "The active target's provider document name; use open_binary to switch targets", "type": "string" } }, "required": [ "procedure" ], "additionalProperties": false, "examples": [ { "procedure": "main" } ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "evidence_id": { "$ref": "#/$defs/__schema0" }, "subject": { "$ref": "#/$defs/__schema1" }, "provider": { "$ref": "#/$defs/__schema6" }, "analysis_profile": { "$ref": "#/$defs/__schema7" }, "predicate_type": { "$ref": "#/$defs/__schema10" }, "operation": { "$ref": "#/$defs/__schema11" }, "parameters": { "$ref": "#/$defs/__schema9" }, "raw_result": { "$ref": "#/$defs/__schema12" }, "normalized_result": { "$ref": "#/$defs/__schema13" }, "confidence": { "$ref": "#/$defs/__schema14" }, "authority": { "$ref": "#/$defs/__schema15" }, "environment": { "$ref": "#/$defs/__schema16" }, "limitations": { "$ref": "#/$defs/__schema17" }, "relationship_coverage": { "$ref": "#/$defs/__schema18" }, "locations": { "$ref": "#/$defs/__schema30" }, "evidence_links": { "$ref": "#/$defs/__schema31" } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema1": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema2": { "type": "string", "minLength": 1 }, "__schema3": { "type": "object", "properties": { "sha256": { "$ref": "#/$defs/__schema4" } }, "required": [ "sha256" ], "additionalProperties": false }, "__schema4": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema5": { "type": "string", "pattern": "^[^\\x00]*$" }, "__schema6": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema7": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema8" }, "parameters": { "$ref": "#/$defs/__schema9" }, "digest": { "$ref": "#/$defs/__schema4" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema8": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema9": { "type": "object", "additionalProperties": {} }, "__schema10": { "type": "string", "minLength": 1 }, "__schema11": { "type": "string", "minLength": 1 }, "__schema12": { "anyOf": [ {}, { "type": "null" } ] }, "__schema13": { "type": "string" }, "__schema14": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "__schema15": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "__schema16": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema17": { "type": "array", "items": { "type": "string" } }, "__schema18": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial" }, "limitations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema21" } }, "limited_directions": { "$ref": "#/$defs/__schema22" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "$ref": "#/$defs/__schema22" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema19": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema20" } }, "__schema20": { "type": "string", "minLength": 1 }, "__schema21": { "type": "string", "minLength": 1 }, "__schema22": { "anyOf": [ { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema23" } ], "items": { "$ref": "#/$defs/__schema24" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema25" } ], "items": { "$ref": "#/$defs/__schema26" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema27" }, { "$ref": "#/$defs/__schema28" } ], "items": { "$ref": "#/$defs/__schema29" }, "minItems": 2, "maxItems": 2 } ] }, "__schema23": { "type": "string", "const": "callers" }, "__schema24": { "anyOf": [ { "$ref": "#/$defs/__schema23" } ] }, "__schema25": { "type": "string", "const": "callees" }, "__schema26": { "anyOf": [ { "$ref": "#/$defs/__schema25" } ] }, "__schema27": { "type": "string", "const": "callers" }, "__schema28": { "type": "string", "const": "callees" }, "__schema29": { "anyOf": [ { "$ref": "#/$defs/__schema27" }, { "$ref": "#/$defs/__schema28" } ] }, "__schema30": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "__schema31": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "$id": "urn:rea:tool-output:sha256:bf436034ad884fe02b996273e4346eefe76da80f9f52e5ce35173517317ef115" } }, { "name": "procedure_callees", "title": "Procedure Callees", "description": "Return the provider's resolved direct callees for one procedure identified by symbol or address. Unresolved indirect calls may be absent; use analyze_function and typed references to preserve available edge uncertainty. Ghidra terminal-call assumptions that may cut the analyzed body are reported in Evidence limitations.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "procedure_callers", "title": "Procedure Callers", "description": "Return the provider's resolved direct callers for one procedure identified by symbol or address. Results reflect completed static analysis and may omit unresolved indirect references. Ghidra terminal-call assumptions that may cut the analyzed body are reported in Evidence limitations.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "procedure_info", "title": "Procedure Info", "description": "Return provider metadata for one procedure identified by symbol or address: entrypoint, signature, locals, size, block count, and complete inclusive body ranges when observed. Extents reflect the provider's analyzed body; Ghidra terminal-call assumptions that may cut it are reported in Evidence limitations. Hopper locals preserve observed names and signed stack displacements; source types remain unknown. Body byte count and enclosing span remain distinct; unavailable extent is explicit.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "read_function_instructions", "title": "Read Function Instructions", "description": "Return every raw instruction for one analyzed procedure. Instruction text and body extent are provider-specific. Ghidra terminal-call assumptions that may cut the analyzed body are reported in limitations.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "search_bytes", "title": "Search Bytes", "description": "Find masked byte signatures in initialized analyzed memory. Hex byte pairs and ?? wildcards are supported; an optional equal-length hex mask selects bits. Bounds are inclusive. Matches are ordered by provider address and never span blocks. Coverage describes this page; reuse the same query with next_cursor to continue. Uninitialized blocks are listed separately. Ghidra only; Hopper is unavailable.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "read_bytes", "title": "Read Bytes", "description": "Read analyzed bytes from one provider-normalized virtual address. The hexadecimal payload reports the exact returned length; incomplete reads remain explicit and unsupported provider APIs return typed capability unavailability.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "address_to_file_offset", "title": "Address To File Offset", "description": "Map one provider-normalized virtual address to its original nonnegative file offset. Hopper verifies the original bytes against the selected executable digest and translates FAT image-relative offsets using the loaded header. Results preserve the provider coordinate, image base, and source path. Unmapped addresses fail explicitly; changed or unavailable sources return typed errors retaining native mapping facts as partial evidence.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "procedure_references", "title": "Procedure References", "description": "Return every raw incoming or outgoing reference edge for one procedure. Endpoint procedures are resolved only from provider containment. Ghidra preserves detailed reference flags. Hopper preserves native CallReference classifications and exact endpoints while leaving unavailable detailed flags explicit.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "procedure_pseudo_code", "title": "Procedure Pseudo Code", "description": "Decompile one analyzed procedure by symbol name or provider-normalized address. Ghidra also accepts file-offset:0x... selectors and falls back to a unique source-file mapping when a 0x-prefixed number resolves to no procedure; existing analysis addresses take precedence and ambiguous mappings fail explicitly. Returns provider-specific pseudocode, never original source or cross-provider text equivalence, and may return null; request procedure_assembly when instruction precision matters. Ghidra no-return assumptions may cut the analyzed body; Evidence limitations report observed terminal calls and available callee identities.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "resolve_containing_procedure", "title": "Resolve Containing Procedure", "description": "Resolve an arbitrary address, including an interior instruction or exact external entry, to its provider-analyzed containing procedure. A negative result distinguishes outside segments from not in a procedure and is never guessed from nearby symbols.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "search_procedures", "title": "Search Procedures", "description": "Search every analyzed procedure name using literal matching by default or regex when requested. Results are deterministic and complete. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker; a matching deadline leaves its API usable.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "search_strings", "title": "Search Strings", "description": "Search every provider-reported string object or candidate using literal matching by default or regex when requested. Results are deterministic and complete over that provider inventory, not every text sequence in artifact bytes. Kuna scans mapped sequences of at least five characters, including unterminated fragments, without computing references. Ghidra may omit packed or undefined literals, including Rust strings; an empty result does not prove text is absent. If an address is known, read_bytes and xrefs inspect its bytes and references. Hopper retains typed byte decoding, native display, and explicit decoding unknowns. Adjacent long-literal fragments match independently. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker; a matching deadline leaves its API usable.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "set_address_name", "title": "Set Address Name", "description": "Assign an analyst name to one mapped hexadecimal address and report whether the native edit succeeded and exact readback matched. Hopper rejects symbol names exceeding 1024 UTF-16 code units before mutation, and rejects names owned by another address; use set_addresses_names to explicitly move or swap labels among selected addresses. This mutates analysis metadata.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "set_addresses_names", "title": "Set Addresses Names", "description": "Assign analyst names to multiple mapped addresses in one call and return per-address edit/readback success booleans. Hopper validates mapped destinations, native string representations, its 1024 UTF-16 code-unit symbol-name limit, and unique destinations/names before applying edits. Existing labels may move or swap only among explicitly selected addresses; unselected label owners remain unchanged. This mutates analysis metadata; verify failures individually.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "set_bookmark", "title": "Set Bookmark", "description": "Create or replace a bookmark at a mapped hexadecimal address and report success. This mutates navigation metadata; bookmarks are analyst-authored navigation aids, not binary evidence.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "set_comment", "title": "Set Comment", "description": "Write a regular analysis comment at a hexadecimal address and return whether readback matched. An empty comment clears it. This mutates the Hopper document; use comments to record evidence IDs or reasoning.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "set_inline_comment", "title": "Set Inline Comment", "description": "Write an inline instruction comment at a hexadecimal address and return whether readback matched. An empty comment clears it; Hopper may flatten newlines, producing false on exact readback. This mutates analysis metadata.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "unset_bookmark", "title": "Unset Bookmark", "description": "Remove the bookmark at a mapped hexadecimal address and return whether it is absent. Hopper also permits removing an existing legacy bookmark outside mapped memory. This mutates navigation metadata and does not alter binary bytes.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "xrefs", "title": "Xrefs", "description": "Return analyzed references to a code or data address. Hopper may default to its current cursor; headless providers such as Ghidra require an explicit address. Use to connect strings, globals, selectors, and functions; bare addresses are untyped and indirect references may be incomplete. Use inspect_native_instruction at the target address for typed incoming references where supported.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "document": { "description": "The active target's provider document name; use open_binary to switch targets", "type": "string" }, "address": { "type": "string", "description": "A provider-normalized address; default memory uses 0x-prefixed hexadecimal" } }, "additionalProperties": false, "examples": [ {} ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "evidence_id": { "$ref": "#/$defs/__schema0" }, "subject": { "$ref": "#/$defs/__schema1" }, "provider": { "$ref": "#/$defs/__schema6" }, "analysis_profile": { "$ref": "#/$defs/__schema7" }, "predicate_type": { "$ref": "#/$defs/__schema10" }, "operation": { "$ref": "#/$defs/__schema11" }, "parameters": { "$ref": "#/$defs/__schema9" }, "raw_result": { "$ref": "#/$defs/__schema12" }, "normalized_result": { "$ref": "#/$defs/__schema13" }, "confidence": { "$ref": "#/$defs/__schema14" }, "authority": { "$ref": "#/$defs/__schema15" }, "environment": { "$ref": "#/$defs/__schema16" }, "limitations": { "$ref": "#/$defs/__schema17" }, "relationship_coverage": { "$ref": "#/$defs/__schema18" }, "locations": { "$ref": "#/$defs/__schema30" }, "evidence_links": { "$ref": "#/$defs/__schema31" } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema1": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema2": { "type": "string", "minLength": 1 }, "__schema3": { "type": "object", "properties": { "sha256": { "$ref": "#/$defs/__schema4" } }, "required": [ "sha256" ], "additionalProperties": false }, "__schema4": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema5": { "type": "string", "pattern": "^[^\\x00]*$" }, "__schema6": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema7": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema8" }, "parameters": { "$ref": "#/$defs/__schema9" }, "digest": { "$ref": "#/$defs/__schema4" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema8": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema9": { "type": "object", "additionalProperties": {} }, "__schema10": { "type": "string", "minLength": 1 }, "__schema11": { "type": "string", "minLength": 1 }, "__schema12": { "anyOf": [ {}, { "type": "null" } ] }, "__schema13": { "type": "array", "items": { "type": "string" } }, "__schema14": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "__schema15": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "__schema16": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema17": { "type": "array", "items": { "type": "string" } }, "__schema18": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial" }, "limitations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema21" } }, "limited_directions": { "$ref": "#/$defs/__schema22" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "$ref": "#/$defs/__schema22" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema19": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema20" } }, "__schema20": { "type": "string", "minLength": 1 }, "__schema21": { "type": "string", "minLength": 1 }, "__schema22": { "anyOf": [ { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema23" } ], "items": { "$ref": "#/$defs/__schema24" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema25" } ], "items": { "$ref": "#/$defs/__schema26" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema27" }, { "$ref": "#/$defs/__schema28" } ], "items": { "$ref": "#/$defs/__schema29" }, "minItems": 2, "maxItems": 2 } ] }, "__schema23": { "type": "string", "const": "callers" }, "__schema24": { "anyOf": [ { "$ref": "#/$defs/__schema23" } ] }, "__schema25": { "type": "string", "const": "callees" }, "__schema26": { "anyOf": [ { "$ref": "#/$defs/__schema25" } ] }, "__schema27": { "type": "string", "const": "callers" }, "__schema28": { "type": "string", "const": "callees" }, "__schema29": { "anyOf": [ { "$ref": "#/$defs/__schema27" }, { "$ref": "#/$defs/__schema28" } ] }, "__schema30": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "__schema31": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "$id": "urn:rea:tool-output:sha256:03b7578ff975b43dacabdb7c4db081769358d354bcad91aaa8b9960a0b1d4f5f" } }, { "name": "trace_native_values", "title": "Trace Native Values", "description": "Trace a bounded static dependency graph from one explicit native procedure. Includes high-p-code def-use, constants, operators, memory and branch operations, resolved call edges, and derived argument/parameter and return/output bindings. Missing bindings, alias semantics, persistent state and RNG roles remain unknown. Budgets bound depth, decompilations, graph size and payloads; nodes are paginated.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_native_dispatch_metadata", "title": "Inspect Native Dispatch Metadata", "description": "Inspect the bound provider's name inventory for Objective-C class/method symbols and Swift mangled symbols, returning at most max_records decoded names. Includes target SHA-256 when available, provider identity/version, analysis-profile digest, facet coverage, and per-record Evidence. This is symbol-level evidence, not runtime metadata: ivar layouts, protocol conformances, witness/class tables, and relative pointers are explicitly marked unsupported unless a provider supplies those decoders. The provider controls how its name inventory is acquired.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "get_objc_classes", "title": "Get Objc Classes", "description": "Discover and deduplicate Objective-C class labels, optionally filtering by literal substring.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "get_objc_protocols", "title": "Get Objc Protocols", "description": "Discover and deduplicate Objective-C and Swift protocol labels.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "batch_decompile", "title": "Batch Decompile", "description": "Decompile each explicit procedure symbol or address concurrently. Preserves each input selector in address and reports the observed canonical entry and entry label in procedure; identity or label failures remain explicit without discarding usable pseudocode. Returns ordered per-item success or error results and aggregate counts.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "get_call_graph", "title": "Get Call Graph", "description": "Resolve one symbol or address to its canonical procedure entry, then traverse the bound provider's caller or callee relationships until the reachable graph is exhausted. Every node uses a canonical address and has an ok/error status; failures use safe typed projections. Unresolved indirect calls may be missing and results are not a whole-program CFG.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "analyze_swift_types", "title": "Analyze Swift Types", "description": "Categorize analyzed Swift procedure names using their manglings or same-address Swift symbol aliases. Decodes legacy and literal modern nominal contexts into classes, structs, enums, protocols, and extensions. Preserves provider names and supporting mangled_names; unresolved categories appear in other and in unclassified, which remains inline even under category filters. Returns deduplicated procedure-name counts, not unique source types, plus identification limitations. Optionally select one category and/or apply a case-sensitive literal filter to provider names or supporting manglings; for example, use {category: \"structs\", pattern: \"Pair\"}.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "find_xrefs_to_name", "title": "Find Xrefs To Name", "description": "Resolve an exact name against the bound provider's name inventory and return a resolved or unresolved result. Unresolved names use the stable name_not_found reason; this xref workflow returns address-only projections.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "binary_overview", "title": "Binary Overview", "description": "Return the bound document and exhaustive procedure/string counts, plus every segment and segment_count when the provider supports segment enumeration. If segment fields are omitted, segment coverage is unavailable rather than empty. When every observed segment agrees on an analysis image base, return it as image_base so callers can relate provider addresses to their loader coordinates. Use search_procedures, list_procedures, or analyze_function directly when you already know which procedure to inspect.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "analyze_function", "title": "Analyze Function", "description": "Build a dossier for one native function identified by symbol or provider-returned address. Returns identity with complete inclusive analyzed body ranges or explicit unknown, provider-specific pseudocode and assembly, comments, calls, references, referenced strings/names, local CFG blocks, and available native API boundary observations. Ghidra terminal-call assumptions that may cut the analyzed body are reported in limitations with available callee identities.