# Reverse Engineering Instructions — MRPS Agent Toolkit

## Overview
Inspecting compiled artifacts: native binaries, Electron/JS bundles, Android APKs,
WebAssembly, and undocumented runtime APIs.

## Category & Tools
- **Tools**: `rea` (`kind: mcp-server`) — endpoint `npx -y rea-agents@latest`
- **Category**: `reverse-engineering`
- **ID prefix**: `rev` · **Report slug**: `reverse`
- **Produces findings**: no list — it produces *understanding* of a named artifact

## When to Reach for What
Reach for `rea` when the source is not available and the question is about behaviour:
what an artifact does, what it talks to, what it hides, how two revisions differ.

## When NOT to use
Standard source audits, or any repo where the source is already present. Use
`code-analysis` instead — it is cheaper and more accurate.

## Authorization (read this before anything else)
- Only artifacts the user owns, or whose license permits analysis.
- Never analyze malware, or a third party's binary, on the user's behalf.
- If ownership is unclear, stop and ask. This is not a category where guessing is acceptable.

## What Inspect means here
Read-only: headers, exported symbols, disassembly, bundled metadata, embedded strings,
network endpoints. No execution of untrusted binaries, no patching.

## The ladder, applied here
- **Inspect** — map the artifact. Read-only.
- **Critique** — undocumented dependencies, hidden channels, weak crypto, proprietary protocols.
- **Recommend** — document the reconstructed interface, type schema, or mitigation.
- **Fix** — **never** patch a binary. Any defensive change is written and approved in source.

## Tool Guidance: REA
### Invocation
```bash
npx -y rea-agents@latest setup
# then connect the agent to the REA MCP server and inspect a named target
```

REA works on a **named artifact**, not a repository root. Do not point it at `.` and
expect a scan.

## Evidence rules
Every finding cites: the artifact path, its hash, and the locator — symbol, offset, or
string. Example: `app.bin · sha256:9f2c… · .text+0x1a40`.

## Report example
```markdown
# reverse — 2026-11-09T14-32-05Z

Prior: none (first run)
Toolchain: REA MCP (rea-agents 6.8.0)
Delta: +1 new · 0 still open · 0 resolved · 0 not checked

## What was found (plain English)
- **rev-01** — The app ships a hardcoded encryption key, so anyone with the binary can decrypt its traffic. (High)

## What changed since last run
- First run.

## Technical detail
| ID | Sev | Evidence | File | Rule | Status |
|----|-----|----------|------|------|--------|
| rev-01 | H | sha256:9f2c… · .rdata+0x1a40 | target/bin/app | hardcoded-credential | NEW |

## Commands run
| Command | Exit | Note |
|---------|------|------|
| rea inspect target/bin/app | 0 | 214 symbols |

## Not checked
- Runtime behaviour — artifact not executed.

Generated by <agent name>. Read-only. No source files were modified.
Findings are advisory; the user decides what to fix.
```