ReversePort

Reconnaissance of a folder: detects the engine/framework (Godot, Unity, Unreal, GameMaker, RPG Maker, Ren'Py, LÖVE, Defold, Bevy, MonoGame, three.js/Phaser/Electron, Flutter, .NET, Go, Rust, Python…) for source projects AND exported game builds, languages with line counts, file categories, entry points, biggest files and binaries. Start here.

Builds the dependency graph of a project: imports/includes/requires, Godot res:// loads and scene resources, Unity script/prefab GUIDs, and type references (C#, GDScript class_name/autoloads, Java…). JS/TS monorepos: imports of workspace packages by name, tsconfig paths aliases, package.json #imports and Deno import maps resolve to their files, and a workspace section shows which package uses which. Returns entry points, cycles, orphans, most-used files, external packages and the port order (dependencies first). format:"mermaid" adds a diagram.

Code structure for one file or a whole folder (30+ languages: GDScript, C#, C/C++ incl. Unreal macros, Python, JS/TS, Lua, Java/Kotlin, Go, Rust, Swift, shaders, Ren'Py…): classes with base classes, functions with lines, signals/events, exported/serialized fields, dependencies, node paths. match filters by name (substring or * wildcard).

Reads Godot .tscn/.tres/project.godot (Godot 3 and 4) and Unity .unity/.prefab/.asset (text serialization) into one neutral tree: node names, types, scripts, transforms (position, quaternion, scale), components, groups/tags, instanced scenes/prefabs (resolved through .meta GUIDs), signal connections, plus a mermaid diagram.

Inspects PE/EXE/DLL (incl. .NET assemblies: runtime, types and methods), ELF, Mach-O (incl. universal), WebAssembly, Java .class, Android .dex, Lua/LuaJIT and Python bytecode: architecture, sections with entropy, imports/exports, PDB path, signing, overlay data (e.g. an embedded game pack), toolchain/engine hints and strings. Read-only: it does not unpack, decrypt or patch.

Lists or extracts game packs and archives. Godot .pck (also embedded in an exported .exe/.x86_64; MD5-checked). Unity asset bundles (UnityFS, LZ4/LZMA) and serialized files (data.unity3d, level0, sharedassets0.assets, globalgamemanagers): every object by class and name, bundle container paths, the C# scripts MonoBehaviours use (with counts), the build's scene list; extract writes Texture2D as PNG (DXT1/5, BC4/5, ETC1/ETC2/ETC2+EAC, 8-bit raw formats; ASTC as .astc, BC6H/BC7 as .dds, others raw), Mesh as OBJ (with type trees), AudioClip as its FSB5 bank, TextAsset as text and other objects as JSON (bundles) or raw bytes (player builds strip type trees). ZIP family (apk, jar, ipa), tar/tar.gz (.unitypackage), Electron .asar, Ren'Py .rpa, GameMaker data.win (PNG/QOI, WAV/OGG), FMOD .bank and .fsb (PCM as WAV), Wwise .bnk, Unreal .pak v1–v11 (stored/Zlib extract), Flash .swf (CWS and ZWS inflate), Unity WebGL and Emscripten .data. Encrypted packs/entries are reported, never decrypted.

For unknown or custom formats: identifies the format at an offset, hex view, entropy map (text/code/compressed regions), embedded files (PNG, OGG, WAV, ZIP, GDPC, glTF, DDS, ELF/PE…) with offsets and sizes, and likely record strides for tables. Works on multi-GB files.

Copies a byte range (e.g. an embedded PNG/WAV/glb/ZIP found by re_probe) into the workspace as its own file. length is optional when the embedded format stores its size (RIFF/WAV, glb, PNG). To unpack a whole archive or pack, use re_archive with action:"extract" instead.

Compares two folders (added/removed/changed files), two packs/archives (entries, MD5 for Godot packs), two executables (imports, exports, sections; for .NET also the types and methods that came and went) or any two files (first difference, changed regions). Use it to see what changed between builds or versions.

Audits a Unity project's GUID references: references to GUIDs no .meta file declares (dangling: missing scripts, pink materials), the same GUID in two .meta files (copies made outside Unity), assets without a .meta, .meta files whose asset is gone, and declared assets nothing references. For dangling script references it suggests scripts that nothing references. Reports only; nothing is written. Fix by re-linking in Unity or by setting the suggested guid in the right .meta.

Localisation: extracts user-facing text with stable ids from Godot scenes/resources and GDScript (text, tooltips, tr()), Unity YAML (m_Text, TextMeshPro) and C#, RPG Maker MV/MZ data (Show Text, choices, database names, terms), Ren'Py scripts (say, menu), web code and i18n JSON files. Writes a catalog plus .pot (gettext) and/or CSV with file:line references and placeholder hints. action:"apply" takes a translated .po/.csv/.json and writes a translated COPY of the project into out, checking placeholders and flagging strings that grew a lot. The source is never modified.