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "procedure": { "type": "string", "description": "A procedure name or address" } }, "required": [ "procedure" ], "additionalProperties": false, "examples": [ { "procedure": "main" } ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "evidence_id": { "$ref": "#/$defs/__schema0" }, "subject": { "$ref": "#/$defs/__schema1" }, "provider": { "$ref": "#/$defs/__schema6" }, "analysis_profile": { "$ref": "#/$defs/__schema7" }, "predicate_type": { "$ref": "#/$defs/__schema10" }, "operation": { "$ref": "#/$defs/__schema11" }, "parameters": { "$ref": "#/$defs/__schema9" }, "raw_result": { "$ref": "#/$defs/__schema12" }, "normalized_result": { "$ref": "#/$defs/__schema13" }, "confidence": { "$ref": "#/$defs/__schema55" }, "authority": { "$ref": "#/$defs/__schema56" }, "environment": { "$ref": "#/$defs/__schema57" }, "limitations": { "$ref": "#/$defs/__schema58" }, "relationship_coverage": { "$ref": "#/$defs/__schema59" }, "locations": { "$ref": "#/$defs/__schema71" }, "evidence_links": { "$ref": "#/$defs/__schema72" } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema1": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema2": { "type": "string", "minLength": 1 }, "__schema3": { "type": "object", "properties": { "sha256": { "$ref": "#/$defs/__schema4" } }, "required": [ "sha256" ], "additionalProperties": false }, "__schema4": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema5": { "type": "string", "pattern": "^[^\\x00]*$" }, "__schema6": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema7": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema8" }, "parameters": { "$ref": "#/$defs/__schema9" }, "digest": { "$ref": "#/$defs/__schema4" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema8": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema9": { "type": "object", "additionalProperties": {} }, "__schema10": { "type": "string", "minLength": 1 }, "__schema11": { "type": "string", "minLength": 1 }, "__schema12": { "anyOf": [ {}, { "type": "null" } ] }, "__schema13": { "type": "object", "properties": { "procedure": { "type": "object", "properties": { "address": { "$ref": "#/$defs/__schema14" }, "name": { "$ref": "#/$defs/__schema15" }, "classification": { "$ref": "#/$defs/__schema16" }, "body": { "$ref": "#/$defs/__schema17" }, "signature": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "locals": { "type": "array", "items": { "type": "object", "properties": { "description": { "type": "string" }, "provenance": { "type": "string", "minLength": 1 }, "name": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "stack_displacement": { "description": "Observed signed stack byte displacement, encoded as decimal to preserve precision.", "$ref": "#/$defs/__schema26" } }, "required": [ "description", "provenance" ], "additionalProperties": false } } }, "required": [ "address", "name", "classification", "body", "signature", "locals" ], "additionalProperties": false }, "pseudocode": { "type": "string" }, "assembly": { "type": "array", "items": { "type": "string" } }, "comments": { "type": "array", "items": { "type": "object", "properties": { "address": { "type": "string" }, "kind": { "type": "string", "enum": [ "comment", "inline" ] }, "text": { "type": "string" } }, "required": [ "address", "kind", "text" ], "additionalProperties": false } }, "callers": { "type": "array", "items": { "$ref": "#/$defs/__schema27" } }, "callees": { "type": "array", "items": { "$ref": "#/$defs/__schema27" } }, "incoming_references": { "type": "array", "items": { "$ref": "#/$defs/__schema28" } }, "outgoing_references": { "type": "array", "items": { "$ref": "#/$defs/__schema28" } }, "unresolved_calls": { "type": "array", "items": { "type": "object", "properties": { "address": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "address", "reason" ], "additionalProperties": false } }, "referenced_strings": { "type": "array", "items": { "type": "object", "properties": { "address": { "type": "string" }, "value": { "type": "string" }, "provider_value": { "description": "Original provider display text, which may shorten the typed object.", "$ref": "#/$defs/__schema29" }, "decoding": { "description": "When present, value retains native display text because typed bytes could not be decoded.", "$ref": "#/$defs/__schema18" }, "string": { "type": "object", "properties": { "encoding": { "type": "string", "minLength": 1 }, "encoding_status": { "description": "Whether the provider declares the encoding or REA infers it from the typed bytes and native display. This does not establish the original source's intended encoding.", "$ref": "#/$defs/__schema30" }, "termination": { "type": "string", "enum": [ "missing", "present_or_not_required" ] }, "byte_length": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "encoding", "termination", "byte_length" ], "additionalProperties": false }, "source_address": { "type": "string" } }, "required": [ "address", "value", "source_address" ], "additionalProperties": false } }, "referenced_names": { "type": "array", "items": { "type": "object", "properties": { "address": { "type": "string" }, "value": { "type": "string" }, "source_address": { "type": "string" } }, "required": [ "address", "value", "source_address" ], "additionalProperties": false } }, "swift_string_literals": { "description": "Swift String literals decoded from constant register values. Absent when the provider does not decode them for this target.", "$ref": "#/$defs/__schema31" }, "swift_string_literal_omissions": { "description": "Literal candidates omitted for capacity or unresolved control flow. Present exactly when swift_string_literals is present; empty when all examined use sites were classified.", "$ref": "#/$defs/__schema42" }, "basic_blocks": { "type": "array", "items": { "type": "object", "properties": { "start": { "type": "string" }, "end": { "type": "string" }, "successors": { "type": "array", "items": { "type": "string" } } }, "required": [ "start", "end", "successors" ], "additionalProperties": false } }, "native_api": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "available": { "type": "boolean", "const": false }, "reason": { "type": "string", "minLength": 1 }, "residual_unknowns": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema45" } } }, "required": [ "available", "reason", "residual_unknowns" ], "additionalProperties": false }, { "type": "object", "properties": { "available": { "type": "boolean", "const": true }, "provenance": { "type": "string", "minLength": 1 }, "signature_source": { "type": "string", "minLength": 1 }, "calling_convention": { "type": "string", "minLength": 1 }, "return_type": { "type": "object", "properties": { "ordinal": { "type": "null" }, "name": { "type": "null" }, "data_type": { "$ref": "#/$defs/__schema46" }, "size_bytes": { "$ref": "#/$defs/__schema47" }, "storage": { "$ref": "#/$defs/__schema48" }, "confidence": { "$ref": "#/$defs/__schema49" }, "evidence": { "$ref": "#/$defs/__schema50" }, "decompiler_artifacts": { "$ref": "#/$defs/__schema52" }, "role": { "type": "string", "const": "return" } }, "required": [ "ordinal", "name", "data_type", "size_bytes", "storage", "confidence", "evidence", "decompiler_artifacts", "role" ], "additionalProperties": false }, "parameters": { "type": "array", "items": { "type": "object", "properties": { "ordinal": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "name": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ] }, "data_type": { "$ref": "#/$defs/__schema46" }, "size_bytes": { "$ref": "#/$defs/__schema47" }, "storage": { "$ref": "#/$defs/__schema48" }, "confidence": { "$ref": "#/$defs/__schema49" }, "evidence": { "$ref": "#/$defs/__schema50" }, "decompiler_artifacts": { "$ref": "#/$defs/__schema52" }, "role": { "type": "string", "const": "parameter" } }, "required": [ "ordinal", "name", "data_type", "size_bytes", "storage", "confidence", "evidence", "decompiler_artifacts", "role" ], "additionalProperties": false } }, "jump_tables": { "type": "array", "items": { "type": "object", "properties": { "dispatch_address": { "type": "string", "minLength": 1 }, "data_sources": { "type": "array", "items": { "type": "object", "properties": { "address": { "type": "string", "minLength": 1 }, "provenance": { "type": "string", "enum": [ "ghidra-decompiler-load-table", "ghidra-dispatch-block-data-reference", "ghidra-aarch64-byte-table", "ghidra-aarch64-halfword-table" ] }, "entry_size_bytes": { "anyOf": [ { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, { "type": "null" } ] }, "entry_count": { "anyOf": [ { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, { "type": "null" } ] }, "confidence": { "$ref": "#/$defs/__schema49" }, "evidence": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema51" } } }, "required": [ "address", "provenance", "entry_size_bytes", "entry_count", "confidence", "evidence" ], "additionalProperties": false } }, "mappings": { "type": "array", "items": { "type": "object", "properties": { "case_value": { "anyOf": [ { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, { "type": "null" } ] }, "target_address": { "type": "string", "minLength": 1 }, "confidence": { "$ref": "#/$defs/__schema49" }, "evidence": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema51" } } }, "required": [ "case_value", "target_address", "confidence", "evidence" ], "additionalProperties": false } }, "default_targets": { "type": "array", "items": { "type": "object", "properties": { "target_address": { "type": "string", "minLength": 1 }, "confidence": { "$ref": "#/$defs/__schema49" }, "evidence": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema51" } } }, "required": [ "target_address", "confidence", "evidence" ], "additionalProperties": false } }, "limitations": { "type": "array", "items": { "type": "string" } } }, "required": [ "dispatch_address", "data_sources", "mappings", "default_targets", "limitations" ], "additionalProperties": false } }, "pseudocode": { "type": "object", "properties": { "classification": { "type": "string", "const": "decompiler-generated-non-source" }, "compilable": { "type": "boolean", "const": false } }, "required": [ "classification", "compilable" ], "additionalProperties": false }, "decompiler_artifacts": { "type": "array", "items": { "type": "string", "enum": [ "recovered-signature", "register-and-stack-variables", "compiler-generated-control-flow", "pointer-arithmetic", "pseudocode" ] } }, "limitations": { "type": "array", "items": { "type": "string" } } }, "required": [ "available", "provenance", "signature_source", "calling_convention", "return_type", "parameters", "jump_tables", "pseudocode", "decompiler_artifacts", "limitations" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "native_value_flow": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "available": { "type": "boolean", "const": true }, "provenance": { "type": "string", "const": "ghidra-high-pcode" }, "operations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "address": { "type": "string", "minLength": 1 }, "sequence": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "opcode": { "type": "string", "minLength": 1 }, "is_dead": { "type": "boolean" }, "block_membership": { "type": "string", "enum": [ "member", "detached", "unavailable" ] }, "inputs": { "type": "array", "items": { "$ref": "#/$defs/__schema53" } }, "output": { "anyOf": [ { "$ref": "#/$defs/__schema53" }, { "type": "null" } ] } }, "required": [ "id", "address", "sequence", "opcode", "is_dead", "block_membership", "inputs", "output" ], "additionalProperties": false } }, "def_use": { "type": "array", "items": { "type": "object", "properties": { "definition": { "type": "string", "minLength": 1 }, "use": { "type": "string", "minLength": 1 }, "input_index": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "definition", "use", "input_index" ], "additionalProperties": false } }, "effects": { "type": "array", "items": { "type": "object", "properties": { "operation": { "type": "string", "minLength": 1 }, "kind": { "type": "string", "enum": [ "memory_read", "memory_write", "conditional_branch", "indirect_branch", "direct_call", "indirect_call" ] }, "operand_input": { "anyOf": [ { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, { "type": "null" } ] }, "value_input": { "anyOf": [ { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, { "type": "null" } ] } }, "required": [ "operation", "kind", "operand_input", "value_input" ], "additionalProperties": false } }, "parameters": { "type": "array", "items": { "type": "object", "properties": { "ordinal": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "name": { "type": "string" }, "data_type": { "type": "string" } }, "required": [ "ordinal", "name", "data_type" ], "additionalProperties": false } }, "parameter_uses": { "type": "array", "items": { "type": "object", "properties": { "ordinal": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "use": { "type": "string" }, "input_index": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "ordinal", "use", "input_index" ], "additionalProperties": false } }, "truncated": { "type": "boolean" }, "omitted_operations_lower_bound": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "known_omitted_inputs": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "known_omitted_edges": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "limitations": { "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "available", "provenance", "operations", "def_use", "effects", "parameters", "parameter_uses", "truncated", "omitted_operations_lower_bound", "known_omitted_inputs", "known_omitted_edges", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "available": { "type": "boolean", "const": false }, "reason": { "type": "string", "minLength": 1 }, "limitations": { "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "available", "reason", "limitations" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "facet_availability": { "type": "object", "properties": { "pseudocode": { "$ref": "#/$defs/__schema54" }, "assembly": { "$ref": "#/$defs/__schema54" }, "comments": { "$ref": "#/$defs/__schema54" }, "callers": { "$ref": "#/$defs/__schema54" }, "callees": { "$ref": "#/$defs/__schema54" }, "references": { "$ref": "#/$defs/__schema54" }, "strings_names": { "$ref": "#/$defs/__schema54" }, "cfg": { "$ref": "#/$defs/__schema54" } }, "additionalProperties": false }, "limitations": { "type": "array", "items": { "type": "string" } } }, "required": [ "procedure", "pseudocode", "assembly", "comments", "callers", "callees", "incoming_references", "outgoing_references", "referenced_strings", "referenced_names", "basic_blocks", "native_api", "native_value_flow", "limitations" ], "additionalProperties": false }, "__schema14": { "type": "string" }, "__schema15": { "type": "string" }, "__schema16": { "anyOf": [ { "type": "object", "properties": { "external": { "type": "boolean" }, "thunk": { "type": "boolean" }, "thunk_target": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "provenance": { "type": "string", "minLength": 1 } }, "required": [ "external", "thunk", "thunk_target", "provenance" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema17": { "oneOf": [ { "$ref": "#/$defs/__schema18" }, { "type": "object", "properties": { "available": { "$ref": "#/$defs/__schema19" }, "provenance": { "$ref": "#/$defs/__schema20" }, "ranges": { "$ref": "#/$defs/__schema21" }, "total_bytes": { "$ref": "#/$defs/__schema22" }, "span_bytes": { "$ref": "#/$defs/__schema23" }, "non_contiguous": { "$ref": "#/$defs/__schema24" }, "contains_entry": { "$ref": "#/$defs/__schema25" } }, "required": [ "available", "provenance", "ranges", "total_bytes", "span_bytes", "non_contiguous", "contains_entry" ], "additionalProperties": false } ] }, "__schema18": { "type": "object", "properties": { "available": { "type": "boolean", "const": false }, "reason": { "type": "string" } }, "required": [ "available", "reason" ], "additionalProperties": false }, "__schema19": { "type": "boolean", "const": true }, "__schema20": { "type": "string", "minLength": 1 }, "__schema21": { "type": "array", "items": { "type": "object", "properties": { "start": { "type": "string" }, "end": { "type": "string", "description": "Inclusive last address of this observed body range." } }, "required": [ "start", "end" ], "additionalProperties": false } }, "__schema22": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "__schema23": { "anyOf": [ { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, { "type": "null" } ] }, "__schema24": { "type": "boolean" }, "__schema25": { "type": "boolean" }, "__schema26": { "anyOf": [ { "type": "string", "pattern": "^-?\\d+$" }, { "type": "null" } ] }, "__schema27": { "type": "object", "properties": { "address": { "$ref": "#/$defs/__schema14" }, "name": { "$ref": "#/$defs/__schema15" }, "classification": { "$ref": "#/$defs/__schema16" }, "body": { "$ref": "#/$defs/__schema17" } }, "required": [ "address", "name", "classification", "body" ], "additionalProperties": false }, "__schema28": { "type": "object", "properties": { "source_address": { "type": "string" }, "target_address": { "type": "string" }, "source_procedure": { "anyOf": [ { "$ref": "#/$defs/__schema27" }, { "type": "null" } ] }, "target_procedure": { "anyOf": [ { "$ref": "#/$defs/__schema27" }, { "type": "null" } ] }, "kind": { "oneOf": [ { "$ref": "#/$defs/__schema18" }, { "type": "object", "properties": { "available": { "type": "boolean", "const": true }, "provenance": { "type": "string", "minLength": 1 }, "type": { "type": "string" }, "flow": { "type": "boolean" }, "call": { "type": "boolean" }, "jump": { "type": "boolean" }, "data": { "type": "boolean" }, "read": { "type": "boolean" }, "write": { "type": "boolean" }, "indirect": { "type": "boolean" }, "computed": { "type": "boolean" }, "conditional": { "type": "boolean" }, "terminal": { "type": "boolean" }, "primary": { "type": "boolean" }, "operand_index": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "external": { "type": "boolean" } }, "required": [ "available", "provenance", "type", "flow", "call", "jump", "data", "read", "write", "indirect", "computed", "conditional", "terminal", "primary", "operand_index", "external" ], "additionalProperties": false } ] }, "call": { "type": "object", "properties": { "classification": { "type": "string", "enum": [ "none", "unknown", "direct", "objective_c" ] }, "provider_type": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "provenance": { "type": "string", "minLength": 1 } }, "required": [ "classification", "provider_type", "provenance" ], "additionalProperties": false } }, "required": [ "source_address", "target_address", "source_procedure", "target_procedure", "kind" ], "additionalProperties": false }, "__schema29": { "type": "string" }, "__schema30": { "type": "string", "enum": [ "observed", "inferred" ] }, "__schema31": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "source_address": { "$ref": "#/$defs/__schema32" }, "value": { "$ref": "#/$defs/__schema33" }, "registers": { "$ref": "#/$defs/__schema34" }, "words": { "$ref": "#/$defs/__schema38" }, "representation": { "type": "string", "const": "small", "description": "The UTF-8 bytes are inside the two words." }, "address": { "type": "null", "description": "A small literal has no storage of its own." } }, "required": [ "source_address", "value", "registers", "words", "representation", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "source_address": { "$ref": "#/$defs/__schema32" }, "value": { "$ref": "#/$defs/__schema33" }, "registers": { "$ref": "#/$defs/__schema34" }, "words": { "$ref": "#/$defs/__schema38" }, "representation": { "type": "string", "const": "large", "description": "An immortal literal whose words hold its count and a pointer to its bytes." }, "address": { "type": "string", "description": "Address of a large literal's bytes." } }, "required": [ "source_address", "value", "registers", "words", "representation", "address" ], "additionalProperties": false } ] } }, "__schema32": { "type": "string", "description": "Instruction that consumes both words: a call, tail call, return, or paired store." }, "__schema33": { "type": "string", "description": "Decoded UTF-8 text, including the canonical empty string." }, "__schema34": { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema35" }, { "$ref": "#/$defs/__schema36" } ], "items": { "$ref": "#/$defs/__schema37" }, "minItems": 2, "maxItems": 2 }, "__schema35": { "type": "string" }, "__schema36": { "type": "string" }, "__schema37": { "anyOf": [ { "$ref": "#/$defs/__schema35" }, { "$ref": "#/$defs/__schema36" } ] }, "__schema38": { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema39" }, { "$ref": "#/$defs/__schema40" } ], "items": { "$ref": "#/$defs/__schema41" }, "minItems": 2, "maxItems": 2, "description": "Observed constant register values, in register order." }, "__schema39": { "type": "string" }, "__schema40": { "type": "string" }, "__schema41": { "anyOf": [ { "$ref": "#/$defs/__schema39" }, { "$ref": "#/$defs/__schema40" } ] }, "__schema42": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "source_address": { "$ref": "#/$defs/__schema32" }, "byte_length": { "$ref": "#/$defs/__schema43" }, "reason": { "$ref": "#/$defs/__schema44" }, "registers": { "$ref": "#/$defs/__schema34" }, "words": { "$ref": "#/$defs/__schema38" }, "representation": { "type": "string", "const": "small" }, "address": { "type": "null" } }, "required": [ "source_address", "byte_length", "reason", "registers", "words", "representation", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "source_address": { "$ref": "#/$defs/__schema32" }, "byte_length": { "$ref": "#/$defs/__schema43" }, "reason": { "$ref": "#/$defs/__schema44" }, "registers": { "$ref": "#/$defs/__schema34" }, "words": { "$ref": "#/$defs/__schema38" }, "representation": { "type": "string", "const": "large" }, "address": { "type": "string", "description": "Address of the literal's bytes." } }, "required": [ "source_address", "byte_length", "reason", "registers", "words", "representation", "address" ], "additionalProperties": false } ] } }, "__schema43": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "__schema44": { "type": "string", "enum": [ "capacity", "unresolved_jump" ], "description": "Why this candidate is omitted: capacity stopped decoding, or an unresolved jump left its use unknown." }, "__schema45": { "type": "string", "minLength": 1 }, "__schema46": { "type": "string", "minLength": 1 }, "__schema47": { "anyOf": [ { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, { "type": "null" } ] }, "__schema48": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "null" } ] }, "__schema49": { "type": "string", "enum": [ "low", "medium", "high" ] }, "__schema50": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema51" } }, "__schema51": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "signature-source", "decompiler-type", "type-lock", "calling-convention", "jump-table" ] }, "source": { "type": "string", "minLength": 1 }, "detail": { "type": "string", "minLength": 1 } }, "required": [ "kind", "source", "detail" ], "additionalProperties": false }, "__schema52": { "type": "array", "items": { "type": "string", "enum": [ "recovered-signature", "register-or-stack-storage", "compiler-generated-variable" ] } }, "__schema53": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "constant", "address", "register", "unique", "other" ] }, "size_bytes": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "location": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "constant_hex": { "anyOf": [ { "type": "string", "pattern": "^[0-9a-f]+$" }, { "type": "null" } ] } }, "required": [ "kind", "size_bytes", "location", "constant_hex" ], "additionalProperties": false }, "__schema54": { "oneOf": [ { "type": "object", "properties": { "available": { "type": "boolean", "const": true } }, "required": [ "available" ], "additionalProperties": false }, { "type": "object", "properties": { "available": { "type": "boolean", "const": false }, "reason": { "type": "string", "minLength": 1 } }, "required": [ "available", "reason" ], "additionalProperties": false } ] }, "__schema55": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "__schema56": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "__schema57": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema58": { "type": "array", "items": { "type": "string" } }, "__schema59": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete" }, "diagnostics": { "$ref": "#/$defs/__schema60" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial" }, "limitations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema62" } }, "limited_directions": { "$ref": "#/$defs/__schema63" }, "diagnostics": { "$ref": "#/$defs/__schema60" } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "$ref": "#/$defs/__schema63" }, "diagnostics": { "$ref": "#/$defs/__schema60" } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema60": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema61" } }, "__schema61": { "type": "string", "minLength": 1 }, "__schema62": { "type": "string", "minLength": 1 }, "__schema63": { "anyOf": [ { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema64" } ], "items": { "$ref": "#/$defs/__schema65" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema66" } ], "items": { "$ref": "#/$defs/__schema67" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema68" }, { "$ref": "#/$defs/__schema69" } ], "items": { "$ref": "#/$defs/__schema70" }, "minItems": 2, "maxItems": 2 } ] }, "__schema64": { "type": "string", "const": "callers" }, "__schema65": { "anyOf": [ { "$ref": "#/$defs/__schema64" } ] }, "__schema66": { "type": "string", "const": "callees" }, "__schema67": { "anyOf": [ { "$ref": "#/$defs/__schema66" } ] }, "__schema68": { "type": "string", "const": "callers" }, "__schema69": { "type": "string", "const": "callees" }, "__schema70": { "anyOf": [ { "$ref": "#/$defs/__schema68" }, { "$ref": "#/$defs/__schema69" } ] }, "__schema71": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "__schema72": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "$id": "urn:rea:tool-output:sha256:afeea164c031cd1b97d8cd434b2877dfabbd297df07e082f6ce0f077e772a3b7" } }, { "name": "inspect_native_api", "title": "Inspect Native Api", "description": "Analyze a native API boundary in one function identified by symbol or provider-returned address. Returns confidence, evidence, jump-table dispatch/data/case mappings, separately evidenced default targets, unsupported branches, and residual unknowns. Null case values mean unresolved cases, never a known default.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": false }, "outputSchema": "" }, { "name": "trace_feature", "title": "Trace Feature", "description": "Trace the complete literal query, preserving spaces, through every matching string and procedure, their xrefs, and truthful containing-procedure resolution. Returns observations, operation count, and residual unknowns without inferring reference kinds.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": false }, "outputSchema": "" }, { "name": "trace_call_path", "title": "Trace Call Path", "description": "Resolve start and optional goal symbols or addresses to canonical procedure entries, then trace direct callers or callees until the graph is exhausted or the goal is reached. Results use canonical addresses; Evidence preserves supplied selectors. Returns visited nodes, direct-call edges, a shortest traversal path, provider failures, and residual unknowns. A requested goal is unknown when unresolved expansions prevent proving it absent; unresolved indirect calls remain unknown.