rea-jev

rea-jev

Reverse-engineer anything with agents, with a System 1 reflex layer.

rea-jev is a Claude Code plugin that pairs REA (Reverse Engineer Anything: the rea-agents CLI and MCP server for Hopper/Ghidra native analysis, Electron and JavaScript bundles, .NET assemblies, Android packages, browser observation, and evidence ledgers) with Jev, TypeSafe's System One decision model.

Claude does the System 2 reasoning. Jev answers small typed questions in about 300 ms, for about $0.00005 a call, at the four points where a wrong reflex is cheap to prevent and expensive to miss: routing the target before Claude thinks, gating a risky REA call before it runs, classifying a result as evidence after it lands, and checking whether "done" was earned before the turn ends. Everything deterministic stays in code; Jev only handles the semantic middle; every hook fails open.

Architecture

user prompt ──► [UserPromptSubmit hook: Jev routes target+workflow] ──► Claude (System 2, skill loaded)
                                                                            │
                   ┌────────────────────────────────────────────────────────┤ calls REA MCP tools
                   ▼                                                        ▼
   [PreToolUse hook: deterministic rules → Jev scope/risk gate]   [PostToolUse hook: Jev scores evidence,
                                                                   flags unknowns + injected text, ledger]
                                                                            │
                                      Claude also calls `jev rank|classify|verify` directly on evidence
                                                                            │
                                     [Stop hook: Jev checks claims vs ledger; blocks unverified "done"]

The plugin bundles the reverse-engineer skill (the System 2 playbook), five hooks and a jev CLI (System 1), REA's MCP server pinned to one version, two subagents (rea-investigator, rea-verifier), and two commands (/rea-jev:setup, /rea-jev:investigate). docs/architecture.md has the full picture; DESIGN.md is the authoritative spec. docs/user-guide.html is the user guide, with recorded examples for every target type.

Install

claude plugin marketplace add juan-viox/rea-jev
claude plugin install rea-jev@rea-jev

Then set one key. Claude Code asks for the TypeSafe key when it enables the plugin; or export one of these before starting Claude Code:

Restart Claude Code, then run /rea-jev:setup once. It checks the Jev round trip, REA's own readiness (Hopper or Ghidra for native binaries), hook registration, and whether REA is registered twice.

Requirements: Node 22 or newer (REA needs 22.19+); macOS or Linux. Without a Jev key the plugin still works as plain REA plus the skill: hooks stay silent.

The four System 1 decision points

SessionStart adds one line of status (mode, provider present, REA pin) and never calls Jev. The full question catalog with thresholds and overrides is in docs/decision-points.md.

The jev CLI

System 2 asks System 1 directly. Claude runs these through Bash; the skill shows when. Human-readable output by default, --json for machines. Exit 0 on answers, 1 on usage error, 2 on provider failure.

Invoke as node "${CLAUDE_PLUGIN_ROOT}/scripts/jev.mjs" <command> from inside Claude Code. All commands redact secrets before sending and refuse item files over 2 MB unless --force.

Modes

Set with the plugin option mode or REA_JEV_MODE.

Environment variables

How this relates to REA

• REA is consumed as the published npm package rea-agents, pinned in .mcp.json and in data/rea-tool-catalog.json (207 tools from 6.5.0). The plugin does not vendor REA's source; bumping the pin is a documented procedure in docs/upstream-rea.md.
• If you already ran rea setup for Claude Code, REA is registered twice (the global rea server and the plugin's bundled one). The hooks match both tool name forms, so either works alone; keep exactly one. /rea-jev:setup walks through it.
• REA's own skill, reverse-engineer-anything (installed by rea setup), stays the canonical tool-by-tool guide. The reverse-engineer skill here is the System 1 loop on top of it: route, hypothesize, probe, classify, ledger, verify, finish or build. It links to REA's guide rather than duplicating it, and its tool catalog is generated from REA's own descriptions.