Checks GDScript (and class names in C#, names in shaders) against name-only snapshots of the real Godot API (godot@3, [email protected], [email protected]) plus the official 3→4 rename table. Reports: renamed-class/function/member/pattern (Godot 3 names in Godot 4 code with the Godot 4 replacement: KinematicBody2D, instance(), yield, deg2rad, string connect, export/onready without @), unknown-class/method/member (not in that version: a model-invented or misspelled API, with the closest real name), too-new (exists only in a newer version, or Godot 4 names in a Godot 3 project). Members are checked only where the receiver type is known (extends, typed vars, Class.new(), singletons, parameters with type hints); untyped receivers are skipped, not guessed. The Godot version comes from engine, else from project.godot, else the newest snapshot. Run it on every file an agent wrote before opening Godot.

Converts a Godot 3.x project to Godot 4 as a COPY (the source is never modified): the official rename table for classes, builtin types, functions, properties, signals, enums, colors, theme overrides, project settings and shader names; export/onready/tool → @annotations with typed hints; yield → await; instance → instantiate; string connect/disconnect/emit_signal → signal.connect(callable)/emit; Pool*Array → Packed*Array; OS time functions → Time; .shader → .gdshader (references updated); scenes to format 3 with renamed node types and properties; project.godot to config_version 5 with the input map keys. What cannot be converted mechanically is listed with file and line and how to do it: setget, funcref, move_and_slide with arguments, var velocity in CharacterBody scripts, Tween nodes, binds, RPC keywords, networking, SCREEN_TEXTURE, window functions. action:"check" only reports. Follow with re_apicheck on the copy and open it in Godot 4.

Peels the open layers of a save file (gzip/zlib, base64, LZ-String as RPG Maker MV/MZ uses, JSON, XML, INI/ConfigFile, Godot store_var) and lists every field with type, sample and a guessed role (health, currency, score, position, progress, collection, time, version, identity, integrity, rng, settings). Checksum fields are verified by recomputing md5/sha1/sha256/crc32 over the save without that field; binary saves are checked for CRC32 trailers/headers and get record strides and strings. compare:<second save> lists the fields that changed between two saves, the fastest way to learn which field is which. action:"schema" writes a JSON schema plus SaveData.gd and SaveData.cs with the same field names, to port the save format. Encrypted, XOR-obfuscated, .NET BinaryFormatter and pickle content is reported, never decoded.

Turns what a Godot export leaves into editable text: compiled GDScript (.gdc: Godot 3 bytecode v10–13 and Godot 4.3+ binary tokens v100/v101, zstd-compressed or not) back to .gd with indentation, binary resources and scenes (RSRC/RSCC .scn/.res, also under .godot/exported with their .remap targets) to .tscn/.tres with ext/sub resources, node tree, groups, instances and signal connections, and project.binary to project.godot. Give the folder re_archive extracted from the .pck. Names, constants and structure are exact; comments and the original formatting are not in the export. Encrypted scripts (.gde) are reported, never decrypted.

Reads a Unity IL2CPP global-metadata.dat (metadata versions 24–31; sections are recognised by validating their records, not by fixed offsets): assemblies with type counts, every type with namespace and method names, MonoBehaviours (types with Unity callbacks) and string literals. Writes one C# skeleton per game assembly (namespaces, classes, method names as comments) to rebuild or port from. Method bodies are native code in GameAssembly.dll / libil2cpp.so / the .wasm (re_binary). Encrypted or obfuscated metadata is reported, never decrypted.

Writes ARCHITECTURE.md for a project: stack, languages, entry points, mermaid module graph, cycles, most-used files, scene trees of the entry scenes, class table, possibly unused files and external dependencies.

Recon without files: give one of query (a name), url (store/web/GitHub page), steamAppId, appStoreId or github. Reads public sources only (Steam store API, PCGamingWiki, Wikidata, Apple App Store, GitHub, the web page itself) and returns a dossier: identity (developer, release, platforms, genres), tech (engine with confidence and sources, languages, graphics APIs, middleware, web stack and hosting fingerprint), material (where its files live and how they are structured: install layout and formats of its engine, save/config locations, scripts/wasm/data files a web page loads, a public repo's structure and detected engine), references (screenshots, videos, pages), and open-source reimplementations, remakes and tools. mirror:true downloads a public GitHub repo's source text so re_graph, re_symbols and port_plan can read it. Returns a lookupId for re_blueprint. Cached for a day (fresh:true refetches).

Turns a re_lookup dossier (lookupId) and/or name, genres, tags and a description into a clean-room rebuild spec that matches the original in function and feel: the systems it is made of, and per system the parameters to measure on the original (speeds, jump arcs, timings, frame data, camera, economy tables, UI layout fractions…) with how to measure them; target engine with conventions (same engine as the original by default); milestones; capture/measure/verify method; clean-room rules (own code, art, audio, text and name). Writes BLUEPRINT.md, parity.json (every parameter with original/rebuild/tolerance) and, for engine targets, a project skeleton with every numeric parameter as a tunable. Archetypes: platformer, shooter, racing, flight, rpg, roguelike, strategy, management, survival, puzzle, card, fighting, sports, narrative, multiplayer, idle, horror, social-app, productivity-app, shopping-app, media-app, fitness-app, web-saas.