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": false }, "outputSchema": "" }, { "name": "trace_native_ui_action", "title": "Trace Native Ui Action", "description": "Trace one unique compiled UI action, object ID, native symbol or exact function address through authored connections, encoded or symbolized Objective-C handlers, and bounded static call references. Typed direct and resolved indirect calls, ambiguous candidates, inferred untyped provider callees, and targetless sites remain distinct. Runtime reachability is unknown; use trace_native_values for recovered value dependencies.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "observe_native_ui", "title": "Observe Native Ui", "description": "Observe an already-running native app by PID and window ID, bound to the active Mach-O target. Captures a bounded accessibility tree and selected-window screenshot; OS permission denial fails without broad capture or target launch.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "capture_native_ui_scenario", "title": "Capture Native Ui Scenario", "description": "Run selected-element press, increment/decrement scroll, AXValue text entry and bounded wait steps in one exact native app window. Returns ordered before/after captures and action/capture failures. Actions can change app data, network activity and persistent state; application state is left as-is and restoration is not attempted.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "observe_native_calls", "title": "Observe Native Calls", "description": "Launch the active Mach-O as an owned process under LLDB and record each entry into caller-selected functions or Objective-C methods: thread, module, symbol, load and file address, raw argument registers, selector, receiver class and optional caller frames. Every hit auto-continues. No expression is evaluated and no other process is attached. The process is killed when max_events or duration_ms is reached; exit status, captured stdout/stderr, unresolved breakpoints and limitations are returned inline. The process runs with the current user's permissions and may change files, show UI or use the network. A hardened-runtime target needs the get-task-allow entitlement.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_macho", "title": "Inspect Macho", "description": "Inspect Mach-O slices, load commands, imports, exports, dependencies, build metadata, segments, sections, permissions, and exact command provenance without launching Hopper. Large frameworks return megabytes of symbols; detail summary retains the complete Evidence and returns slice identity with per-collection counts, then page rows with inspect_analysis_view kind macho.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_signature", "title": "Inspect Signature", "description": "Inspect the active Mach-O executable's code-signing identity, hashes, authorities, requirements, entitlements, hardened-runtime state, and exact command provenance.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_plist", "title": "Inspect Plist", "description": "Parse Info.plist from the active artifact by default, or pass any local plist path. Returns normalized JSON rather than plutil text.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_architectures", "title": "List Architectures", "description": "List thin or universal Mach-O slices with offsets, sizes, alignment, explicit coverage, and native-tool provenance.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "demangle_swift", "title": "Demangle Swift", "description": "Demangle an ordered list of single-line Swift symbols without requiring Hopper. Each input returns demangled, unchanged, or invalid status.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_artifact", "title": "Inspect Artifact", "description": "Inspect an active archive or application package in one call. By default returns the complete content-addressed artifact graph once, as the typed nested inventory Evidence, with root and integrity observations, integrity contradictions, hypotheses, unexplored branches, limitations, and next probes inline. Optional detail summary retains the complete inspection and returns its derived summary view; read exact paths or inventory pages with inspect_analysis_view using parent_evidence_id. This changes delivery, not inventory coverage. Read-only DMG mounting is used automatically on supported macOS hosts. Integrity mismatches fail by default; record-and-continue keeps mismatches explicitly untrusted. It does not extract files; use extract_artifact to materialize its regular contents.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "extract_artifact", "title": "Extract Artifact", "description": "Extract all regular files from the active archive or application package into a fresh temporary directory chosen by REA. The result includes its location. Rejects traversal and symlink escapes, never overwrites, and verifies cleanup. Integrity mismatches fail by default; record-and-continue extracts the observed bytes and returns each mismatch as an explicitly untrusted integrity contradiction.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "decode_interface_builder", "title": "Decode Interface Builder", "description": "Decode compiled storyboard and nib archives inside the active Apple app bundle, including keyed property lists and NIBArchive object tables, into a bounded object, hierarchy, and connection graph. This is static archive parsing; unrecognized archive classes and unresolved code handlers remain explicit unknowns. A full app graph is often several megabytes; detail summary retains it and returns documents with node, edge and coverage counts, then page rows, optionally one document's, with inspect_analysis_view kind interface-builder.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_keyed_archive", "title": "Inspect Keyed Archive", "description": "Inspect one Foundation NSKeyedArchiver plist in the active app bundle as original object-table nodes, class descriptors, named roots, and UID edges. Preserves shared and cyclic references without instantiating classes. The path is relative to the bundle; root selection and object pagination preserve original identities.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_asset_catalog", "title": "Inspect Asset Catalog", "description": "Inspect compiled Assets.car metadata in an active Apple app bundle. Returns stable paginated catalog and rendition records with raw assetutil metadata and catalog digests; rendition bytes are not extracted.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "trace_dylib_resolution", "title": "Trace Dylib Resolution", "description": "Trace how dyld would resolve each Mach-O dylib load for the active Mach-O, or for every executable in the active .app bundle (the main app, XPC services, extensions, login items, helpers). Expands @executable_path, @loader_path, and @rpath through each process's LC_RPATH stack in dependents-first load order, and reports every candidate path with its outcome, the resolved image and digest, weak, re-export, and upward flags, and derived findings such as unresolved required loads or absent earlier @rpath candidates. Pure header parsing: nothing is executed, and absolute or system paths outside the analyzed root stay undetermined. Select roots or one architecture to narrow large bundles.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_managed_artifact", "title": "Inspect Managed Artifact", "description": "Inspect an explicit PE/CLI path, or the selected managed target, without loading or executing target code. Omitted or complete detail returns complete metadata inventories with original coverage. Select detail: \"summary\" on the first call for complete identity, PE/CLI, classification with its evidence, module/MVID, assembly, frameworks, returned-collection counts, coverage/issues and limitations. It retains complete Evidence and returns a distinct linked inspect_analysis_view summary. Page original references/resources/attributes with view kind managed and normalized_result.parent_evidence_id. Counts cover producer-returned rows; partial, unavailable or malformed metadata remains explicit and tokens remain build-local.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_managed_members", "title": "Inspect Managed Members", "description": "Inspect PE/CLI metadata members, signatures, raw CIL hashes, decoded-instruction-tuple hashes, separately reported exception regions, call edges, field-access anchors, and the #US string literals that ldstr loads, without loading or executing target code. Select type_names to decode only the members of those exact declaring types and the literals their bodies load, which keeps large assemblies such as a base class library within the representation budget. Metadata tokens are reported as build-local coordinates bound to the artifact SHA-256 and MVID; the tuple hash does not resolve them or fully commit control flow. Omitted or complete detail returns every collection, including the assembly-wide member_refs and exported_types, which type_names does not narrow. Select detail: \"summary\" for identity, metadata status, selection with unmatched names, coverage/issues, limitations and per-collection counts; it retains complete Evidence and returns a linked inspect_analysis_view summary. Page original rows with view kind managed-members, normalized_result.parent_evidence_id and collection types/exported_types/fields/methods/member_refs/call_edges/field_accesses/user_strings.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_managed_native_boundaries", "title": "Inspect Managed Native Boundaries", "description": "Inspect PE/CLI ModuleRef, ImplMap/PInvoke declarations, CLI native-header indicators, and non-IL method implementation flags without loading or executing target code. Results are managed declarations and degraded native-boundary observations, not verified native exports or addresses.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "compare_managed_members", "title": "Compare Managed Members", "description": "Compare two authenticated inspect_managed_members Evidence records using unique-only tiers: exact declared type, name, and CIL/signature; exact declared type, name, and signature (decoded or not); exact declared type, name, and decoded structural method shape; then exact CIL/signature or decoded structural method shape alone, which never takes a member whose own declared type and name remain unpaired on the other side or whose declaring type is unresolved. Signatures compare type operands by name, not by build-local metadata row. Names alone are never a matching basis; a member whose signature was not decoded, or whose same-named counterpart's was not, stays unknown rather than added or removed. Metadata tokens remain build-local coordinates bound to each artifact SHA-256 and MVID, and the tuple digest does not itself remap them.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "verify_managed_native_boundaries", "title": "Verify Managed Native Boundaries", "description": "Verify managed P/Invoke/native-boundary declarations against authenticated native export or function Evidence without executing managed code or translating managed metadata tokens into native addresses. The workflow preserves declaration-only, verified, inferred, contradicted, and unresolved states; a name candidate with missing managed or native module identity remains unresolved with its candidate evidence retained.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "import_managed_reconstruction", "title": "Import Managed Reconstruction", "description": "Import decompiler-produced managed reconstruction against authenticated inspect_managed_members Evidence. The workflow locks each method to artifact SHA-256, MVID, metadata token, signature hash, and the limited decoded-IL tuple hash, records the decompiler identity and options, and marks C# or pseudocode as analyst inference rather than canonical byte observation.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "project_managed_application_graph", "title": "Project Managed Application Graph", "description": "Project authenticated managed artifact, member, and native-boundary Evidence into the provider-neutral application graph without executing managed code, loading assemblies, or translating managed metadata tokens to native addresses. The graph preserves managed static observations as managed-specific nodes linked to source Evidence.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_with_objdump", "title": "Inspect With Objdump", "description": "Run caller-selected GNU objdump inspection against a local artifact, or request operation=architectures without a path to list BFD targets advertised by the installed binary. Preserves decoded stdout and stderr inline with SHA-256 Evidence for artifact inspections, up to a shared 16 MiB combined limit; invalid UTF-8 bytes are represented by replacement characters and flagged in Evidence limitations. output_truncated reports output beyond that limit and completion_status is unknown if buffer enforcement terminated the process. The raw output is authoritative and REA does not claim a stable normalized format. DWARF does not follow local debug links by default. Set follow_debug_links to true to follow them; identities of external debug files are not bound to Evidence. REA clears DEBUGINFOD_URLS for objdump so DWARF processing does not make debuginfod network requests. Architecture output is subjectless and does not establish support for any artifact.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "execute_rizin_command", "title": "Execute Rizin Command", "description": "Execute one caller-selected Rizin command against a local artifact using the Rizin CLI profile that suppresses user settings and scripts while retaining plugins. Preserves decoded stdout and stderr inline with SHA-256 Evidence, up to a shared 16 MiB combined limit; invalid UTF-8 bytes are represented by replacement characters and flagged in Evidence limitations. output_truncated reports output beyond that limit and completion_status is unknown if buffer enforcement terminated the process. Rizin commands and retained plugins can execute foreign code, mutate files, access the network, and read files outside the selected artifact; identities and contents of those external inputs are not bound to Evidence. Command effects depend on the Rizin command and loaded plugins; JSON is command-specific and raw output remains authoritative. In a shared MCP server, this admitted command closes any active binary-analysis session; after its effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_frida_devices", "title": "List Frida Devices", "description": "List Frida devices currently available to this host, optionally connecting to the caller-selected remote Frida endpoint. Remote authentication options are used for this call only and are never returned or recorded.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_frida_processes", "title": "List Frida Processes", "description": "List processes observed on a selected Frida device or caller-supplied remote endpoint. A remote connection is closed after discovery; authentication values are never returned or recorded.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "start_frida_session", "title": "Start Frida Session", "description": "Attach Frida to one selected process or spawn one selected target. Spawned targets remain paused until resume_frida_session, allowing scripts to load before execution. Closing a session detaches instrumentation; it does not kill the target.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "load_frida_script", "title": "Load Frida Script", "description": "Load caller-supplied JavaScript into a Frida session. Scripts can read or change target memory and behavior and can access the target process's capabilities. Messages and script errors are returned inline as Evidence; source content is not persisted.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "resume_frida_session", "title": "Resume Frida Session", "description": "Resume the process created by a paused Frida spawn session. Attached processes are already running and cannot be resumed through this operation.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "unload_frida_script", "title": "Unload Frida Script", "description": "Unload one caller-selected Frida script from a live session. This removes that script's instrumentation from the target.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "frida_session_status", "title": "Frida Session Status", "description": "Return observed Frida session state and queued script messages. Message history is bounded by the provider capture budget and reports truncation.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "close_frida_session", "title": "Close Frida Session", "description": "Unload session scripts and detach REA's Frida session. If a spawned process is still paused, resume it before detaching so it is not left suspended. REA never kills the target; its final state is reported as unknown.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "instrument_with_frida", "title": "Instrument With Frida", "description": "Run one caller-authored Frida script against an explicitly selected process and detach when the observation window ends. The CLI and MCP share this ephemeral workflow; use MCP session operations for persistent sessions. Remote authentication is used only for this call and excluded from Evidence.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_cutter_sessions", "title": "List Cutter Sessions", "description": "List live REA bridge sessions hosted by upstream Cutter instances, including observed document identity and bridge-directory security status. Discovery admits at most 256 descriptor candidates (16 MiB at the descriptor byte limit), reads and probes at most eight concurrently, and reports bridge_directory_capacity_exceeded rather than claiming no sessions when that budget is exceeded.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "cutter_command", "title": "Cutter Command", "description": "Run one arbitrary Rizin command in a selected live Cutter session. Commands may edit and persist analysis state or execute plugin-provided effects; completion uncertainty is returned as Evidence and must not be retried automatically. In a shared MCP server, this admitted command closes any active binary-analysis session; after its effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "start_gdb_session", "title": "Start Gdb Session", "description": "Start a BYO GDB process in MI3 mode when available, suppress startup files, and disable auto-loading. Persistent GDB sessions are available only on Linux, where REA can verify live inferior output descriptors through /proc before detaching; macOS descriptor verification is not implemented, and Windows Job Object cleanup can terminate debugger inferiors. Optionally set inferior_tty to a caller-selected terminal for future inferior runs; REA verifies the setting through GDB/MI before the session becomes ready. The selected terminal must remain available after GDB exits. A live inferior can be detached during close only while this durable output sink remains verified. The session persists in this REA MCP server process and receives an explicit session ID.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "gdb_console", "title": "Gdb Console", "description": "Run one unrestricted GDB CLI command through MI interpreter-exec console and return raw MI, console, target, and log records inline with Evidence. A command timeout preserves collected records with completion_status unknown and stops the owned debugger session. Commands can execute shell, alter target state, access files, and use network. Closing the debugger never implies target termination. In a shared MCP server, this admitted command closes any active binary-analysis session; after its effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "gdb_session_status", "title": "Gdb Session Status", "description": "Return the observed lifecycle state and bounded recent MI records and process diagnostics for one persistent REA GDB session; truncation and invalid-UTF-8 fields report discarded or lossy data.", "inputSchema": "", "annotations": { "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "close_gdb_session", "title": "Close Gdb Session", "description": "Close the owned GDB process after verifying the inferior state. When one live thread group has a verified durable output TTY, REA automatically detaches it, which may resume target execution; otherwise close reports that a disposition is required. REA never kills attached or remote targets as part of debugger cleanup. In a shared MCP server, this admitted close retires any active binary-analysis session; after target effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "start_rizin_debug_session", "title": "Start Rizin Debug Session", "description": "Start a persistent Rizin debugger session using `-N` to suppress user settings and scripts while retaining plugins, `-0` for NUL framing, and `-d` with an optional caller-selected IO debugger backend. Requires a caller-selected Linux TTY for inferior stdout and stderr; the target may write directly to that terminal while running and after detach. REA verifies both destinations and `dbg.exitkills=false` before detaching. Backend and target capabilities depend on the installed build. The session lives in this REA MCP process. Persistent sessions require Linux `/proc` descriptor readback. In a shared MCP server, starting this session retires any active binary-analysis session; after target effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "rizin_debug_command", "title": "Rizin Debug Command", "description": "Execute one unrestricted command in a persistent Rizin debugger session. Returns raw output inline with Evidence, including backend output interleaved before the completion marker. If the command exceeds the output or frame limit, `output_truncated` is true and `completion_status` is `unknown`; retained partial output is returned and the owned debugger session is stopped. Unsolicited frames already queued before the command make the session unavailable because correlation is ambiguous. Commands can access local files, shell, network, plugins, and target state; effects depend on the active backend and target. In a shared MCP server, this admitted command closes any active binary-analysis session; after its effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "rizin_debug_session_status", "title": "Rizin Debug Session Status", "description": "Return observed lifecycle state and bounded recent NUL-framed output and process diagnostics for one Rizin debugger session; truncation fields report discarded data, and output_invalid_utf8 reports whether invalid UTF-8 has been observed in session frame bytes; recent output may contain replacement characters.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "close_rizin_debug_session", "title": "Close Rizin Debug Session", "description": "Close the REA-owned Rizin debugger only after verifying no inferior remains or detaching one with a verified caller-selected TTY output sink. A detached target may continue running and write to that TTY; target state is otherwise reported as unknown. REA never signals an inferior based on PID or path. In a shared MCP server, this admitted close retires any active binary-analysis session; after target effects have settled, call open_binary before further analysis. Close an active Ghidra session explicitly first.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_packet_capture", "title": "Inspect Packet Capture", "description": "Inspect caller-selected fields in an existing local packet capture with TShark 4.x. Return 50 matching frames by default, with match_offset/match_limit paging and coverage counts; match_limit:null requests all remaining matches. Preserve repeated values, frame numbers, display filter, decode-as rules and pass mode in inline Evidence with source/tool identity and diagnostics. Optional packet_limit counts input packets before filtering; output paging does not shorten dissection or two-pass reassembly. Requires Linux, util-linux prlimit, and absolute REA_TSHARK_COMMAND. File-only analysis; no live capture or device communication. Missing fields or no matches do not establish absence of device traffic.