Limits and honesty

• Jev is a System One model. It does not write code, generate text, or explain anything. It returns probabilities for typed questions (Noul, Choice, Score). Every route note, gate question, and evidence note here is advisory data with a confidence attached; code, and then Claude, decide what to do with it. Jev will be wrong sometimes, and the thresholds in v0.1.0 are defaults, not calibrated on a labeled corpus. REA_JEV_LOG=1 and jev stats exist so you can tune them on your own decisions.
• Hooks fail open. No key, a timeout, a 4xx or 5xx, or a malformed answer means the hook exits 0 and emits nothing (answers are validated against the questions; an out-of-range or foreign value counts as no opinion). A hook that blocks by accident costs more trust than one that misses a case. In advise the only denies are local and deterministic: an identical repeated inspection call, and a non-loopback cdp_endpoint/inspector_endpoint on any REA tool. enforce adds one Jev-based deny: a runtime or extraction call whose within_scope falls below T_GATE_SCOPE with a decisive answer (confidence at or above the confirm band) while a target is declared; a near-coin-flip, or a session with no declared target, only asks. The Stop hook likewise blocks only on decisive answers and never when your message cites the Evidence IDs that were returned.
• What leaves the machine. Only the fields each question needs: a prompt excerpt (at most 3000 chars), the REA tool name with a redacted input excerpt (1500), a redacted result excerpt (6000, head and tail), the final message (4000), and your last reverse-engineering request (at most 1200 chars). Secrets (sk-…, sk_live_…, ghp_…, glpat-…, AKIA…, AIza…, xox?-…, JWTs, bearer tokens, password=/token=/cookie= pairs, private key blocks, URL userinfo) are masked before sending, and URLs in prompts lose their credentials and query strings before they reach a hint, the ledger, or Jev. The analyzed binary is never uploaded; REA itself analyzes locally. With OpenRouter, requests transit OpenRouter. The ledger on disk holds hashes, Evidence IDs (at most 64 per result), excerpts of at most 200 chars, and one 1200-char redacted copy of your request per prompt, never full tool inputs or outputs. The PostToolUse hook reads at most 32 MB of a result; a larger one is recorded from its prefix (tool, input hash, size) and not judged.
• Cost and latency. About $0.042 per million input tokens, output free; one call is roughly 1 to 3k tokens, so a few hundredths of a cent, in about 300 ms. Inspection calls never cost a Jev request.
• Not in v1. Compaction of REA outputs, model or effort routing, auto-approval of REA inspection calls, Windows hooks (untested), running REA itself in tests. The roadmap is in DESIGN.md.
• Scope and ethics. Analyze only software you are entitled to analyze (your own, licensed for interoperability or security research, or explicitly permitted). The skill says so and the gate asks when a scenario reaches outside the declared target.

Development

Zero runtime dependencies, Node 22+, ESM .mjs, no build step.

npm test            # node --test "tests/*.test.mjs"   (offline, against tests/fake-jev.mjs)
npm run validate    # node scripts/validate.mjs
node scripts/validate.mjs --write-catalog   # regenerate the skill's tool catalog from data/

validate.mjs checks that the manifests parse, every hook command points at an existing script, the hook matcher accepts both REA tool-name forms, the skill frontmatter is well formed, the .mcp.json pin equals the catalog version, every backticked tool name in the skill and agents exists in the catalog (with a documented allowlist for REA's Android tools), and the generated catalog is current. CI runs both commands on Ubuntu with Node 22.

License

MIT. See LICENSE.

Credits

• morluto/rea, Reverse Engineer Anything, for the tools, the evidence model, and the reverse-engineer-anything skill this one builds on.
• TypeSafe for Jev and the System One guidance on atomic questions, confidence routing, and state design.
• The Jev hook projects whose patterns informed this one: jev-auto-approve (allow-or-silent PreToolUse that never denies, hard deny-lists before the model), jev-axi (local rules first, Jev for the semantic middle, guard for text that reads as instructions), and jev-belay (an evidence-gated Stop hook that establishes facts before asking whether "done" is earned).