Preface¶

When performing reverse engineering tasks in DeepSeek Harness (DSH), the common practice is to run rea setup --client dsh separately to write the REA MCP service into the home patch; skill files also need to be manually aligned with the morluto/rea repository. When turning off a specific section, the MCP and skills often manage themselves independently, and they are prone to conflicting with bundle entries in the plugin system regarding IDs.

Maintained by BJ1919810 and categorized as a workflow plugin, dsh-rea wraps the capabilities of morluto/rea into a DSH plugin. It provides a single toggle on the plugin page to simultaneously enable or disable the REA MCP service (207 reverse engineering analysis tools) and the three REA workflow skills. Changing the toggle does not require restarting DSH.

What is this¶

dsh-rea is a DeepSeek Harness plugin, version 1.0.0 (MIT). The skill content originates from morluto/rea (MIT), while this repository handles DSH integration and the one-click toggle.

When the plugin is turned off, the tools and skills disappear from the current profile together; when turned on, they are restored together. The plugin itself does not install engines like Ghidra, jadx, or apktool; like REA, it acts only as an adapter layer.

Core Functions¶

REA MCP Service¶

Launches the rea-agents MCP subcommand via a bundle patch, providing 207 reverse engineering related tools externally. It covers directions such as Ghidra, IDA, jadx, apktool, Frida, adb, pcap, firmware, browser, Electron, and managed code (specific availability depends on whether the corresponding engines are installed locally and environment variables are configured).

Three Workflow Skills¶

Enabled and disabled together with the MCP; the skill IDs remain consistent with the upstream:

• reverse-engineer-anything (includes 6 references)
• rea-tool-design
• rea-changelog-update

At runtime, lib/index.js parses the frontmatter; skills/ is a verbatim copy of morluto/rea’s .agents/skills/.

Cross-platform Launcher¶

cordis.patch.yml uses expressions to select the launch method based on the platform: Windows calls npx via cmd.exe, while other platforms use npx directly. The author has tested on Windows x64 that the expression evaluates correctly and the 207 tools are available; the npx branch for macOS / Linux has not been tested.

Installation and Activation¶

This repository is not published to npm. The GUI uses --profile desktop; for TUI, change to --profile tui.

Method 1: Install from GitHub (The author notes that it has not been separately verified whether the DSH supply chain uniformly allows this; on 2026-10-16, pnpm installation was tested to be successful and allowed by policy):

dsh plugin --profile desktop add github:BJ1919810/dsh-rea

Method 2: Clone and install via local path (Marked by the author as the most stable; tested environment is Windows x64 + DSH Desktop + REA 6.5.0):

git clone https://github.com/BJ1919810/dsh-rea
dsh plugin --profile desktop add file:D:/path/to/dsh-rea

Pinning the version (The repository is tagged):

dsh plugin --profile desktop add github:BJ1919810/dsh-rea#v1.0.0

After installation, dsh-rea will appear on the plugin page, and the toggle is the master switch.

Uninstall:

dsh plugin --profile desktop remove dsh-rea

It will not delete your self-provided engine directories.

Prerequisites and Variables¶

Common combinations (Excerpted from README):

The plugin does not hardcode paths. The REA MCP inherits the DSH process environment; please set the variables as user or system environment variables before starting DSH. Example:

GHIDRA_INSTALL_DIR   = D:\tools\ghidra_12.1.4_PUBLIC
JAVA_HOME            = D:\tools\jdk-21
REA_JADX_MCP_JAR     = D:\tools\jadx-headless-mcp-0.7.1-all.jar
REA_APKTOOL_COMMAND  = D:\tools\apktool\apktool.cmd
REA_ADB_PATH         = D:\Android\Sdk\platform-tools\adb.exe

Only configure the items actually used. Check readiness:

npx -y rea-agents@latest doctor --json

You can install and start the MCP without setting variables, but the corresponding tools will fail with capability_unavailable and explain in the prompt which variable should be set. Restarting DSH is required after modifying environment variables (environment is only read at startup).

Conflicts with Home Patch¶

If rea setup --client dsh was previously executed, REA may write a self-managed rea-mcp into ~/.dsh/cordis.patch.yml, which conflicts with the plugin entry ID and is not controlled by the plugin toggle. Before using this plugin, you should delete that configuration from the home patch and restore the file to:

[]

The home patch cannot be left as an empty file or pure comments, otherwise DSH will fail to start; when disabling this layer, you must write [].

Typical Usage and Verification¶

1. Install the plugin and turn on the toggle. The author tested: When ON, rea-skills / rea-mcp appear in cordis.yml; when OFF, both entries disappear, and calls report unknown tool.
2. Call reverse engineering tools via MCP in the conversation (e.g., inspect_apktool_client); when configured correctly, it can return the local apktool version information.
3. When workflow guidance is needed, rely on the three enabled skills (e.g., reverse-engineer-anything and its references).

For maintainers to sync upstream skills:

node sync-skills.mjs D:\path\to\rea-checkout
node test/smoke.mjs

Use Cases and Notes¶

Suitable for developers who are already doing reverse engineering in DSH, wish to have a unified toggle for MCP and skills, and are willing to self-provision analysis engines. The plugin runs with the current DSH process permissions; please read the repository source code, LICENSE, and LICENSE-REA / NOTICE before installing to confirm licensing and origin.

Node requirement: >=22.19.0 (see package.json). The author has not tested the full runtime path on macOS / Linux; if there are issues with expression launching, you can change the launcher in cordis.patch.yml to a literal string according to the README (see comments in the file).

The community directory dsh-rea page on SkillHub and the GitHub repository are independent of each other and are not an official DeepSeek / High-Flyer app store; the DSH ecosystem philosophy is “everything is a plugin,” so you can obtain them from the directory or repository as needed.

Conclusion¶

dsh-rea consolidates REA’s MCP and three workflow skills into a single toggle on the plugin page, reducing the friction of home patches and skill versions managing themselves separately; engines must still be self-provisioned locally and configured with environment variables according to the documentation.

• Directory Page: https://www.skillhub.cn/plugins/BJ1919810/dsh-rea
• GitHub: https://github.com/BJ1919810/dsh-rea