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_packet_fields", "title": "Inspect Packet Fields", "description": "Discover protocols or field names/types registered in the installed TShark 4.x. kind defaults to protocols; use fields and optional exact protocol abbreviation to select field definitions. query searches name/abbreviation/description by case-insensitive literal substring. Return 50 matches by default with offset/limit paging; null requests all remaining within resource limits. Preserve type/base/bitmask/description, duplicate registrations, source line numbers, coverage, tool identity and diagnostics. Linux, REA_TSHARK_COMMAND and prlimit required. No capture file, interface or binary target needed. Registrations describe tool capabilities, not observed traffic. Each call rereads the glossary; use selected fields with inspect_packet_capture.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "decode_signal_recording", "title": "Decode Signal Recording", "description": "Decode an existing local logic/signal recording on Linux with sigrok-cli 0.7.2 and util-linux prlimit. Supply decoder stack, channels and options explicitly; optionally select input format and annotation classes. Return 50 literal output lines by default, with line_offset/line_limit paging; line_limit:null requests all remaining lines. Output windows count display lines, not annotations or samples, and do not shorten decoding. Preserve selected text, sample ranges, stderr, source/tool identity and coverage inline. Configure absolute REA_SIGROK_COMMAND. File-only analysis; no hardware acquisition or device communication. Empty output does not prove absence of traffic.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_signal_decoders", "title": "Inspect Signal Decoders", "description": "Discover installed sigrok protocol decoders or inspect one decoder's channel/option help on Linux. Omit decoder to list ID/name pairs; supply its exact ID for literal help lines with source line numbers. query is a case-insensitive literal substring. Page matches with offset/limit (default 50; null returns all remaining). Reports tool identity, version, diagnostics and examined/matching coverage. Uses configured REA_SIGROK_COMMAND and prlimit; no recording, binary target, hardware scan or acquisition. Each call probes again; decoder modules are trusted, not fully fingerprinted. Use returned IDs/options with decode_signal_recording.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_android_package", "title": "Inspect Android Package", "description": "Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts. Omitted or complete detail preserves the complete result. Select detail: \"summary\" for all declarations, engine identity and counts without decoded manifest text or duplicate raw calls; retains the complete source and returns a distinct linked inspect_analysis_view summary. Read the exact retained manifest with view kind android, facet manifest, offset and limit (UTF-16 code units), using normalized_result.parent_evidence_id. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and JDK; uses one worker in an isolated temporary workspace.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "search_android_classes", "title": "Search Android Classes", "description": "Search complete top-level decompiler class-name rows in an explicit local APK by case-sensitive substring. Empty query inventories all rows. Repeated names remain repeated and appear in duplicate_names; the provider accepts only class names for lookup, so these rows do not identify which same-name class node a later lookup selects. Retains artifact and engine identity; no APK execution.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_android_class", "title": "Inspect Android Class", "description": "Inspect one exact Android class's parsed methods, fields and inner classes, including synthetic members. Returns display signatures and exact DEX prototypes without generating source. A prototype is not a complete raw method ID; overload indices remain consistent within the artifact and engine session.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_android_method", "title": "Inspect Android Method", "description": "Decompile one Android method with smali fallback. Requires explicit overload_index when multiple methods share a name. Reports its DEX prototype, representation, fallback markers and source truncation; display signatures may be aliases.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "trace_android_references", "title": "Trace Android References", "description": "Trace incoming static using nodes to an exact Android class or selected method overload. The total counts containing nodes, not individual invoke instructions. Use inspect_android_class to choose an overload_index when names collide. Source lines and the containing node dex_offset remain unknown. direct_invokes carries exact DEX code-unit instruction offsets when available; direct_invokes_exhaustive false marks byte-bounded partial instruction evidence, and null means coverage is unknown. Using-node coverage remains separate; no runtime calls are inferred.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_jeb_client", "title": "Inspect Jeb Client", "description": "Inspect the running JEB client serving MCP: engine version, GUI or headless mode, and startup time. Does not open a target. Requires a caller-started JEB client reachable at REA_JEB_MCP_URL (default http://127.0.0.1:8425/mcp); REA never installs or launches JEB.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "open_jeb_project", "title": "Open Jeb Project", "description": "Open or create a JEB project from an artifact file or existing .jdb2 database on the engine host. Returns the project's input-file digests and top-level units. The engine analyzes the target itself; REA does not read the file or execute it. Fails when a project is already open.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_jeb_units", "title": "List Jeb Units", "description": "List project units by stable unit path and type, with optional wildcard filter, parent restriction, and pagination. The engine caps pages at 100 units; a full page reports partial coverage because more units may exist. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "decompile_jeb_item", "title": "Decompile Jeb Item", "description": "Decompile one type or method to engine pseudo-code using its decompiler (Dalvik, Java, or native). item_address comes from the engine's code item listing; unit_path defaults to the engine's first code unit and stays unknown when omitted. Read-only with respect to the target file.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_binary_layout", "title": "Inspect Binary Layout", "description": "Inspect an explicit local binary without launching it as a host process. Returns file-backed section/segment ranges, linked addresses, original symbol/REL/RELA table identities, complete encoded RELR tables and upstream-derived offsets with unknown per-word locations/addends, raw name bytes, dependency/interpreter names and static mitigation inferences inline with artifact SHA-256 Evidence. Initial profile: ELF64 x86-64 little-endian EXEC/DYN/REL on Linux x64 via caller-supplied Python with unchanged pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Runtime addresses/library paths, overall relocation inventory completeness and complete derived GOT/PLT coverage remain unknown. Zero executable entry values mean absence; relocatable entries are not applicable. Upstream can emulate PLT instructions with Unicorn for derived static maps. Uses bounded complete output and owned temporary files/processes; malformed, unsupported or oversized objects return no partial success. Select detail summary to retain the complete layout Evidence in this session and receive only its summary view, then inspect sections, symbols, mitigations or linkage with inspect_analysis_view.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_analysis_view", "title": "Inspect Analysis View", "description": "Inspect selected views of completed binary-layout, JavaScript application, native analyze_function, inspect_artifact, inventory_artifact, inspect_wasm_artifact, inspect_macho, decode_interface_builder, inspect_evm_interface, inspect_managed_artifact, inspect_managed_members, inspect_android_package, inspect_dart_aot or inspect_web_network_capture Evidence without repeating analysis. Historical capture summaries return identity and counts without bodies or archive inventories. Capture views page retained records: view {kind: \"capture\", detail: \"preview\" | \"complete\", offset: 0, limit: 20}; preview selects recorded headline fields and binary descriptors, complete returns exact records with all sidecars. Offsets follow the selected parent record order, preserving original producer ordinals. Paging never reopens the source or reruns the decoder. For inspect_pcap_capture parents, kind pcap pages endpoints, dns-queries, tls-sni, protocols, http-uris or unattributed-addresses. Select an exact query for dns-addresses, or a tshark/capinfos stream for UTF-16 diagnostics text. Page totals count retained facts; source coverage remains explicit. Qlog summaries keep profile/scope and counts; kind qlog pages traces, streams, loss-declarations, incomplete-records, contributions, ranges or final-sizes. Except traces, select trace_index; stream-specific facets also require exact stream_id and direction. Facts retain all-recorded-events-before-selection scope, and interval overlap or endpoint loss declarations do not prove retransmission or network loss. The api-surface view groups retained HAR requests by method, origin and format-rule path template; templated segments are inferences. It reads no headers or bodies and reports no query values. For a retained record use source: {kind: \"retained-evidence\", evidence_id: \"\"}. Use normalized_result.parent_evidence_id from a summary receipt. Source kind is required. Portable source uses {kind: \"inline\", evidence: }. For layout, JavaScript, inventory, WASM, Mach-O, Interface Builder, EVM, managed artifact, Android package and Dart AOT sources, request a summary with view: {kind: \"summary\"}; summary is a view kind and has no facet. The WASM summary gives validation, counts, WAT digest/length, tool profile and execution/network states without reading WAT text. Select a layout mitigations/linkage facet, one section/symbol/module, or a stable page. Module pages include assets, bundled and source modules; use node_id for ambiguous or unavailable paths. Typed module references use view {kind: \"javascript\", collection: \"modules\", projection: \"references\", where: {path: \"main.js\", kind: \"javascript-module\"}, offset: 0, limit: 64}; where matches exact retained strings (null selects unavailable paths). Rows include canonical identity, retained source-range count and observation support states. Source coverage and selection remain explicit; exhausting matching rows does not prove runtime loading or complete analysis. For exact file/native facts and processing gaps, use view {kind: \"javascript-facts\", where: {paths: [\"package.json\"]}, property_keys: [\"name\", \"operation\", \"analysis_status\"]}. Rows page original observations with canonical identities and Evidence; missing properties remain omitted. Paths match recorded artifact-path/source-range locations; optional kinds filter nodes. To discover field names without values, opt into include_available_property_keys: true with property_keys: []. Canonical identity and Evidence are separate from properties; keep each node_id/observation_id pair together when composing results. Inventory uses view: {kind: \"inventory\", collection: \"occurrences\", logical_paths: [\"package.json\"], offset: 0, limit: 64}. Inventory views page nodes, occurrences, edges or integrity contradictions; occurrence logical_paths matches exact recorded strings (omitted means all available, [] means none). source_complete distinguishes complete inventories from partial source records; page exhaustion does not prove absence in a partial source. WASM views use kind wasm and facet sections/imports/exports/candidates/glue/wat/headers/details/tool_profile; text facets use UTF-16 code units and source forms remain exact. Mach-O views use kind macho and facet entrypoints/architectures/build_metadata/load_commands/dependencies/imports/exports/segments/provenance; source_exhaustive false means unreturned rows may exist. Interface Builder views use kind interface-builder and collection documents/nodes/edges/coverage; nodes and edges accept an exact document relative_path. EVM summary returns all inferred interface candidates, carrier/decoded identities and explicit unknowns without hex or duplicate stdout. EVM views use kind evm and facet functions/bytecode_hex/stdout/stderr; function pages preserve the original candidate rows, and text offsets/limits count UTF-16 code units (hex has two characters per decoded byte). Exhausting candidate pages does not establish global interface completeness. Managed artifact summaries preserve complete identity/classification, metadata status, module/MVID, frameworks, coverage and limitations without unrelated inventories. Managed pages use kind managed and collection references/resources/attributes, retaining source coverage and build-local token scope; page exhaustion does not establish complete metadata. Managed member summaries keep identity, selection with unmatched names, coverage and per-collection counts; managed-members pages use collection types/exported_types/fields/methods/member_refs/call_edges/field_accesses/user_strings and carry the source selection and coverage. Android package summaries retain all declarations, engine identity and counts without decoded manifest text. Android manifest pages use kind android, facet manifest, offset and limit in UTF-16 code units; source_status preserves partial decoded coverage even when the retained text page is exhausted. Dart AOT summary preserves target/ABI/library identity, snapshot headers and pool lower bounds. String pages use kind dart-aot, collection package_uris/dart_uris/class_like_tokens; source coverage remains partial when the producer says partial. Native function Evidence requires kind native: view: {kind: \"native\", facet: \"procedure\"}. Facets select procedure, pseudocode, assembly, basic blocks, comments, callers/callees, references, unresolved calls, referenced strings/names, native API and high-pcode. Use nonnegative offset and a positive caller-selected limit (defaults 0 and 64); pseudocode uses UTF-16 code units, other native pages use rows. Returns artifact identity, parent Evidence ID, a distinct view digest, coverage, limitations and unknowns. Actual serialized size determines MCP transport admission; choose a smaller page or export the complete retained Evidence if needed.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_pe_resources", "title": "Inspect Pe Resources", "description": "Inspect one explicit local PE32/PE32+ image's complete bounded type/name/language resource tree without executing it or opening a disassembler. Returns numeric IDs versus original UTF-16 names, directory/data-entry file locations, payload RVA/file ranges, complete SHA-256 hashes and static RT_GROUP_ICON image-resource candidates. Language fallback, image decoding and actual shell/window loading remain unobserved. Reads a stable regular file; malformed or ambiguous mappings, non-identical overlapping ranges and exhausted budgets return no partial success. Portable on supported Node hosts; no Windows SDK or engine installation required.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_go_binary", "title": "Inspect Go Binary", "description": "Inspect embedded Go compiler version, main module, dependency/replacement versions and build settings in an explicit local ELF, PE or thin Mach-O image. Returns original artifact SHA-256, exact build-info source ranges, raw framed module bytes and unparsed module-text lines inline as observed Evidence. Supports inline and historical pointer encodings without installing Go, opening a disassembler, executing the target, writing temporary files or accessing the network. Missing metadata is reported as unknown, not proof that an image is not Go. Does not recover functions, source mappings, types or runtime behavior. Resource guards bound files to 256 MiB, aggregate embedded strings to 1 MiB, structural table decoding to 16 MiB and complete inline metadata to 8 MiB; malformed, unsupported and oversized inputs receive typed failures rather than partial success.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_rust_binary", "title": "Inspect Rust Binary", "description": "Inspect the cargo-auditable crate dependency list embedded in an explicit local ELF, PE or thin Mach-O image. Returns the artifact SHA-256, the .dep-v0 section file offset and size, compressed and uncompressed sizes, format version, packages in their original order, the root package index, and dependency edges by index. Reads zlib-compressed JSON without installing Rust, opening a disassembler, executing the target, writing temporary files or accessing the network. A missing section is null metadata with a limitation and is not proof that the binary has no dependencies. A rustc commit hash is reported only as an inference when a /rustc/<40-hex>/ path is present in read-only data. Resource guards bound files to 256 MiB, dependency sections to 1 MiB, inflated JSON to the smaller of 8 MiB and 64 times the compressed size, and the complete report to 8 MiB. Malformed, unsupported and oversized inputs receive typed failures rather than partial success.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "compare_wasm_interfaces", "title": "Compare Wasm Interfaces", "description": "Compare typed core WASM import/export names, kinds and exact signatures from two authenticated inspect_wasm_artifact Evidence records. Select imports, exports or both explicitly. Retained references resolve only in the current session; CLI accepts portable inline Evidence. Duplicate names, unsupported types and missing historical interface facets remain unknown. Preserve original module digests and every occurrence; no source acquisition, module execution or runtime-compatibility inference.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_wasm_artifact", "title": "Inspect Wasm Artifact", "description": "Validate an explicit local WASM artifact with caller-supplied WABT 1.0.42. Omitted or complete detail returns exact byte SHA-256, sections, upstream import/export WAT forms and decoded WAT inline as Evidence. For counts, validation and WAT identity without WAT text, pass detail: \"summary\" on this first call; it retains the complete original Evidence and returns the same typed summary as inspect_analysis_view, avoiding oversized complete delivery. Read exact imports/exports or WAT pages with inspect_analysis_view using normalized_result.parent_evidence_id. Delivery selection does not change analysis, provider inputs or source identity. Optionally associate selected JavaScript glue literals with explicit local candidates while preserving ambiguous URL/basename matches. Configure absolute REA_WABT_BIN_DIRECTORY. No installation, implicit fetch, WASM execution or original-source claim.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_evm_interface", "title": "Inspect Evm Interface", "description": "Inspect explicit local flat EVM bytecode without target execution or chain/RPC access. Select raw or hex encoding explicitly. Omitted or complete detail returns original carrier and decoded identities, full bytecode and all inferred interface candidates inline. For all inferred selectors/offsets/arguments/mutability and identities without bytecode hex or duplicated stdout, select detail: \"summary\" on this first call: it retains unchanged complete Evidence and returns a distinct linked inspect_analysis_view summary. Read original function rows or bytecode_hex/stdout/stderr text pages using view kind evm and normalized_result.parent_evidence_id; original complete Evidence remains accessible. Bytecode kind, hardfork, deployed authenticity and discovery completeness stay unknown; summary coverage covers only producer-returned candidates. Unchanged bundled EVMole 0.9.3/WASM in an owned bounded worker is initially real-verified on Linux x64; EOF-style EF00 containers are unsupported. No signature lookup, wallet action or transaction broadcast.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_sqlite_database", "title": "Inspect Sqlite Database", "description": "Inspect an explicit local SQLite database snapshot and its existing sibling WAL without modifying source files or opening a native analysis provider. Requires Node.js 24.x >=24.15 or 26+ with native DatabaseSync.limits support, checked by the worker. Returns observed Evidence with database/WAL SHA-256 and a compact schema inventory. Selecting an exact ordinary table expands only its schema and samples rows (default 20, subject to byte and worker resource limits). Select exact columns in the requested order to avoid unrelated or large values; schema_scope=database explicitly expands the whole schema; returned rows retain 64-bit integers, text bytes and blobs with explicit truncation. No arbitrary SQL, view or virtual-table execution, extension loading, database repair, encryption support or live-snapshot atomicity claim. At most two inspections per provider are admitted; occupied capacity is retryable. An isolated temporary copy and owned worker enforce input, value/record, SQL-statement, JSON-reply, JavaScript-heap and deadline limits; overall native heap is not capped. Supply a quiescent snapshot for coherent database/WAL evidence.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_recorded_crash", "title": "Inspect Recorded Crash", "description": "Inspect a supplied Linux ELF64 amd64 or AArch64 little-endian core without launching its target or attaching to any live PID. Returns all recorded segments, raw note owners/descriptors and source ranges, every Linux CORE PRSTATUS thread/register and SIGINFO fields inline with SHA-256 Evidence. Historical PID is recorded metadata; current process/file identity, note coverage and signal-thread associations stay unknown. Optionally add derived core-only GDB/pwndbg mapping candidates through explicit BYO configuration; zero map flags mean unknown permissions. Uses the same stable snapshot for both stages, bounded complete output and owned cleanup. Linux x64 host profile: unchanged pwntools 4.15.0/pyelftools 0.33/Unicorn 2.1.2; optional unchanged pwndbg 2026.09.15. No implicit executable/library pairing, GDB command language, host configuration changes or dependency installation.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_firmware_regions", "title": "Inspect Firmware Regions", "description": "Inspect signature candidates in a local firmware file with Binwalk 3.1.x (verified with 3.1.0). Returns offsets, reported lengths, descriptions and raw confidence values. Length validation and runtime addresses remain unknown. No extraction or target execution. Linux, caller-supplied tool and util-linux prlimit required; 128 MiB input limit, one worker and 120-second deadline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "extract_firmware", "title": "Extract Firmware", "description": "Extract caller-selected firmware bytes with Unblob 26.6.x (verified with 26.6.4) into an absent output directory. Returns verified child paths/digests, task derivations, unknown chunks, extraction diagnostics and explicit extraction_gaps rows naming unextracted regions, missing extractor dependencies and a continuation_id referencing shared extraction_continuations recovery instructions. Preserves the default sandbox; publishes regular files only. Linux, caller-supplied tool, format-specific extractors and util-linux prlimit required. No mounts or extracted-code execution. Select a returned native file with open_binary for Ghidra analysis; decompressed offsets are not original-file addresses.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "trace_web_module_imports", "title": "Trace Web Module Imports", "description": "Trace one exported website script's outgoing native ES imports/re-exports, using exact URL and optional selected import-map context. Reads a local export_web_scripts manifest and verifies the selected source's SHA-256/size; returns source positions, native resolved URLs or exact errors, every matching captured candidate and explicit unknown execution. Query/fragment identities are preserved. Computed imports and bundler IDs remain unknown. Select importer_url for unknown inline/document-base context. Caller-supplied Chromium executes only a trusted REA resolver stub in an owned context with page requests locally fulfilled/blocked; no captured application execution or asset refetch. Requires absolute REA_BROWSER_EXECUTABLE for literal imports. 