dsh-rea
A DSH bundle that puts the whole Reverse Engineer Anything (REA) stack — the rea
MCP tool server and the reverse-engineer-anything skill — behind one toggle in
the Plugins manager, pre-trimmed so enabling it never floods your context.
REA turns Ghidra (and friends) into agent
tools for reverse engineering. Out of the box its MCP server advertises 229 tools
(~302 KB ≈ 75k tokens) to every session. This bundle starts it through a vendored
filtering proxy instead, so you get the same capability for a few thousand tokens.
What you get
| Row id | Plugin | What it adds |
|---|---|---|
rea-mcp |
@deepseek-ai/dsh-mcp-client |
The rea stdio MCP server, started through mcp/rea-tool-filter.mjs — never rea mcp directly. You see ~16 curated mcp__rea__* tools; load_rea_tools/presets pull the rest on demand. |
rea-skills |
@deepseek-ai/dsh-skill-filesystem |
The vendored reverse-engineer-anything skill, served from this bundle's skills/ only (includeDefaultRoots: false, providerName: rea). |
Install
- Prerequisites (once per machine, outside DSH): a Ghidra install folder and a
JDK 21+, plus REA itself:
npm i -g rea-agents
Tell REA where Ghidra lives — set GHIDRA_INSTALL_DIR to the Ghidra folder (or
use the fallback/edit the knobs below).
2. Install the bundle — full CLI command (desktop app or web app):
dsh plugin --profile desktop add @codemody/dsh-rea
dsh plugin --profile web add @codemody/dsh-rea
Or paste the package name @codemody/dsh-rea into the Plugins manager's
install field — like the other bundles here.
- Restart the harness, then start a new session: you should see the
mcp__rea__*tools and the REA skill. Disabling the bundle makes both disappear
from sessions started afterwards (~8k saved vs. not having REA at all).
> Note: like the other bundles here, the patch uses a literal path into the
> default desktop profile (…\.dsh\profiles\desktop\node_modules\@codemody\dsh-rea\…,
> built from %USERPROFILE%). If you rename the profile, move .dsh, or install
> into the web profile, swap the desktop segment in args and
> bundledSkillDir in cordis.patch.yml.
Machine knobs (point at your own Ghidra)
Every path in cordis.patch.yml is a !!js expression that prefers a Windows
environment variable and falls back to the literal this bundle was built on — so on a
fresh machine you either set the variable (System → Environment → user variables) or
edit the fallback. Expressions evaluate when the row activates, and editing the row
config in Settings reloads the connection in place.
| Env var | Fallback if unset | Meaning |
|---|---|---|
GHIDRA_INSTALL_DIR |
C:\ghidra_12.1.4_PUBLIC |
Your Ghidra installation folder — the main knob |
DSH_REA_JAVA_HOME |
C:\Users\CodeMody Laptop\.jdks\openjdk-26.0.1 |
JDK 21+ for REA's Ghidra provider, passed to REA as JAVA_HOME. Deliberately not the global JAVA_HOME — on this machine (and many others) it still points at a JDK 17 that REA cannot use. |
REA_FILTER_NODE |
C:\Program Files\nodejs\node.exe |
Node used for the proxy AND the REA child |
REA_FILTER_SCRIPT |
...\AppData\Roaming\npm\node_modules\rea-agents\scripts\rea.mjs |
Where npm installed rea-agents |
USERPROFILE |
(always set on Windows) | Builds the ~\.dsh\profiles\desktop\… paths for args and bundledSkillDir |
Context diet (why it stays small)
- The MCP row is the proxy, so the plugin can never come back in the unfiltered
229-tool form. Edit the curated set insidemcp/rea-tool-filter.mjs
(DEFAULT_TOOLS,PRESETS); aREA_FILTER_TOOLSenv value overrides it entirely. - The row pins
REA_ANALYSIS_PROVIDER=ghidra, the compact input-schema profile, and
theoffoutput-schema profile — they are what keep each schema tiny. - The numbers (229 tools, REA 6.8.0, skill v49) describe the REA release this bundle
was cut for; they are documentation, not pinned versions.
Scope and removal
- The toggle affects sessions started afterwards; existing sessions keep the tool
catalog they started with. - Uninstall: Plugins →
@codemody/dsh-rea→ uninstall (orplugin_manager
remove_bundle). Nothing of the bundle stays behind beyond pnpm's own files. - History for this machine: before the bundle, REA lived in
~\.dsh\cordis.patch.yml
(written byrea setup --client dsh),~\.agents\skills\reverse-engineer-anything,
and~\.dsh\rea-tool-filter.mjs. All three were removed once the bundle took over.
Do not runrea setup --client dshagain — it would recreate an unfiltered
global patch file; if that happens, delete~\.dsh\cordis.patch.ymland restart.
Compatibility
- DSH:
0.2.2-rc.1, Windows; the patch builds its profile paths from
%USERPROFILE%\.dsh\profiles\desktop\…, so it targets thedesktopprofile —
for thewebprofile (or a renamed one) swap thedesktopsegment in
args/bundledSkillDir. - Prerequisites:
rea-agentson npm (cut for REA 6.8.0), a Ghidra install
(tested with 12.1.4), and a JDK 21+ — see Machine knobs. - Permissions: spawns one stdio child process (the filtered
reaMCP
server); no network access of its own beyond what REA does. - License: MIT (LICENSE); the vendored skill is from
rea-agents, see Provenance.
Provenance
skills/reverse-engineer-anything/ (SKILL.md + references/) is vendored from the
rea-agents package's DSH skill directory (skill version 49) — after a REA upgrade,
re-copy the skill folder if you want the new instructions. The bundle packaging
(patch, proxy, locales, icon) is MIT licensed.
