Introduction¶

When integrating reverse-engineering analysis capabilities into DSH, the common practice is to simply run npx -y rea-agents@latest to launch the MCP. Each session may silently switch to a new version; if tool parameters, Evidence handling, or default values change, it becomes difficult to distinguish whether the target changed or the tool changed. There is also no “upgrade only when you click” layer on the supply chain. For a toolchain dedicated to producing reasoning evidence, “always latest” is often not the right default.

Below we introduce the community plugin dsh-rea-agents (maintainer: appthin). It pins REA (rea-agents) to the exact version recorded in your profile, launches the MCP from that copy (the README states it bundles around 207 reverse-analysis tools), and the version only advances when you press “Update” on the plugin card.

What Is This¶

dsh-rea-agents is a DeepSeek Harness plugin for REA integration, categorized under model reasoning. It does not install analysis engines such as Ghidra or jadx. Instead, it: pins the dependency inside the current profile with pnpm add rea-agents@<version> --save-exact, manages install/update/uninstall from the card, and registers the two loaders rea-agents and rea-agents-mcp through a bundle patch, so that the MCP subprocess launches from the pinned copy on disk. The launcher does not consult PATH and does not access the network.

The plugin’s current npm version is 1.0.8 (see the repository’s package.json). Directory page: skillhub.cn/plugins/appthin/dsh-rea-agents; source code: github.com/appthin/dsh-rea-agents.

Core Features¶

The plugin master switch is a master gate: turning it off removes both the MCP service and the REA section on the card; turning it on restores them. In general, no DSH restart is needed.

Version and Environment Requirements¶

• DSH: >= 0.1.6-alpha.1 and < 0.3.0 (peerDependencies are already declared for the pre-release branch).
• This plugin Node: >= 22.19.0.
• rea-agents: itself declares ^22.19.0 || ^24.11.0 || >=26.0.0; if it doesn’t match, the page will warn before installation.

Installation and Activation¶

First install the plugin, then install the REA package itself on the card—the two steps must not be confused.

1. Install the DSH Plugin¶

Desktop: Sidebar → Plugins → Add in the top-right → enter the source and install. The Desktop profile is exclusively owned by Electron; dsh plugin --profile desktop … will be rejected by the CLI, so please install inside the app.

web / tui and other profiles (command line):

# npm package (available after release)
dsh plugin --profile web add dsh-rea-agents

# GitHub repository
dsh plugin --profile web add github:<your-account>/dsh-rea-agents

# Local directory (link, suitable for development and debugging)
dsh plugin --profile web add file:D:/path/to/dsh-rea-agents

After installation, restart dsh or wait for the profile to hot-reload, then open Plugins → dsh-rea-agents to view the card.

2. Install REA on the Card¶

Click Install on the Plugins → dsh-rea-agents card. The plugin will write the dependency and run pnpm add rea-agents@<version> --save-exact.

If pnpm is not in PATH, set DSH_PNPM_PATH to point to the pnpm executable.

3. Verification¶

The card should show a “REA version” section. If it does not, follow the README’s suggested troubleshooting order:

1. dsh plugin --profile web ls to confirm it was installed into the profile you are using;
2. Restart dsh once;
3. Visit http://127.0.0.1:<port>/rea-agents/diagnose and determine which step is blocked based on graph.selfPresent, gates, and selfRows.

Confirm that the MCP has been registered on the model side. You can ask the assistant in DSH to run:

List your mcp__rea__ tools and call mcp__rea__binary_session with empty arguments {} to see what it returns.

If the mcp__rea__-prefixed tools are listed and binary_session returns session information (rather than “this tool does not exist”), the chain is working.

Updating and Uninstalling the Plugin¶

dsh plugin --profile web ls
dsh plugin --profile web add dsh-rea-agents      # update the plugin itself
dsh plugin --profile web remove dsh-rea-agents   # uninstall the plugin

Typical Usage and Bringing Your Own Engines¶

REA is an adapter layer: when an engine is missing, the corresponding tool will report provider_unavailable, and the message will state which environment variable needs to be set. Common items you need to provide yourself include Ghidra 12.1.x + JDK 21+ (or IDA), apktool, jadx, adb, tshark, sigrok-cli, binwalk/unblob, WABT, etc. Please set the user or system environment variables before starting DSH; the MCP subprocess inherits the harness process environment (some credential-shaped variables will be sanitized, but REA-related path variables are not in the sanitization scope).

Example (PowerShell; adjust the paths for your machine):

GHIDRA_INSTALL_DIR     = D:\tools\ghidra_12.1.4_PUBLIC
JAVA_HOME              = D:\tools\jdk-21
REA_JADX_MCP_JAR       = D:\tools\jadx-headless-mcp-0.7.1-all.jar
REA_APKTOOL_COMMAND    = D:\tools\apktool\apktool.cmd
REA_ADB_PATH           = D:\Android\Sdk\platform-tools\adb.exe
REA_TSHARK_COMMAND     = D:\tools\Wireshark\tshark.exe
REA_CAPINFOS_COMMAND   = D:\tools\Wireshark\capinfos.exe
REA_SIGROK_COMMAND     = D:\tools\sigrok\sigrok-cli.exe
REA_WABT_BIN_DIRECTORY = D:\tools\wabt\bin

If the engines are installed but tools are still unavailable, you need to restart DSH (environment variables are only read at startup).

When installing REA, pnpm may report ERR_PNPM_IGNORED_BUILDS for the optional dependency frida: the package is installed and the CLI can start, but only the runtime-instrumentation tools that depend on Frida bindings are unavailable. The plugin judges installation success based on the on-disk result.

Use Cases and Cautions¶

Who it’s for: security research or binary analysis workflows that need to use the REA reverse-engineering toolchain stably within DSH conversations, while wanting auditable versions, the ability to roll back, and the ability to compare results across sessions.

Permissions and security: The plugin runs with the permissions of the current dsh process; the loopback API only responds to local requests. Before installing, please review the source code and MIT license yourself, and understand that it only adds the single rea-agents dependency to the profile and does not read or write the cordis.patch.yml patch layer (the loader entries are provided by the plugin’s bundle patch).

Ecosystem note: The DSH community plugin directory (such as SkillHub) is an independent site with no official affiliation with DeepSeek / High-Flyer. This article describes a community-maintained integration approach, not an official app store entry.

Conclusion¶

If you are already using rea-agents@latest and have never encountered version drift or supply-chain concerns, you can continue with the existing approach. If you want “the version shown on the page to be exactly the copy the MCP will launch,” and want upgrades to require an explicit click, dsh-rea-agents turns this into a fixed flow on the plugin card.

• Directory page: https://www.skillhub.cn/plugins/appthin/dsh-rea-agents
• GitHub: https://github.com/appthin/dsh-rea-agents