32 MiB manifest, 16 MiB source, 4 MiB map and 20-second native deadline; cleanup may extend the deadline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "trace_web_source_location", "title": "Trace Web Source Location", "description": "Trace one generated position in an exported website script through an explicitly paired local source map. Verifies manifest, selected script and map SHA-256/byte identities; returns every equal-position mapping, reported source/root, resolved source URL, embedded sourcesContent and original position inline. One-based lines and zero-based UTF-16 columns; greatest generated position <= requested across lines. Duplicate sources and generated-only mappings remain distinct. Caller-selected pairing does not establish deployment authenticity or execution. Regular maps and inline indexed sections only; external section URLs are unsupported. No network access or application execution; uses the pinned upstream codec in an owned Node process with private temporary files, independent 192 MiB old-generation heap and 20-second deadline. 4 MiB map, 32 MiB reply; complete evidence or actionable resource failure. Cleanup may extend the deadline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "observe_web_execution", "title": "Observe Web Execution", "description": "Instrument one selected CDP page for a finite, externally driven precise coverage window. Resets execution counters and prevents optimized execution until stopped. Returns complete nested UTF-16 ranges/counts, independently hashed script text and request initiator associations by session script ID. Does not navigate, click, evaluate selected code or close the externally owned page. Navigation ends document-scoped collection; workers and UI causality remain outside this claim. Emits an actual armed progress notification before external actions.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_web_event_listeners", "title": "Inspect Web Event Listeners", "description": "Inspect listeners registered directly on the first main-document CSS match in one selected CDP page. Returns event flags, native callback locations, source ownership and exact script text/digests inline. Does not dispatch events, evaluate JavaScript or invoke handlers. Delegated ancestor/framework listeners and execution history remain unknown. Releases REA's object group and transport, preserving the external page.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_web_network_capture", "title": "Inspect Web Network Capture", "description": "Request detail summary for capture identity and counts; then page retained records with inspect_analysis_view kind capture (preview or complete), avoiding repeated decoding. Default detail complete preserves existing inline delivery. Inspect retained local HAR 1.2, native mitmproxy, Fiddler SAZ or aioquic 1.5.0 JSON qlog 0.3 events without contacting recorded URLs. Returns original ordinals, pointers/byte ranges/archive member names, preserved producer fields, precise numeric representations and exact exposed binary bytes inline. Excludes known transport credentials and explicitly marked values. Decodes every record before optional ordinal selection; malformed or oversized captures return no partial success. Duplicate JSON members are invalid; prototype-named members such as __proto__ are preserved as ordinary own JSON members without prototype mutation. Qlog reports trace-scoped STREAM interval unions and endpoint loss declarations; it does not recover bodies, prove network loss or correlate PCAP. Other qlog layouts are unsupported. Uses pinned upstream parsers, owned temporary files and bounded offline processes. SAZ preserves HTTP fields, XML metadata and encoded body/message bytes without replay or HAR conversion; encrypted archives are unsupported. Native mitmproxy requires caller-supplied mitmdump 12.2.3 on Linux. Browser transaction IDs, runtime attribution and original bytes of HAR Unicode text remain unknown.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "recover_javascript_sources", "title": "Recover Javascript Sources", "description": "Recover readable modules from local UTF-8 JavaScript scripts/bundles into an absent directory, using caller-supplied Wakaru ^1.13.0 (verified with 1.14.0) on Linux x64. Use additional_paths for related chunks; each input retains its own snapshot and provenance. Returns original/derived digests, extraction byte ranges, emitted source maps, warnings and analysis_input inline. Structural splitting may fall back to one module; original names and runtime equivalence remain unknown. No application code execution. Requires util-linux prlimit; one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB total input, 128 MiB output, 10000 entries and 8 MiB per diagnostic/report stream.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_adb_client", "title": "Inspect Adb Client", "description": "Inspect the caller-selected adb client: resolved binary, version, and install path. Never contacts devices and never starts the adb server. REA never installs platform tools; select a binary with REA_ADB_PATH (absolute) or adb on PATH.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_adb_devices", "title": "List Adb Devices", "description": "List attached devices exactly as `adb devices -l` reports them: serial, state, transport, model metadata, and an inferred emulator/physical kind with its evidence basis. Emulators and USB or network devices appear alike; REA neither starts nor manages them. May start the local adb server on first use.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_adb_device", "title": "Inspect Adb Device", "description": "Inspect one device's build identity through a fixed `getprop` whitelist: Android and SDK versions, security patch, fingerprint, product identity, CPU ABIs, and debuggable flag, plus the observed emulator indicator ro.kernel.qemu. Read-only with respect to the device.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_adb_packages", "title": "List Adb Packages", "description": "List installed packages on one device with each base APK's device path, optionally scoped to third-party or system packages. Paths are device filesystem paths, not host-local. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "pull_adb_package", "title": "Pull Adb Package", "description": "Pull one installed package's complete APK set (base plus every split, as `pm path` reports) from the device into a caller-selected output directory, creating a package-named subdirectory that must not already exist. Every pulled file is digested with SHA-256; partial pulls keep successful artifacts and per-file failure reasons. The device keeps the originals.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "read_adb_logcat", "title": "Read Adb Logcat", "description": "Read a bounded dump of the device log (`logcat -d -t`) for one buffer, optionally restricted to a process id. No streaming, no clearing; the newest lines are kept when the count cap trims. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_adb_package", "title": "Inspect Adb Package", "description": "Inspect one installed package through `dumpsys package`: version name/code, install and update times, installer, user id, flags, and the requested-permission count. A fixed projection of version-dependent output; unknown sections are ignored rather than guessed. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "pull_adb_file", "title": "Pull Adb File", "description": "Pull one absolute device path (a database, shared-preferences XML, or any readable file) into a caller-selected output directory, digesting it with SHA-256. The local copy must not already exist. Read-only with respect to the device.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "push_adb_file", "title": "Push Adb File", "description": "Push one local file to an absolute device path. A device-mutating tool: checks for an existing device file before transfer and refuses it unless overwrite is explicitly requested; this check is not an atomic create and another process can create the path before adb writes. When the device provides sha256sum, the transfer is verified by comparing it with the local digest.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "capture_adb_screen", "title": "Capture Adb Screen", "description": "Capture one frame of the device screen as a PNG (`screencap -p` through exec-out, no device-side file) into a caller-selected output directory, digesting it and reporting its dimensions. No recording or interaction.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_adb_processes", "title": "List Adb Processes", "description": "List running processes exactly as `ps -A` reports them: user, pid, ppid, rss, state, and name. Useful for pairing with instrumentation lanes. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_adb_directory", "title": "List Adb Directory", "description": "List the immediate children of one absolute device directory, including hidden entries: names, kinds, permissions, owner, group, sizes, dates, and symlink targets. Names and targets preserve embedded newlines. Recognizes the standard errors for absent paths and denied reads. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_adb_features", "title": "List Adb Features", "description": "List the device's declared hardware and software features (`pm list features`) for device fingerprinting. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_adb_services", "title": "List Adb Services", "description": "List the device's binder services with their interfaces (`service list`). Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_adb_display", "title": "Inspect Adb Display", "description": "Report the display's physical and any overridden size (`wm size`) and density (`wm density`) as the device declares them. Read-only; setting values is not exposed.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_adb_window", "title": "Inspect Adb Window", "description": "Report the window manager's focus declarations with display context, original lines and explicit summary status. Reads `dumpsys window windows`, falling back to `displays` only when no focus field is declared. Singular fields are unknown for multiple contexts or repeated declarations; inspect focus_contexts for every observation. Read-only; no interaction occurs.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "read_adb_setting", "title": "Read Adb Setting", "description": "Read one settings value (`settings get`) from the system, secure, or global namespace. Absent keys report the device's own null observation. Read-only; writing settings is not exposed.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "collect_adb_bugreport", "title": "Collect Adb Bugreport", "description": "Collect one device-generated bugreport archive (`adb bugreport`) into a caller-selected output directory, digesting the zip. The archive contains the device's own dumpstate, dumpsys, and logcat report; collection can take minutes. Read-only with respect to configuration.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "resolve_adb_packages", "title": "Resolve Adb Packages", "description": "Find installed packages by case-insensitive substring of the package name (e.g. `whatsapp` → `com.whatsapp`), returning each match's base APK device path. The first step of an easy get: resolve, then pull_adb_package the exact name. Read-only.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "install_adb_package", "title": "Install Adb Package", "description": "Install one local APK on the device (`adb install [-r]`), recording the APK's host digest and byte size. A device-mutating tool: `replace_requested` records whether `-r` was selected; `replaced` is null because install success does not establish prior package state. The device's own Success/Failure verdict is preserved with its reason.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "uninstall_adb_package", "title": "Uninstall Adb Package", "description": "Request package removal for user 0 (`adb shell pm uninstall --user 0`) without data retention. A device-mutating tool; absent packages report the device's own refusal reason.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "start_adb_app", "title": "Start Adb App", "description": "Start one installed app's resolved launcher activity with `am start -W -n`. A device-mutating tool for dynamic analysis. The full wait report determines success; failures retain launch-attempt facts and raw output. Pair with `read_adb_logcat` (pid filter) and `list_adb_processes` to observe the app, and `stop_adb_app` to end the run.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "start_adb_activity", "title": "Start Adb Activity", "description": "Start an intent with `am start -W`: one action, optional data URI, optional explicit component, and up to 16 typed extras (string, boolean, int, long, float). A device-mutating tool; the full wait report determines success, with failed-attempt facts and raw output retained.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "stop_adb_app", "title": "Stop Adb App", "description": "Force-stop every process of one package (`am force-stop`), ending a dynamic-analysis run. A device-mutating tool; it succeeds whether or not the package had running processes.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_pcap_client", "title": "Inspect Pcap Client", "description": "Inspect the caller-selected tshark and capinfos binaries: selected commands, selection sources, and versions. Both tools must be usable. Reads no capture file. REA never installs the Wireshark suite; select binaries with REA_TSHARK_COMMAND and REA_CAPINFOS_COMMAND (absolute) or from PATH.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_pcap_capture", "title": "Inspect Pcap Capture", "description": "Request detail summary for capture identity/counts, then page retained facts with inspect_analysis_view kind pcap. Default detail complete preserves inline delivery. Inspect one saved pcap or pcapng capture through an owned snapshot: metadata, exact packet count, SHA-256, IPv4/IPv6 address counts, DNS questions and address values from the same single-question response, TLS SNI, protocol distribution and HTTP URIs. All derived inventories are retained within declared resource budgets; unknown DNS attribution and excluded credentials remain explicit. Linux requires util-linux prlimit; Windows uses owned Job Objects. Requires caller-supplied capinfos and tshark; REA never captures traffic.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "identify_flutter_build", "title": "Identify Flutter Build", "description": "Identify a Flutter app's build facts by pure parsing: the Dart VM snapshot hash from every lib//libapp.so AOT section (vm and isolate, cross-checked), per-ABI library digests, the engine library's GNU build-id, and any labeled Dart version or toolchain strings libflutter.so carries. The snapshot hash is the artifact that maps to a Dart SDK release through an external dataset; REA performs no lookup. No engine, no execution, no external tools.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_dart_aot", "title": "Inspect Dart Aot", "description": "Inspect one ABI's Dart AOT snapshot inside an APK: the four snapshot symbols located through the ELF dynamic symbol table with their offsets, sizes, and section headers (magic, kind, length), the snapshot hash, and a bounded string-pool projection from the isolate data section (package: source URIs, dart: SDK URIs, identifier-like tokens) exposing the app's dependency structure. String-pool entries are byte-pattern observations, not deserialized cluster semantics; typed class and function recovery needs an SDK-specific parser. Omitted or complete detail returns the full observation. Select detail: \"summary\" for target/ABI/library identity, all snapshot headers, coverage and original lower-bound counts without string lists. The complete source stays retained; read returned strings via inspect_analysis_view with parent_evidence_id and kind dart-aot, collection package_uris/dart_uris/class_like_tokens, offset and limit. Exhausting pages does not imply complete pool coverage. No engine, no execution.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_apktool_client", "title": "Inspect Apktool Client", "description": "Inspect the caller-selected apktool launcher: resolved command, selection source, and version. Decodes nothing. REA never installs Apktool or Java; select a launcher with REA_APKTOOL_COMMAND (absolute) or apktool on PATH.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "decode_android_resources", "title": "Decode Android Resources", "description": "Decode one local APK's resources with `apktool d --no-src` in a provider-owned workspace that is removed after projection: the readable AndroidManifest.xml, apktool.yml version and SDK facts, the app's string resources (default or selected locales, bounded to 2000 entries per table), selectable string locales, and the decoded file count. The target APK is digest with SHA-256 before decoding; smali is skipped because Java-source recovery belongs to the JADX family.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "export_web_scripts", "title": "Export Web Scripts", "description": "Export JavaScript bytes already retained in one local inspect_web_page or capture_browser_scenario JSON capture (normalized result or complete Evidence). Writes scripts and a digest-verified manifest into an absent absolute output_directory. Returns all source URLs, script or transaction/event references, unavailable states, and an analysis_input for analyze_javascript_application when any bytes were exported. Include script sources in inspect_web_page or select capture.network.response_body in scenarios. No refetch or execution. Safe unambiguous URL layouts preserve relative module paths; versions, query variants, inline scripts, and path collisions are isolated with explicit resolution limitations.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": false }, "outputSchema": "" }, { "name": "list_browser_targets", "title": "List Browser Targets", "description": "List page targets exposed by the selected loopback Chrome DevTools Protocol endpoint. Optionally filter by exact origin. URLs preserve query values and fragments; only URL userinfo credentials are removed.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_web_page", "title": "Inspect Web Page", "description": "Passively inspect one selected page target through CDP without evaluating JavaScript, navigating, clicking, closing, or mutating the page. If no origin filter is supplied, capture is scoped to the target's current origin. Returns DOM structure, accessibility, scripts, resources, attach-window network and console metadata, workers, and redacted storage inventory as Evidence.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "analyze_web_bundle", "title": "Analyze Web Bundle", "description": "Capture JavaScript source from one selected CDP page and statically derive a chunk graph, route and endpoint candidates, vendor fingerprints, page-declared WebMCP metadata, and optionally fetch source maps from the selected target origin or explicitly requested origins. JavaScript is parsed but never executed.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "observe_web_session", "title": "Observe Web Session", "description": "Arm a CDP observation window of the requested duration while the user operates the page. By default it follows the selected target's current origin; an explicit origin list controls which origins may be retained. Records navigation, redirect, lifecycle, and failure events.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "discover_webmcp_tools", "title": "Discover Webmcp Tools", "description": "Passively inventory every page-registered WebMCP tool and its complete structural input-schema summary using the experimental CDP WebMCP domain. Metadata is page-declared-untrusted; REA never registers or invokes discovered tools.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "compare_web_captures", "title": "Compare Web Captures", "description": "Compare passive web captures by providing before and after, each with the complete inspect_web_page normalized_result in inspection and an optional complete discover_webmcp_tools normalized_result in webmcp; or compare recorded scenarios by passing complete capture_browser_scenario normalized_result objects in before_scenario and after_scenario with an optional normalization policy. Use exactly one input group. Network comparison includes observed HTTP requests and WebSocket frame streams; same-URL connections are compared as an unordered collection of ordered streams, retaining connection counts without claiming stable identity between individual connections. Scenario comparison aligns exact step IDs, records deterministic literal normalization, and returns every artifact-level difference plus alignment failures inline. Missing or truncated evidence never proves equality.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "capture_web_screenshot", "title": "Capture Web Screenshot", "description": "Capture the current visible viewport of one configured page as an inline, content-addressed PNG artifact. The operation never scrolls, navigates, or evaluates page JavaScript.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "compare_web_screenshots", "title": "Compare Web Screenshots", "description": "Compare two self-verifying PNG screenshot artifacts with local pixel metrics. Returns exact changed-pixel ratios and channel deltas without OCR or external services.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "capture_browser_scenario", "title": "Capture Browser Scenario", "description": "Run a controlled browser scenario when passive observation cannot exercise the application. Launch the selected executable or connect to a loopback CDP target, provide a start URL and actions, and select storage or artifacts when needed. Environment, empty storage, a URL-only final capture, and measured event-retention budgets are defaults. capture.network selects request_body, response_body, and header_values independently; capture.limits lets callers raise or lower the event count, retained-allocation estimates, network transaction count, and network content budgets. Selected content is returned inline with transaction and event references, byte digests, and explicit unavailable states. Budget omissions identify affected event kinds and network transactions. Credentials and declared secrets are redacted. Agents can run their own local fixture servers to control application responses. Actions run until completion or cancellation unless timeout_ms is set. Results are returned inline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_electron_fuses", "title": "Inspect Electron Fuses", "description": "Inspect packaged Electron fuse bytes in one local macOS app bundle, Electron Framework binary, Windows PE executable, or Linux ELF executable. Returns the artifact digest, per-slice wire version, fuse index, version-1 name, state, and raw byte, plus derived implications for Inspector flags, ELECTRON_RUN_AS_NODE, embedded ASAR integrity, and app.asar-only loading. A missing sentinel is unknown fuse state. Reads artifact bytes only and does not modify the selected file or open a runtime target.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "list_electron_targets", "title": "List Electron Targets", "description": "List every Electron file:// page target from a selected loopback CDP endpoint. Local file paths are canonicalized after symlink resolution. Selecting an endpoint exposes every eligible target and its local path metadata.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "inspect_electron_page", "title": "Inspect Electron Page", "description": "Passively inspect one Electron file page by supplying its loopback CDP endpoint and target ID. The provider rechecks that the target currently exists at that endpoint and is a local file page. Returns frames, DOM structure, resource paths, and scripts without evaluating renderer JavaScript or invoking Electron APIs. The selected endpoint exposes every local file page and its metadata to this tool.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "analyze_javascript_application", "title": "Analyze Javascript Application", "description": "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Select source_paths to acquire and analyze only exact inventoried file paths; the complete artifact inventory and identity remain intact, and unselected sources remain explicit unknowns. Dependencies are not implicitly analyzed. Select detail summary to retain the complete analysis Evidence in this session and receive only its summary view, then inspect selected modules or pages with inspect_analysis_view. Summary detail reduces delivery, whereas source_paths bounds source analysis. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "reconcile_javascript_runtime", "title": "Reconcile Javascript Runtime", "description": "Reconcile verified static JavaScript application graphs with existing passive web/Electron CDP, passive V8 Inspector, or provider-owned active Electron Evidence. Active Electron captures contribute an explicitly partial target-only runtime record; they never invent renderer scripts, frames, workers, or execution claims. Exact captured-source digests take priority over caller-declared file/URL mappings; target, frame, script, and worker ambiguity remains explicit, and source-map authority stays separate.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "capture_electron_scenario", "title": "Capture Electron Scenario", "description": "Use this for a provider-owned Electron run when passive CDP or Inspector observation cannot exercise application behavior. REA owns startup and teardown, accepts caller-defined click/wait actions plus window-targeted renderer reload/crash and synthetic open-url/second-instance delivery, and returns correlated window/WebContents/process/preload/session/navigation/shell/IPC evidence without retaining payload values. Actions wait for completion or request cancellation; a missing click target can keep the request pending. Results identify observed and unavailable event families, coverage status, action targets, and truncation. Cleanup failures retain collected observations with explicit cleanup uncertainty. External shell, navigation, permission, download, popup, updater, and OS-integration effects are blocked and recorded. Use passive Electron tools for observation-only work.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "list_javascript_runtime_targets", "title": "List Javascript Runtime Targets", "description": "List every eligible Node/Electron V8 Inspector target from an explicit literal-loopback endpoint. Node discovery file locations that cannot be verified are preserved as unresolved reported URLs; they do not prove filesystem identity. Listing does not attach to targets.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "observe_javascript_runtime", "title": "Observe Javascript Runtime", "description": "Attach passively to one Node/Electron V8 Inspector target by supplying its loopback Inspector endpoint and target ID. The provider rechecks target presence and attachability; a Node discovery file location may remain unresolved. Loaded script locations are validated independently from Debugger.scriptParsed. Captures script and Runtime execution-context metadata. REA never evaluates, pauses, resumes, reads source, or instruments the target; require/import edges, EventEmitter activity, and Electron IPC remain explicit unknowns. Reconcile the result with static Application Graph Evidence using reconcile_javascript_runtime. The selected endpoint exposes every target it serves to this tool.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": "" }, { "name": "trace_application_feature", "title": "Trace Application Feature", "description": "Trace a typed literal seed through every reachable part of an authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "trace_javascript_semantics", "title": "Trace Javascript Semantics", "description": "Trace static JavaScript data-flow, direct call/return, and closure relations from inline application Evidence or an exact same-session retained reference. Dynamic or unsupported semantics remain explicit unknowns; static reachability never claims runtime execution.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "compare_application_versions", "title": "Compare Application Versions", "description": "Compare two authenticated JavaScript Application Graph versions supplied as inline Evidence or exact same-session retained references. Uses unique-only exact digest, module source digest, source-map identity, structural fingerprint, and non-module semantic-key tiers. Reports added, removed, changed, ambiguous, and unknown entities plus the complete matching changed_from graph without fuzzy or module-ordinal pairing.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "compare_source_to_bundle", "title": "Compare Source To Bundle", "description": "Compare a cryptographically committed HistoricalSourceGraph with authenticated JavaScript Application Graph Evidence supplied inline or by exact same-session retained reference. Uses explicit exact-digest, source-map path, current-path, suffix, and basename signals with stable weights. Classifies unchanged, modified, removed, split, merged, duplicated, and unknown; incomplete coverage and ambiguous weak signals never become absence or forced matches.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "compare_javascript_export_shapes", "title": "Compare Javascript Export Shapes", "description": "Compare static return shapes for one exact module/export selector on each authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Variants pair only by reciprocal unique literal discriminants. Each retained variant lists observed return-property names even when values stay unknown. Presence (present, absent, or unknown-coverage) is separate from value resolution: a name present on only one paired shape is added or removed when parent-property coverage is complete on both sides, including when the static value is unresolved. Dynamic values, incomplete parent coverage, and unpaired variants remain unknown. Reports JSON Pointer changes without executing JavaScript; runtime behavior requires a separate agent-run probe.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "build_reconstruction_obligation_ledger", "title": "Build Reconstruction Obligation Ledger", "description": "Generate the complete deterministic ReconstructionObligationLedger from an authenticated Evidence bundle, reviewed obligations, and an explicit reconstruction manifest. Static candidates remain candidates; duplicate ownership, missing original or reconstruction cases, missing parser/type, weak verifier authority, unenumerated claims, contradictions, dependencies, and residual unknowns fail closed. The inline result carries the full-ledger closure digest and typed per-obligation diagnostics.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "evaluate_reconstruction_coverage", "title": "Evaluate Reconstruction Coverage", "description": "Evaluate inline evidence-backed reconstruction coverage against one named boundary. Missing ownership or inventory is partial; stale, weak, truncated, skipped, unresolved, or conflicting tied verifier proof is unknown; contradictions, failed proof, missing owners, and authority routing fail closed.", "inputSchema": "", "annotations": { "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "project_android_application_graph", "title": "Project Android Application Graph", "description": "Project authenticated APK inventory_artifact Evidence into an execution-free Android application inventory. Reports exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without decoding DEX, executing the APK, or claiming observed runtime calls.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "project_apple_application_graph", "title": "Project Apple Application Graph", "description": "Project authenticated IPA, macOS .app directory, ZIP, or DMG inventory Evidence into an execution-free Apple application inventory. Reports application roots, nested bundles with path-convention roles (app extensions, XPC services, login items, privileged helpers, system extensions, frameworks), launchd plists, exact component paths and hashes, runtime-family hints, and path-based bridge hypotheses without parsing plist/CMS semantics or claiming observed runtime calls.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "project_harmony_application_graph", "title": "Project Harmony Application Graph", "description": "Project authenticated HarmonyOS HAP, HSP, or App Pack inventory Evidence into an execution-free application inventory. Reports packaging-model hints (Stage module.json versus FA config.json), exact component paths and hashes (manifests, Ark bytecode, resources, native libraries, JavaScript, signing), App Pack child packages, runtime-family hints, and path-based N-API bridge hypotheses without decoding Ark bytecode, parsing manifest semantics, or claiming observed runtime calls.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "open_binary", "title": "Open Binary", "description": "Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. format=dos-com explicitly interprets 1..65280 headerless bytes as a DOS COM analysis image. format=raw-binary interprets headerless bytes with a required architecture and entry_point; file offset 0 maps at that address. Omission preserves header-based detection. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. Reopening the same target and profile retains its active database and metadata edits. An optional analysis snapshot is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly; importing into a session with metadata mutations requires closing and reopening it first. Call close_binary when the investigation is finished.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "path": { "type": "string", "minLength": 1, "pattern": "^[^\\x00]*$", "description": "Absolute local filesystem path for the analysis target; relative paths are rejected." }, "format": { "description": "Explicit headerless interpretation: dos-com or raw-binary. Omission preserves header-based detection.", "type": "string", "enum": [ "dos-com", "raw-binary" ] }, "architecture": { "description": "Caller-supplied CPU family. Required with format=raw-binary; rejected otherwise.", "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "m68k" ] }, "entry_point": { "description": "Caller-supplied load and entry address (0xhex). File offset 0 is mapped here. Required with format=raw-binary; rejected otherwise.", "type": "string", "pattern": "^0x[0-9A-Fa-f]{1,16}$" }, "provider_id": { "anyOf": [ { "type": "string", "const": "auto" }, { "type": "string", "minLength": 1, "pattern": "^[a-z][a-z0-9\\x2d]*$" } ], "description": "Exact deep-analysis provider ID, or automatic selection when omitted." }, "snapshot_path": { "type": "string", "minLength": 1, "pattern": "^[^\\x00]*$", "description": "Absolute local filesystem path for the analysis snapshot; relative paths are rejected." } }, "required": [ "path" ], "additionalProperties": false, "examples": [ { "path": "/tmp/fixture" } ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "result": { "$ref": "#/$defs/__schema0" } }, "required": [ "result" ], "additionalProperties": false, "$defs": { "__schema0": { "oneOf": [ { "type": "object", "properties": { "path": { "$ref": "#/$defs/__schema1" }, "kind": { "type": "string", "enum": [ "executable", "database", "archive", "artifact" ] }, "sha256": { "$ref": "#/$defs/__schema2" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "mach-o-universal", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "path", "kind", "sha256", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "path": { "$ref": "#/$defs/__schema1" }, "kind": { "type": "string", "const": "executable" }, "sha256": { "$ref": "#/$defs/__schema2" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "m68k" ] }, "entry_point": { "type": "string", "pattern": "^0x[0-9A-Fa-f]{1,16}$", "description": "Canonical caller-selected address where raw file offset 0 is mapped and execution is seeded." } }, "required": [ "path", "kind", "sha256", "format", "architecture", "entry_point" ], "additionalProperties": false } ] }, "__schema1": { "type": "string" }, "__schema2": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "$id": "urn:rea:tool-output:sha256:932e3fed203fdb706c19e72f8f08cddd1a06816c5d49ccd7301d845621fad825" } }, { "name": "close_binary", "title": "Close Binary", "description": "When the investigation is finished, drain earlier provider requests, optionally write a provider-neutral analysis snapshot atomically to the caller-supplied path, then close the active target and every provider resource started for it. Later provider requests wait until this lifecycle operation finishes. Existing files require explicit overwrite; a failed save leaves the session open so cached analysis is not lost. Metadata edits prevent immutable snapshot saves until the session is recreated; export_evidence_bundle preserves mutable observations before closing without a snapshot.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "snapshot_path": { "type": "string", "minLength": 1, "pattern": "^[^\\x00]*$", "description": "Absolute local filesystem path for the analysis snapshot; relative paths are rejected." }, "overwrite": { "default": false, "type": "boolean", "description": "Whether an existing destination may be replaced." } }, "additionalProperties": false, "examples": [ { "overwrite": false } ] }, "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "result": { "$ref": "#/$defs/__schema0" } }, "required": [ "result" ], "additionalProperties": false, "$defs": { "__schema0": { "anyOf": [ { "type": "null" }, { "type": "object", "properties": { "path": { "type": "string" }, "bytes": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "primitive_entries": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "Retained eligible primitive query bindings." }, "workflow_entries": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "Retained eligible composed workflow bindings." }, "evidence_records": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "All retained Evidence records, including observations without replay bindings." } }, "required": [ "path", "bytes", "primitive_entries", "workflow_entries", "evidence_records" ], "additionalProperties": false } ] } }, "$id": "urn:rea:tool-output:sha256:8a32f576cedd988969146e42aca5272425f25e92c028d49091ce857dea07d12f" } }, { "name": "binary_session", "title": "Binary Session", "description": "Report the complete current target, provider, capability availability, client-feature, analysis, and server-identity status without starting analysis.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "expected_package_version": { "type": "string", "minLength": 1, "description": "Expected package version used to reject stale or mismatched input." }, "expected_catalog_digest": { "type": "string", "pattern": "^[a-f0-9]{64}$", "description": "Expected catalog digest used to reject stale or mismatched input." }, "expected_server_path": { "type": "string", "minLength": 1, "pattern": "^[^\\x00]*$", "description": "Absolute local filesystem path expected for the running server; relative paths are rejected." } }, "additionalProperties": false, "examples": [ {} ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "result": { "$ref": "#/$defs/__schema0" } }, "required": [ "result" ], "additionalProperties": false, "$defs": { "__schema0": { "anyOf": [ { "type": "object", "properties": { "cleanup_pending": { "$ref": "#/$defs/__schema1" }, "capabilities": { "$ref": "#/$defs/__schema2" }, "analysis_run": { "$ref": "#/$defs/__schema9" }, "analysis_activity": { "$ref": "#/$defs/__schema12" }, "provider_operation_health": { "$ref": "#/$defs/__schema13" }, "analysis_provider_binding": { "$ref": "#/$defs/__schema14" }, "analysis_provider_candidates": { "$ref": "#/$defs/__schema18" }, "tool_availability": { "$ref": "#/$defs/__schema20" }, "client_features": { "$ref": "#/$defs/__schema33" }, "server_identity": { "$ref": "#/$defs/__schema34" }, "open": { "type": "boolean", "const": false } }, "required": [ "cleanup_pending", "capabilities", "analysis_run", "analysis_activity", "provider_operation_health", "analysis_provider_binding", "analysis_provider_candidates", "tool_availability", "client_features", "server_identity", "open" ], "additionalProperties": { "$ref": "#/$defs/__schema35" } }, { "type": "object", "properties": { "cleanup_pending": { "$ref": "#/$defs/__schema1" }, "capabilities": { "$ref": "#/$defs/__schema2" }, "analysis_run": { "$ref": "#/$defs/__schema9" }, "analysis_activity": { "$ref": "#/$defs/__schema12" }, "provider_operation_health": { "$ref": "#/$defs/__schema13" }, "analysis_provider_binding": { "$ref": "#/$defs/__schema14" }, "analysis_provider_candidates": { "$ref": "#/$defs/__schema18" }, "tool_availability": { "$ref": "#/$defs/__schema20" }, "client_features": { "$ref": "#/$defs/__schema33" }, "server_identity": { "$ref": "#/$defs/__schema34" }, "open": { "type": "boolean", "const": true }, "path": { "$ref": "#/$defs/__schema36" }, "kind": { "type": "string", "enum": [ "executable", "database", "archive", "artifact" ] }, "sha256": { "$ref": "#/$defs/__schema37" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "mach-o-universal", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "cleanup_pending", "capabilities", "analysis_run", "analysis_activity", "provider_operation_health", "analysis_provider_binding", "analysis_provider_candidates", "tool_availability", "client_features", "server_identity", "open", "path", "kind", "sha256", "format", "architecture" ], "additionalProperties": { "$ref": "#/$defs/__schema35" } }, { "type": "object", "properties": { "cleanup_pending": { "$ref": "#/$defs/__schema1" }, "capabilities": { "$ref": "#/$defs/__schema2" }, "analysis_run": { "$ref": "#/$defs/__schema9" }, "analysis_activity": { "$ref": "#/$defs/__schema12" }, "provider_operation_health": { "$ref": "#/$defs/__schema13" }, "analysis_provider_binding": { "$ref": "#/$defs/__schema14" }, "analysis_provider_candidates": { "$ref": "#/$defs/__schema18" }, "tool_availability": { "$ref": "#/$defs/__schema20" }, "client_features": { "$ref": "#/$defs/__schema33" }, "server_identity": { "$ref": "#/$defs/__schema34" }, "open": { "type": "boolean", "const": true }, "path": { "$ref": "#/$defs/__schema36" }, "kind": { "type": "string", "const": "executable" }, "sha256": { "$ref": "#/$defs/__schema37" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "m68k" ] }, "entry_point": { "type": "string", "pattern": "^0x[0-9A-Fa-f]{1,16}$", "description": "Canonical caller-selected address where raw file offset 0 is mapped and execution is seeded." } }, "required": [ "cleanup_pending", "capabilities", "analysis_run", "analysis_activity", "provider_operation_health", "analysis_provider_binding", "analysis_provider_candidates", "tool_availability", "client_features", "server_identity", "open", "path", "kind", "sha256", "format", "architecture", "entry_point" ], "additionalProperties": { "$ref": "#/$defs/__schema35" } } ] }, "__schema1": { "type": "boolean" }, "__schema2": { "type": "array", "items": { "$ref": "#/$defs/__schema3" } }, "__schema3": { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema4" }, "shared_limitations": { "type": "array", "items": { "type": "string" } }, "groups": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "operations": { "$ref": "#/$defs/__schema5" }, "effects": { "$ref": "#/$defs/__schema7" }, "limitations": { "$ref": "#/$defs/__schema8" }, "available": { "type": "boolean", "const": true }, "reason": { "type": "null" }, "availability_code": { "type": "null" } }, "required": [ "operations", "effects", "limitations", "available", "reason", "availability_code" ], "additionalProperties": false }, { "type": "object", "properties": { "operations": { "$ref": "#/$defs/__schema5" }, "effects": { "$ref": "#/$defs/__schema7" }, "limitations": { "$ref": "#/$defs/__schema8" }, "available": { "type": "boolean", "const": false }, "reason": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "availability_code": { "anyOf": [ { "type": "string", "enum": [ "not_configured", "executable_missing", "runtime_missing", "runtime_unavailable", "unsupported_host", "unsupported_version", "target_kind_unsupported", "target_format_unsupported", "architecture_unsupported", "target_role_unsupported", "managed_target_unsupported", "open_options_invalid", "version_unresolved" ] }, { "type": "null" } ] } }, "required": [ "operations", "effects", "limitations", "available", "reason", "availability_code" ], "additionalProperties": false } ] } } }, "required": [ "provider", "shared_limitations", "groups" ], "additionalProperties": false }, "__schema4": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema5": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema6" } }, "__schema6": { "type": "string", "minLength": 1 }, "__schema7": { "type": "array", "items": { "type": "string", "enum": [ "mutates_artifact", "launches_process", "may_show_ui", "may_access_network", "may_write_filesystem", "changes_permissions", "requires_root" ] } }, "__schema8": { "type": "array", "items": { "type": "string" } }, "__schema9": { "anyOf": [ { "type": "object", "properties": { "run_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "process_lineage": { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "not_observed" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "snapshots" }, "snapshots": { "type": "array", "items": { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema4" }, "observation": { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "unavailable" }, "observed_at": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$" }, "launcher_pid": { "$ref": "#/$defs/__schema10" }, "process_group_id": { "$ref": "#/$defs/__schema11" }, "reason": { "type": "string", "minLength": 1 } }, "required": [ "status", "observed_at", "launcher_pid", "process_group_id", "reason" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "verified" }, "observed_at": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$" }, "launcher_pid": { "$ref": "#/$defs/__schema10" }, "process_group_id": { "$ref": "#/$defs/__schema11" }, "launcher_parent_pid": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "descendants": { "type": "array", "items": { "type": "object", "properties": { "pid": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "parent_pid": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "process_group_id": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 } }, "required": [ "pid", "parent_pid", "process_group_id" ], "additionalProperties": false } } }, "required": [ "status", "observed_at", "launcher_pid", "process_group_id", "launcher_parent_pid", "descendants" ], "additionalProperties": false } ] } }, "required": [ "provider", "observation" ], "additionalProperties": false } } }, "required": [ "status", "snapshots" ], "additionalProperties": false } ] } }, "required": [ "run_id", "process_lineage" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema10": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "__schema11": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "__schema12": { "type": "object", "properties": { "status": { "type": "string", "enum": [ "not_observed", "idle", "busy" ] }, "providers": { "type": "array", "items": { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema4" }, "active": { "anyOf": [ { "type": "object", "properties": { "request_id": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "operation": { "type": "string", "minLength": 1 }, "elapsed_ms": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "caller_state": { "type": "string", "enum": [ "waiting", "cancelled" ] } }, "required": [ "request_id", "operation", "elapsed_ms", "caller_state" ], "additionalProperties": false }, { "type": "null" } ] }, "queued_requests": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "provider", "active", "queued_requests" ], "additionalProperties": false } } }, "required": [ "status", "providers" ], "additionalProperties": false }, "__schema13": { "anyOf": [ { "type": "object", "properties": { "state": { "type": "string", "enum": [ "idle", "busy", "exited", "unreachable", "not_started", "unknown" ] }, "stage": { "anyOf": [ { "type": "string", "enum": [ "launch", "connection", "analysis", "decompilation", "unknown" ] }, { "type": "null" } ] }, "retry_action": { "anyOf": [ { "type": "string", "enum": [ "retry", "wait", "restart_provider", "unknown" ] }, { "type": "null" } ] }, "exit_code": { "anyOf": [ { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, { "type": "null" } ] }, "requests": { "type": "array", "items": { "type": "object", "properties": { "request_id": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "operation": { "type": "string", "minLength": 1 }, "stage": { "type": "string", "enum": [ "launch", "connection", "analysis", "decompilation", "unknown" ] } }, "required": [ "request_id", "operation", "stage" ], "additionalProperties": false } } }, "required": [ "state", "stage", "retry_action", "exit_code", "requests" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema14": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema4" }, "selection_source": { "type": "string", "enum": [ "request", "environment", "auto-single-candidate" ] }, "analysis_profile": { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema15" }, "parameters": { "$ref": "#/$defs/__schema16" }, "digest": { "$ref": "#/$defs/__schema17" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false } }, "required": [ "provider", "selection_source", "analysis_profile" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema15": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema16": { "type": "object", "additionalProperties": {} }, "__schema17": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema18": { "type": "array", "items": { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema4" }, "availability": { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "code": { "type": "null" }, "reason": { "type": "string", "minLength": 1 }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "code", "reason", "diagnostics" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "available" }, "code": { "type": "null" }, "reason": { "type": "null" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "code", "reason", "diagnostics" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unavailable" }, "code": { "type": "string", "enum": [ "not_configured", "executable_missing", "runtime_missing", "runtime_unavailable", "unsupported_host", "unsupported_version", "target_kind_unsupported", "target_format_unsupported", "architecture_unsupported", "target_role_unsupported", "managed_target_unsupported", "open_options_invalid", "version_unresolved" ] }, "reason": { "type": "string", "minLength": 1 }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "code", "reason", "diagnostics" ], "additionalProperties": false } ] }, "target_support": { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "code": { "type": "null" }, "reason": { "type": "string", "minLength": 1 }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "code", "reason", "diagnostics" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "supported" }, "code": { "type": "null" }, "reason": { "type": "null" }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "code", "reason", "diagnostics" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unsupported" }, "code": { "type": "string", "enum": [ "target_kind_unsupported", "target_format_unsupported", "architecture_unsupported", "target_role_unsupported", "managed_target_unsupported" ] }, "reason": { "type": "string", "minLength": 1 }, "diagnostics": { "$ref": "#/$defs/__schema19" } }, "required": [ "status", "code", "reason", "diagnostics" ], "additionalProperties": false } ] }, "selected": { "type": "boolean" }, "capabilities": { "type": "array", "items": { "$ref": "#/$defs/__schema3" } } }, "required": [ "provider", "availability", "target_support", "selected", "capabilities" ], "additionalProperties": false } }, "__schema19": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "__schema20": { "type": "object", "properties": { "client_requirements": { "$ref": "#/$defs/__schema21" }, "groups": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "names": { "$ref": "#/$defs/__schema23" }, "surface": { "$ref": "#/$defs/__schema25" }, "default_mode_available": { "$ref": "#/$defs/__schema26" }, "modes": { "$ref": "#/$defs/__schema27" }, "client_requirements": { "$ref": "#/$defs/__schema30" }, "effects": { "$ref": "#/$defs/__schema31" }, "annotations": { "$ref": "#/$defs/__schema32" }, "available": { "type": "boolean", "const": true }, "reason": { "type": "string", "const": "available" }, "remediation": { "type": "null" } }, "required": [ "names", "surface", "effects", "annotations", "available", "reason", "remediation" ], "additionalProperties": false }, { "type": "object", "properties": { "names": { "$ref": "#/$defs/__schema23" }, "surface": { "$ref": "#/$defs/__schema25" }, "default_mode_available": { "$ref": "#/$defs/__schema26" }, "modes": { "$ref": "#/$defs/__schema27" }, "client_requirements": { "$ref": "#/$defs/__schema30" }, "effects": { "$ref": "#/$defs/__schema31" }, "annotations": { "$ref": "#/$defs/__schema32" }, "available": { "type": "boolean", "const": false }, "reason": { "type": "string", "enum": [ "client_capability_missing", "target_required", "provider_missing", "provider_unavailable", "target_unsupported", "unsupported_host" ] }, "remediation": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "names", "surface", "effects", "annotations", "available", "reason", "remediation" ], "additionalProperties": false } ] } } }, "required": [ "client_requirements", "groups" ], "additionalProperties": false }, "__schema21": { "type": "object", "properties": { "required": { "type": "array", "items": { "$ref": "#/$defs/__schema22" } }, "optional": { "type": "array", "items": { "$ref": "#/$defs/__schema22" } }, "missing_required": { "type": "array", "items": { "$ref": "#/$defs/__schema22" } }, "missing_optional": { "type": "array", "items": { "$ref": "#/$defs/__schema22" } } }, "required": [ "required", "optional", "missing_required", "missing_optional" ], "additionalProperties": false }, "__schema22": { "type": "string", "enum": [ "elicitation_form", "elicitation_url", "roots", "sampling" ] }, "__schema23": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema24" } }, "__schema24": { "type": "string", "minLength": 1 }, "__schema25": { "type": "string" }, "__schema26": { "type": "boolean" }, "__schema27": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "available": { "type": "boolean", "const": true }, "missing_operations": { "minItems": 0, "maxItems": 0, "type": "array", "items": { "$ref": "#/$defs/__schema28" } }, "remediation": { "type": "null" } }, "required": [ "name", "available", "missing_operations", "remediation" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "type": "string" }, "available": { "type": "boolean", "const": false }, "missing_operations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema29" } }, "remediation": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "name", "available", "missing_operations", "remediation" ], "additionalProperties": false } ] } }, "__schema28": { "type": "string" }, "__schema29": { "type": "string" }, "__schema30": { "$ref": "#/$defs/__schema21" }, "__schema31": { "type": "array", "items": { "type": "string", "enum": [ "mutatesTarget", "mutatesSession", "writesFilesystem", "launchesProcess", "accessesNetwork", "changesUiState", "mayDiscardData", "executesForeignCode", "mutatesDevice", "idempotent" ] } }, "__schema32": { "type": "array", "items": { "type": "string", "enum": [ "read_only", "destructive", "idempotent", "open_world" ] } }, "__schema33": { "type": "object", "properties": { "elicitation_form": { "type": "boolean" }, "elicitation_url": { "type": "boolean" }, "roots": { "type": "boolean" }, "sampling": { "type": "boolean" } }, "required": [ "elicitation_form", "elicitation_url", "roots", "sampling" ], "additionalProperties": false }, "__schema34": { "type": "object", "properties": { "package": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "root_path": { "type": "string" }, "build_commit": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "name", "version", "root_path", "build_commit" ], "additionalProperties": false }, "server": { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "started_at": { "type": "string" }, "command_path": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "name", "version", "started_at", "command_path" ], "additionalProperties": false }, "sdk": { "type": "object", "properties": { "server": { "type": "string" }, "client_test": { "type": "string" }, "core": { "type": "string" } }, "required": [ "server", "client_test", "core" ], "additionalProperties": false }, "negotiated_protocol_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "client": { "anyOf": [ { "type": "object", "properties": { "name": { "type": "string" }, "version": { "type": "string" } }, "required": [ "name", "version" ], "additionalProperties": false }, { "type": "null" } ] }, "skill": { "type": "object", "properties": { "name": { "type": "string" }, "expected_version": { "type": "string" } }, "required": [ "name", "expected_version" ], "additionalProperties": false }, "catalog": { "type": "object", "properties": { "counts": { "type": "object", "properties": { "cli_commands": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "mcp_tools": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "mcp_prompts": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "cli_commands", "mcp_tools", "mcp_prompts" ], "additionalProperties": false }, "digests": { "type": "object", "properties": { "tools_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "prompts_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "combined_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "required": [ "tools_sha256", "prompts_sha256", "combined_sha256" ], "additionalProperties": false } }, "required": [ "counts", "digests" ], "additionalProperties": false }, "protocol_features": { "type": "object", "properties": { "progress": { "type": "boolean" }, "cancellation": { "type": "boolean" }, "elicitation": { "type": "boolean" } }, "required": [ "progress", "cancellation", "elicitation" ], "additionalProperties": false }, "alignment": { "type": "object", "properties": { "state": { "type": "string", "enum": [ "aligned", "mcp_server_restart_required", "unknown" ] }, "reasons": { "type": "array", "items": { "type": "string" } }, "remediation": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "state", "reasons", "remediation" ], "additionalProperties": false } }, "required": [ "package", "server", "sdk", "negotiated_protocol_version", "client", "skill", "catalog", "protocol_features", "alignment" ], "additionalProperties": false }, "__schema35": {}, "__schema36": { "type": "string" }, "__schema37": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "$id": "urn:rea:tool-output:sha256:4e8a0312f6ecec53940a575a8e7cd1d115a529cb84e1a13d75ccea62975aba21" } }, { "name": "export_evidence_bundle", "title": "Export Evidence Bundle", "description": "Atomically write the session's deterministic Evidence bundle to the requested local path. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "path": { "type": "string", "minLength": 1, "pattern": "^[^\\x00]*$", "description": "Absolute local filesystem path for the exported evidence bundle; relative paths are rejected." }, "overwrite": { "default": false, "type": "boolean", "description": "Whether an existing destination may be replaced." } }, "required": [ "path" ], "additionalProperties": false, "examples": [ { "path": "/tmp/evidence.json", "overwrite": false } ] }, "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "result": { "$ref": "#/$defs/__schema0" } }, "required": [ "result" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "object", "properties": { "path": { "type": "string" }, "bytes": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "records": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "unknowns": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "path", "bytes", "records", "unknowns" ], "additionalProperties": false } }, "$id": "urn:rea:tool-output:sha256:8f25c6189cc54a6a9705844d3b51f53abe7d85c22aebe665040d2fade659c4ed" } }, { "name": "import_evidence_bundle", "title": "Import Evidence Bundle", "description": "Read the JSON bundle at the supplied local path, validate every Evidence ID and canonical manifest, then atomically merge it. Imported content is data only and is never executed.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "path": { "type": "string", "minLength": 1, "pattern": "^[^\\x00]*$", "description": "Absolute local filesystem path for the evidence bundle to import; relative paths are rejected." } }, "required": [ "path" ], "additionalProperties": false, "examples": [ { "path": "/tmp/evidence.json" } ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "result": { "$ref": "#/$defs/__schema0" } }, "required": [ "result" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "object", "properties": { "imported": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "unknowns_added": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "total": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "imported", "unknowns_added", "total" ], "additionalProperties": false } }, "$id": "urn:rea:tool-output:sha256:2530df2b57608db6e80da29b2a0731f1c240c7aaa6ee7fe3c85352b6c63495ec" } }, { "name": "get_evidence_bundle", "title": "Get Evidence Bundle", "description": "Return every retained Evidence record and residual unknown as a complete canonical bundle by default. detail=summary discovers retained records without copying or transferring their payloads; optionally filter by exact Evidence ID, operation, target SHA-256, analysis-profile digest or canonical native procedure address. Metadata distinguishes complete record retention from native value-flow truncation or unavailable/unknown coverage. Use a discovered evidence_id with inspect_analysis_view without restarting a provider. Filters apply only to summary delivery.", "inputSchema": "", "annotations": { "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "capture_process_scenario", "title": "Capture Process Scenario", "description": "Run one caller-selected command under a PTY and return process capture Evidence with residual unknowns. The renderer admits at most 1,000,000 combined terminal cells, computed as columns × (rows + scrollback); every resize uses the selected scrollback and must fit the same budget. Supply a smaller terminal shape when that product is too large; dimensions are never clamped. A command name resolves through the inherited PATH; the working directory defaults to the caller's current directory; host environment variables are inherited with scenario overrides. Environment keys cannot contain '=' or NUL, and REA_PROCESS_RUN_ID is reserved for process ownership. Filesystem snapshots are opt-in through filesystem_observation_paths. A positive finalization_ms makes a timeout or idle deadline send SIGTERM to the captured root through its start identity, keep observing, and send SIGKILL once after the interval; exit.finalization records each attempt with its delivery result and the observed exit, and cancellation still ends the run at once. The target runs with the current user's permissions; this is not a security sandbox.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": true, "idempotentHint": false, "openWorldHint": true }, "outputSchema": "" }, { "name": "compare_process_captures", "title": "Compare Process Captures", "description": "Compare two compatible process capture observations across terminal, interaction, lifecycle, process, filesystem, command-shim, HTTP, and WebSocket evidence. Optional trace_spec validates exact events against an explicit partial order or finite trace language; concurrency is never inferred from timestamps or broad sorting. Missing, journal-free, or truncated observations are never treated as equivalent.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "compare_artifacts", "title": "Compare Artifacts", "description": "Compare complete artifact inventories by logical occurrence path, content identity, metadata, and graph relations. Pass the inventory Evidence nested in each inspect_artifact result as left and right, or pass its inspect_analysis_view summary while the complete parent Evidence remains retained in this session. Summary facts are not treated as a complete inventory; comparison resolves the exact retained parent. Every delta cites both complete inputs, and gaps yield truncated or unknown, never equivalence. Returns every change inline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "compare_functions", "title": "Compare Functions", "description": "Compare two explicit sets of analyze_function Evidence across identity, exact provider text, calls, references, strings, and address-normalized CFG topology. Missing or provider-incompatible facets remain truncated or unknown; every conclusion cites both Evidence sets.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "left": { "type": "object", "properties": { "evidence_id": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$", "description": "Stable identifier of the recorded Evidence observation." }, "subject": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "digest": { "type": "object", "properties": { "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "required": [ "sha256" ], "additionalProperties": false }, "local_path": { "type": "string", "pattern": "^[^\\x00]*$", "description": "Local filesystem path for local." }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ], "description": "Declared input artifact format." }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "digest": { "type": "object", "properties": { "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "required": [ "sha256" ], "additionalProperties": false }, "local_path": { "type": "string", "pattern": "^[^\\x00]*$", "description": "Local filesystem path for local." }, "format": { "type": "string", "const": "raw-binary", "description": "Declared input artifact format." }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "provider": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "analysis_profile": { "anyOf": [ { "type": "object", "properties": { "provider": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "parameters": { "type": "object", "additionalProperties": {} }, "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "predicate_type": { "type": "string", "minLength": 1 }, "operation": { "type": "string", "minLength": 1 }, "parameters": { "type": "object", "additionalProperties": {} }, "raw_result": { "anyOf": [ {}, { "type": "null" } ] }, "normalized_result": {}, "confidence": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "authority": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "environment": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "limitations": { "type": "array", "items": { "type": "string" } }, "relationship_coverage": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete", "description": "Current lifecycle or verification status." }, "diagnostics": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial", "description": "Current lifecycle or verification status." }, "limitations": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } }, "limited_directions": { "anyOf": [ { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callees" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ] }, "minItems": 2, "maxItems": 2 } ] }, "diagnostics": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown", "description": "Current lifecycle or verification status." }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "anyOf": [ { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callees" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ] }, "minItems": 2, "maxItems": 2 } ] }, "diagnostics": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "locations": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1, "description": "Local filesystem path used by this operation." } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "evidence_links": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "description": "Left-hand input used for comparison or differential execution." }, "right": { "type": "object", "properties": { "evidence_id": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$", "description": "Stable identifier of the recorded Evidence observation." }, "subject": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "digest": { "type": "object", "properties": { "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "required": [ "sha256" ], "additionalProperties": false }, "local_path": { "type": "string", "pattern": "^[^\\x00]*$", "description": "Local filesystem path for local." }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ], "description": "Declared input artifact format." }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "digest": { "type": "object", "properties": { "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "required": [ "sha256" ], "additionalProperties": false }, "local_path": { "type": "string", "pattern": "^[^\\x00]*$", "description": "Local filesystem path for local." }, "format": { "type": "string", "const": "raw-binary", "description": "Declared input artifact format." }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "provider": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "analysis_profile": { "anyOf": [ { "type": "object", "properties": { "provider": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "parameters": { "type": "object", "additionalProperties": {} }, "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "predicate_type": { "type": "string", "minLength": 1 }, "operation": { "type": "string", "minLength": 1 }, "parameters": { "type": "object", "additionalProperties": {} }, "raw_result": { "anyOf": [ {}, { "type": "null" } ] }, "normalized_result": {}, "confidence": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "authority": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "environment": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "limitations": { "type": "array", "items": { "type": "string" } }, "relationship_coverage": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete", "description": "Current lifecycle or verification status." }, "diagnostics": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial", "description": "Current lifecycle or verification status." }, "limitations": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } }, "limited_directions": { "anyOf": [ { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callees" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ] }, "minItems": 2, "maxItems": 2 } ] }, "diagnostics": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown", "description": "Current lifecycle or verification status." }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "anyOf": [ { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callees" } ] }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ], "items": { "anyOf": [ { "type": "string", "const": "callers" }, { "type": "string", "const": "callees" } ] }, "minItems": 2, "maxItems": 2 } ] }, "diagnostics": { "minItems": 1, "type": "array", "items": { "type": "string", "minLength": 1 } } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "locations": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1, "description": "Local filesystem path used by this operation." } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "evidence_links": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "description": "Right-hand input used for comparison or differential execution." } }, "required": [ "left", "right" ], "additionalProperties": false }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "evidence_id": { "$ref": "#/$defs/__schema0" }, "subject": { "$ref": "#/$defs/__schema1" }, "provider": { "$ref": "#/$defs/__schema6" }, "analysis_profile": { "$ref": "#/$defs/__schema7" }, "predicate_type": { "$ref": "#/$defs/__schema10" }, "operation": { "$ref": "#/$defs/__schema11" }, "parameters": { "$ref": "#/$defs/__schema9" }, "raw_result": { "$ref": "#/$defs/__schema12" }, "normalized_result": { "$ref": "#/$defs/__schema13" }, "confidence": { "$ref": "#/$defs/__schema28" }, "authority": { "$ref": "#/$defs/__schema29" }, "environment": { "$ref": "#/$defs/__schema30" }, "limitations": { "$ref": "#/$defs/__schema31" }, "relationship_coverage": { "$ref": "#/$defs/__schema32" }, "locations": { "$ref": "#/$defs/__schema44" }, "evidence_links": { "$ref": "#/$defs/__schema45" } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema1": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema2": { "type": "string", "minLength": 1 }, "__schema3": { "type": "object", "properties": { "sha256": { "$ref": "#/$defs/__schema4" } }, "required": [ "sha256" ], "additionalProperties": false }, "__schema4": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema5": { "type": "string", "pattern": "^[^\\x00]*$" }, "__schema6": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema7": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema8" }, "parameters": { "$ref": "#/$defs/__schema9" }, "digest": { "$ref": "#/$defs/__schema4" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema8": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema9": { "type": "object", "additionalProperties": {} }, "__schema10": { "type": "string", "minLength": 1 }, "__schema11": { "type": "string", "minLength": 1 }, "__schema12": { "anyOf": [ {}, { "type": "null" } ] }, "__schema13": { "type": "object", "properties": { "status": { "$ref": "#/$defs/__schema14" }, "function_match": { "$ref": "#/$defs/__schema15" }, "left_subject_sha256": { "$ref": "#/$defs/__schema4" }, "right_subject_sha256": { "$ref": "#/$defs/__schema4" }, "summary": { "$ref": "#/$defs/__schema16" }, "dimensions": { "$ref": "#/$defs/__schema17" }, "changes": { "$ref": "#/$defs/__schema26" }, "limitations": { "$ref": "#/$defs/__schema27" } }, "required": [ "status", "function_match", "left_subject_sha256", "right_subject_sha256", "summary", "dimensions", "changes", "limitations" ], "additionalProperties": false }, "__schema14": { "type": "string", "enum": [ "unchanged", "changed", "unknown" ] }, "__schema15": { "anyOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "matched" }, "method": { "type": "string", "const": "symbol" }, "left_name": { "type": "string" }, "right_name": { "type": "string" } }, "required": [ "status", "method", "left_name", "right_name" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "enum": [ "mismatched", "ambiguous" ] }, "method": { "type": "string", "const": "explicit" }, "left_name": { "type": "string" }, "right_name": { "type": "string" } }, "required": [ "status", "method", "left_name", "right_name" ], "additionalProperties": false } ] }, "__schema16": { "type": "object", "properties": { "unchanged": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "changed": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "unknown": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "unchanged", "changed", "unknown" ], "additionalProperties": false }, "__schema17": { "minItems": 8, "maxItems": 8, "type": "array", "items": { "$ref": "#/$defs/__schema18" } }, "__schema18": { "anyOf": [ { "type": "object", "properties": { "dimension": { "$ref": "#/$defs/__schema19" }, "left_count": { "$ref": "#/$defs/__schema20" }, "right_count": { "$ref": "#/$defs/__schema21" }, "evidence_links": { "$ref": "#/$defs/__schema22" }, "limitations": { "$ref": "#/$defs/__schema24" }, "status": { "type": "string", "const": "unchanged" }, "left_digest": { "$ref": "#/$defs/__schema4" }, "right_digest": { "$ref": "#/$defs/__schema4" }, "text_delta": { "anyOf": [ { "$ref": "#/$defs/__schema25" }, { "type": "null" } ] }, "conclusion_kind": { "type": "string", "const": "derived_relationship" } }, "required": [ "dimension", "left_count", "right_count", "evidence_links", "limitations", "status", "left_digest", "right_digest", "text_delta", "conclusion_kind" ], "additionalProperties": false }, { "type": "object", "properties": { "dimension": { "$ref": "#/$defs/__schema19" }, "left_count": { "$ref": "#/$defs/__schema20" }, "right_count": { "$ref": "#/$defs/__schema21" }, "evidence_links": { "$ref": "#/$defs/__schema22" }, "limitations": { "$ref": "#/$defs/__schema24" }, "status": { "type": "string", "const": "changed" }, "left_digest": { "$ref": "#/$defs/__schema4" }, "right_digest": { "$ref": "#/$defs/__schema4" }, "text_delta": { "anyOf": [ { "$ref": "#/$defs/__schema25" }, { "type": "null" } ] }, "conclusion_kind": { "type": "string", "enum": [ "derived_relationship", "contradiction" ] } }, "required": [ "dimension", "left_count", "right_count", "evidence_links", "limitations", "status", "left_digest", "right_digest", "text_delta", "conclusion_kind" ], "additionalProperties": false }, { "type": "object", "properties": { "dimension": { "$ref": "#/$defs/__schema19" }, "left_count": { "$ref": "#/$defs/__schema20" }, "right_count": { "$ref": "#/$defs/__schema21" }, "evidence_links": { "$ref": "#/$defs/__schema22" }, "limitations": { "$ref": "#/$defs/__schema24" }, "status": { "type": "string", "const": "unknown" }, "left_digest": { "type": "null" }, "right_digest": { "type": "null" }, "text_delta": { "type": "null" }, "conclusion_kind": { "type": "string", "const": "unresolved_branch" } }, "required": [ "dimension", "left_count", "right_count", "evidence_links", "limitations", "status", "left_digest", "right_digest", "text_delta", "conclusion_kind" ], "additionalProperties": false } ] }, "__schema19": { "type": "string", "enum": [ "identity", "pseudocode", "assembly", "comments", "calls", "references", "strings_names", "cfg" ] }, "__schema20": { "anyOf": [ { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, { "type": "null" } ] }, "__schema21": { "anyOf": [ { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, { "type": "null" } ] }, "__schema22": { "minItems": 2, "type": "array", "items": { "$ref": "#/$defs/__schema23" } }, "__schema23": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema24": { "type": "array", "items": { "type": "string" } }, "__schema25": { "type": "object", "properties": { "added_lines": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "removed_lines": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "hunks": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "added_lines", "removed_lines", "hunks" ], "additionalProperties": false }, "__schema26": { "type": "array", "items": { "$ref": "#/$defs/__schema18" } }, "__schema27": { "type": "array", "items": { "type": "string" } }, "__schema28": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "__schema29": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "__schema30": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema31": { "type": "array", "items": { "type": "string" } }, "__schema32": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete" }, "diagnostics": { "$ref": "#/$defs/__schema33" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial" }, "limitations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema35" } }, "limited_directions": { "$ref": "#/$defs/__schema36" }, "diagnostics": { "$ref": "#/$defs/__schema33" } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "$ref": "#/$defs/__schema36" }, "diagnostics": { "$ref": "#/$defs/__schema33" } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema33": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema34" } }, "__schema34": { "type": "string", "minLength": 1 }, "__schema35": { "type": "string", "minLength": 1 }, "__schema36": { "anyOf": [ { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema37" } ], "items": { "$ref": "#/$defs/__schema38" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema39" } ], "items": { "$ref": "#/$defs/__schema40" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema41" }, { "$ref": "#/$defs/__schema42" } ], "items": { "$ref": "#/$defs/__schema43" }, "minItems": 2, "maxItems": 2 } ] }, "__schema37": { "type": "string", "const": "callers" }, "__schema38": { "anyOf": [ { "$ref": "#/$defs/__schema37" } ] }, "__schema39": { "type": "string", "const": "callees" }, "__schema40": { "anyOf": [ { "$ref": "#/$defs/__schema39" } ] }, "__schema41": { "type": "string", "const": "callers" }, "__schema42": { "type": "string", "const": "callees" }, "__schema43": { "anyOf": [ { "$ref": "#/$defs/__schema41" }, { "$ref": "#/$defs/__schema42" } ] }, "__schema44": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "__schema45": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "$id": "urn:rea:tool-output:sha256:38acaf16075998f0a9a7fd93443ffc404c0621a40de15fc248254f206b9e5bd8" } }, { "name": "compare_bundles", "title": "Compare Bundles", "description": "Compare two canonical Evidence bundles by exact record membership, explicit one-to-one observation pairs, and complete residual-unknown revision histories. Missing bundle members describe omission only, never behavioral equivalence; output is digest-anchored and returns every change inline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "find_changed_behavior", "title": "Find Changed Behavior", "description": "Aggregate validated process and artifact comparison Evidence. Runtime observations remain distinct from static behavior candidates; missing or incomplete comparisons produce unresolved findings, never causal claims. Returns every finding inline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "build_call_path", "title": "Build Call Path", "description": "Build every shortest direct-callee path inline from complete analyze_function Evidence records using exact canonical addresses. Missing dossiers and provider mixing remain unknown; every node and edge cites source Evidence.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "correlate_static_and_runtime", "title": "Correlate Static And Runtime", "description": "Evaluate every explicit caller-declared hypothesis between exact static comparison findings and runtime comparison dimensions. Similar names or paths are never auto-matched, consistent cochange never proves causality, and unknown or truncated inputs remain unresolved. Returns all correlations and their complete Evidence closure inline.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "verify_reconstruction", "title": "Verify Reconstruction", "description": "Verify a finite typed behavioral and structural specification against a canonical Evidence bundle. Pass means every declared claim has complete comparable authority—not global source equivalence; changed claims fail and missing, limited, or unresolved evidence stays unknown.", "inputSchema": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "specification": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "description": "Exact name used by this operation." }, "claims": { "minItems": 1, "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "claim_id": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9._\\x2d]*$" }, "title": { "type": "string", "minLength": 1 }, "comparison_evidence_id": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$", "description": "Exact Evidence identifier for the comparison observation." }, "kind": { "type": "string", "const": "behavioral" }, "dimension": { "type": "string", "enum": [ "overall", "terminal", "interaction", "exit", "filesystem", "process" ] } }, "required": [ "claim_id", "title", "comparison_evidence_id", "kind", "dimension" ] }, { "type": "object", "properties": { "claim_id": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9._\\x2d]*$" }, "title": { "type": "string", "minLength": 1 }, "comparison_evidence_id": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$", "description": "Exact Evidence identifier for the comparison observation." }, "kind": { "type": "string", "const": "structural-function" }, "dimension": { "type": "string", "enum": [ "overall", "identity", "pseudocode", "assembly", "comments", "calls", "references", "strings_names", "cfg" ] } }, "required": [ "claim_id", "title", "comparison_evidence_id", "kind", "dimension" ] }, { "type": "object", "properties": { "claim_id": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9._\\x2d]*$" }, "title": { "type": "string", "minLength": 1 }, "comparison_evidence_id": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$", "description": "Exact Evidence identifier for the comparison observation." }, "kind": { "type": "string", "const": "structural-artifact" }, "dimension": { "type": "string", "const": "overall" } }, "required": [ "claim_id", "title", "comparison_evidence_id", "kind", "dimension" ] } ] } } }, "required": [ "name", "claims" ] } }, "required": [ "specification" ], "additionalProperties": false, "examples": [ { "specification": { "name": "Terminal compatibility", "claims": [ { "claim_id": "terminal-output", "title": "Terminal output remains equivalent", "comparison_evidence_id": "ev_2ee844fcb1da7bad86a3d3c4216db8c670ac03658fb681ce5cf5c5d37b68e9c4", "kind": "behavioral", "dimension": "terminal" } ] } } ] }, "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "evidence_id": { "$ref": "#/$defs/__schema0" }, "subject": { "$ref": "#/$defs/__schema1" }, "provider": { "$ref": "#/$defs/__schema6" }, "analysis_profile": { "$ref": "#/$defs/__schema7" }, "predicate_type": { "$ref": "#/$defs/__schema10" }, "operation": { "$ref": "#/$defs/__schema11" }, "parameters": { "$ref": "#/$defs/__schema9" }, "raw_result": { "$ref": "#/$defs/__schema12" }, "normalized_result": { "$ref": "#/$defs/__schema13" }, "confidence": { "$ref": "#/$defs/__schema23" }, "authority": { "$ref": "#/$defs/__schema24" }, "environment": { "$ref": "#/$defs/__schema25" }, "limitations": { "$ref": "#/$defs/__schema26" }, "relationship_coverage": { "$ref": "#/$defs/__schema27" }, "locations": { "$ref": "#/$defs/__schema39" }, "evidence_links": { "$ref": "#/$defs/__schema40" } }, "required": [ "evidence_id", "subject", "provider", "analysis_profile", "predicate_type", "operation", "parameters", "raw_result", "normalized_result", "confidence", "authority", "environment", "limitations", "relationship_coverage", "locations", "evidence_links" ], "additionalProperties": false, "$defs": { "__schema0": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema1": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "enum": [ "hopper", "analysis-database", "mach-o", "elf", "pe", "dos-mz", "dos-com", "zip", "ipa", "apk", "msix", "appx", "hap", "hsp", "app-pack", "asar", "dmg", "pkg", "plist", "javascript", "source-map", "directory", "file", "unknown", "mach-o-universal", "javascript-bundle", "entitlements" ] }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false }, { "type": "object", "properties": { "name": { "$ref": "#/$defs/__schema2" }, "digest": { "$ref": "#/$defs/__schema3" }, "local_path": { "$ref": "#/$defs/__schema5" }, "format": { "type": "string", "const": "raw-binary" }, "architecture": { "anyOf": [ { "type": "string", "enum": [ "6502", "x86", "x86_64", "arm", "arm64", "mips", "riscv", "powerpc", "m68k", "hexagon" ] }, { "type": "null" } ] } }, "required": [ "name", "digest", "local_path", "format", "architecture" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema2": { "type": "string", "minLength": 1 }, "__schema3": { "type": "object", "properties": { "sha256": { "$ref": "#/$defs/__schema4" } }, "required": [ "sha256" ], "additionalProperties": false }, "__schema4": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "__schema5": { "type": "string", "pattern": "^[^\\x00]*$" }, "__schema6": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema7": { "anyOf": [ { "type": "object", "properties": { "provider": { "$ref": "#/$defs/__schema8" }, "parameters": { "$ref": "#/$defs/__schema9" }, "digest": { "$ref": "#/$defs/__schema4" } }, "required": [ "provider", "parameters", "digest" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema8": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }, "required": [ "id", "name", "version" ], "additionalProperties": false }, "__schema9": { "type": "object", "additionalProperties": {} }, "__schema10": { "type": "string", "minLength": 1 }, "__schema11": { "type": "string", "minLength": 1 }, "__schema12": { "anyOf": [ {}, { "type": "null" } ] }, "__schema13": { "type": "object", "properties": { "status": { "$ref": "#/$defs/__schema14" }, "specification_sha256": { "$ref": "#/$defs/__schema4" }, "summary": { "$ref": "#/$defs/__schema15" }, "claims": { "$ref": "#/$defs/__schema16" }, "recommended_probes": { "$ref": "#/$defs/__schema20" }, "evidence_links": { "$ref": "#/$defs/__schema21" }, "limitations": { "$ref": "#/$defs/__schema22" } }, "required": [ "status", "specification_sha256", "summary", "claims", "recommended_probes", "evidence_links", "limitations" ], "additionalProperties": false }, "__schema14": { "type": "string", "enum": [ "pass", "fail", "unknown" ] }, "__schema15": { "type": "object", "properties": { "total": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "passed": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "failed": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "unknown": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "behavioral": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "structural": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "total", "passed", "failed", "unknown", "behavioral", "structural" ], "additionalProperties": false }, "__schema16": { "type": "object", "properties": { "items": { "type": "array", "items": { "type": "object", "properties": { "claim_id": { "$ref": "#/$defs/__schema17" }, "kind": { "type": "string", "enum": [ "behavioral", "structural-function", "structural-artifact" ] }, "dimension": { "type": "string", "minLength": 1 }, "status": { "$ref": "#/$defs/__schema14" }, "observed_status": { "type": "string", "enum": [ "unchanged", "added", "removed", "changed", "truncated", "unknown", "contradiction" ] }, "comparison_evidence_id": { "$ref": "#/$defs/__schema18" }, "left_evidence_ids": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema18" } }, "right_evidence_ids": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema18" } }, "evidence_links": { "minItems": 2, "type": "array", "items": { "$ref": "#/$defs/__schema18" } }, "unknown_ids": { "type": "array", "items": { "$ref": "#/$defs/__schema19" } }, "limitations": { "type": "array", "items": { "type": "string" } } }, "required": [ "claim_id", "kind", "dimension", "status", "observed_status", "comparison_evidence_id", "left_evidence_ids", "right_evidence_ids", "evidence_links", "unknown_ids", "limitations" ], "additionalProperties": false } } }, "required": [ "items" ], "additionalProperties": false }, "__schema17": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9._\\x2d]*$" }, "__schema18": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" }, "__schema19": { "type": "string", "pattern": "^unk_[a-f0-9]{64}$" }, "__schema20": { "type": "array", "items": { "type": "object", "properties": { "operation": { "type": "string", "minLength": 1 }, "rationale": { "type": "string", "minLength": 1 }, "claim_ids": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema17" } }, "unknown_ids": { "type": "array", "items": { "$ref": "#/$defs/__schema19" } } }, "required": [ "operation", "rationale", "claim_ids", "unknown_ids" ], "additionalProperties": false } }, "__schema21": { "minItems": 2, "type": "array", "items": { "$ref": "#/$defs/__schema18" } }, "__schema22": { "type": "array", "items": { "type": "string" } }, "__schema23": { "type": "string", "enum": [ "observed", "derived", "inferred" ] }, "__schema24": { "type": "string", "enum": [ "shipped-artifact", "controlled-replay", "historical-reference", "external-service", "analyst-inference" ] }, "__schema25": { "anyOf": [ { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "platform": { "type": "string", "minLength": 1 }, "architecture": { "type": "string", "minLength": 1 }, "isolation": { "type": "string", "enum": [ "none", "process", "container", "virtual-machine" ] } }, "required": [ "id", "platform", "architecture", "isolation" ], "additionalProperties": false }, { "type": "null" } ] }, "__schema26": { "type": "array", "items": { "type": "string" } }, "__schema27": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "status": { "type": "string", "const": "complete" }, "diagnostics": { "$ref": "#/$defs/__schema28" } }, "required": [ "status" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "partial" }, "limitations": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema30" } }, "limited_directions": { "$ref": "#/$defs/__schema31" }, "diagnostics": { "$ref": "#/$defs/__schema28" } }, "required": [ "status", "limitations" ], "additionalProperties": false }, { "type": "object", "properties": { "status": { "type": "string", "const": "unknown" }, "reason": { "type": "string", "minLength": 1 }, "limited_directions": { "$ref": "#/$defs/__schema31" }, "diagnostics": { "$ref": "#/$defs/__schema28" } }, "required": [ "status", "reason" ], "additionalProperties": false } ] }, { "type": "null" } ] }, "__schema28": { "minItems": 1, "type": "array", "items": { "$ref": "#/$defs/__schema29" } }, "__schema29": { "type": "string", "minLength": 1 }, "__schema30": { "type": "string", "minLength": 1 }, "__schema31": { "anyOf": [ { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema32" } ], "items": { "$ref": "#/$defs/__schema33" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema34" } ], "items": { "$ref": "#/$defs/__schema35" }, "minItems": 1, "maxItems": 1 }, { "type": "array", "prefixItems": [ { "$ref": "#/$defs/__schema36" }, { "$ref": "#/$defs/__schema37" } ], "items": { "$ref": "#/$defs/__schema38" }, "minItems": 2, "maxItems": 2 } ] }, "__schema32": { "type": "string", "const": "callers" }, "__schema33": { "anyOf": [ { "$ref": "#/$defs/__schema32" } ] }, "__schema34": { "type": "string", "const": "callees" }, "__schema35": { "anyOf": [ { "$ref": "#/$defs/__schema34" } ] }, "__schema36": { "type": "string", "const": "callers" }, "__schema37": { "type": "string", "const": "callees" }, "__schema38": { "anyOf": [ { "$ref": "#/$defs/__schema36" }, { "$ref": "#/$defs/__schema37" } ] }, "__schema39": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "address" }, "address": { "type": "string", "minLength": 1 } }, "required": [ "kind", "address" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "address-range" }, "start": { "type": "string", "minLength": 1 }, "end": { "type": "string", "minLength": 1 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "artifact-path" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "kind", "path" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset" }, "offset": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "offset" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "file-offset-range" }, "start": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "end": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": [ "kind", "start", "end" ], "additionalProperties": false } ] } }, "__schema40": { "type": "array", "items": { "type": "string", "pattern": "^ev_[a-f0-9]{64}$" } } }, "$id": "urn:rea:tool-output:sha256:fef42683ceb16e115168fd5c384c021ab1142b9721c7292ac86a9784978c6218" } }, { "name": "list_unknowns", "title": "List Unknowns", "description": "List current residual-unknown heads in deterministic ID order, with optional exact status, severity, and domain filters. Results are complete inline by default; supply offset and limit to page the filtered order. total is the matching-head count and next_offset is null when the page exhausts the result. This is read-only; unresolved, contradicted, and non-truth dispositions remain distinct.", "inputSchema": "", "annotations": { "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "record_unknown", "title": "Record Unknown", "description": "Create one deterministic residual unknown and immutable mutation evidence. Validates all evidence and relationship references, and rejects duplicate stable identity.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": false }, "outputSchema": "" }, { "name": "update_unknown", "title": "Update Unknown", "description": "Append one immutable full-state revision and mutation evidence. Requires exact expected_revision; stale concurrent writers fail instead of overwriting newer analysis.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false, "openWorldHint": false }, "outputSchema": "" }, { "name": "verify_unknown_resolution", "title": "Verify Unknown Resolution", "description": "Revalidate the current residual-unknown head against live bundled evidence, exact authority/confidence/environment requirements, and revision integrity. Withdrawn and out-of-scope dispositions are not truth claims.", "inputSchema": "", "annotations": { "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "get_navigation_context", "title": "Get Navigation Context", "description": "Return the selected document, current address, and containing/current procedure in one provider-neutral result. The result reflects sequential provider observations, not an atomic cursor snapshot; a cursor outside any procedure returns procedure: null.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" }, { "name": "inspect_address_context", "title": "Inspect Address Context", "description": "Inspect one explicit reproducible address for its analyzed name, containing procedure, regular and inline comments, and matching bookmarks. Each unsupported facet returns a typed unavailable outcome; use xrefs, assembly, or pseudocode for those deeper views.", "inputSchema": "", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true, "openWorldHint": false }, "outputSchema": "" } ] }, "jsonrpc": "2.0", "id": 2 } }