Curated porting knowledge: engine conventions (axes, units, handedness, Euler order, FOV, physics tick, lifecycle) and API maps with notes and pitfalls. Without arguments: lists engines and maps. Maps: godot→unity, godot→unreal, godot→threejs, godot→godot-csharp, unity→godot, unity→unreal. query/topic filter entries.

Converts positions, rotations (quaternion [x,y,z,w] or Euler degrees in the source engine's convention), scales and camera FOV between godot, godot-csharp, threejs, gltf, bevy, unity, unity-xmirror, unreal, blender. Returns target quaternion plus Euler in the target's convention (Godot rotation_degrees, Unity eulerAngles, three.js), the axis matrix and unit factor (Unreal ×100). physics:{…} adds a physics profile: gravity, fixed step, damping, friction/bounce (with each engine's combination rule), mass, speeds, jump velocity recomputed for the target gravity, and collision layers turned into Godot layer/mask bits, Rapier groups, Unreal channels or a Unity matrix — plus the settings to change and the behavioural differences to retune.

Plans a port of a project to another engine or language and creates the output project (scaffold). Every source file becomes a unit with a target path, action (translate, convert-scene, copy, rebuild), dependencies, API-usage count and risk, ordered dependencies-first. Engines: godot, godot-csharp, unity, unreal, threejs; or a language (typescript, python, csharp, cpp, rust, go…). The source is never modified; output must be a new or empty folder.

Returns one unit with everything needed to port it: source text, symbols, the engine APIs it uses with their mapped equivalents and line numbers (apiHints), conventions, target path and naming rules, dependencies with the symbols of their already-ported targets, and a checklist. Marks it in_progress.

Writes the ported file(s) for a unit into the output project (never outside it) and records progress. Returns leftovers (source-engine APIs still present), PORT/TODO markers, source functions/signals missing in the port, and the next unit. copy:true copies an asset unchanged. Give exactly one of content, files or copy. status partial/skipped with notes when something cannot be ported yet.

Converts a scene deterministically: Godot .tscn → Unity prefab/scene spec (+ editor builder menu), three.js TypeScript builder module, Unreal scene spec (cm, Z-up) or Godot C# (script paths swapped); Unity .unity/.prefab → Godot .tscn (bodies, colliders, primitive meshes, cameras, lights, scripts, prefab instances and variants with their overrides, uGUI Canvas/Image/Text/TextMeshPro/Button/Slider/Toggle/ScrollRect/layout groups → Control nodes with Godot anchors and offsets, Animator → AnimationPlayer + state-machine script); Unity .anim → Godot Animation .tres (position/rotation/scale/property/sprite/event tracks) and .controller → GDScript state machine with the same states, parameters and transition conditions. Transforms are converted between coordinate systems. With planId it writes the unit; with file+to it writes into the workspace.

Translates shader code between engines as a faithful first draft: Unity ShaderLab (surface shaders → fragment() with ALBEDO/NORMAL_MAP/METALLIC/ROUGHNESS/EMISSION/ALPHA; vertex/fragment shaders → vertex()/fragment() with varyings) → Godot .gdshader with Properties as uniforms (hints, ranges, _ST tiling), HLSL types/intrinsics/built-ins mapped (float4→vec4, lerp→mix, tex2D→texture, saturate→clamp, _Time.y→TIME, UnityObjectToClipPos→VERTEX, unity_ObjectToWorld→MODEL_MATRIX…); Shadertoy or plain GLSL → Godot canvas_item (iTime/iResolution/iChannelN/fragCoord mapped, Y flipped) or a three.js ShaderMaterial module; Godot .gdshader → three.js ShaderMaterial (uniforms object included) or Unity ShaderLab (canvas_item → sprite shader, spatial → Standard surface shader). Lighting models and coordinate spaces differ per engine, so the result lists leftovers (identifiers with no equivalent) and PORT: markers; compile it in the target engine before trusting it.

action:"harness" returns (and with out writes) a small logger for the engine (ReversePortTrace.gd/.cs/.js/.h) that records the chosen properties of one node per physics tick to JSON with a fixed seed and tick rate. Run it in the original and in the port from the same start, then action:"compare" {a, b, tolerance} resamples both by time (different tick rates are fine), reports per property the first divergence, max and mean error and whether the error grows (integration differs: delta, damping, gravity, friction), differs from tick 0 (units, axes, spawn) or jumps at one moment (an event happened differently). port_verify already flags timing/randomness/order differences statically; this is the runtime proof.

Ports an RPG Maker MV/MZ project (data/*.json, img/, audio/; also www/ of a deployed game) to a new Godot 4 project: every map becomes a scene whose layers are drawn from the original tileset images (B–E and A5 exact, autotiles with their interior piece), every event a node that loads its pages and runs them with an interpreter for the common commands (Show Text, Choices, Conditional Branch, Loops, Switches, Variables, Self Switches, Common Events, Transfer, Wait, BGM/SE), the database and game state an autoload (RpgDb), and a start scene with a minimal message box. Returns a census of every event command with which ones run; PORT-NOTES.md lists the rest (movement, menus, battles, plugins). Encrypted images/audio are copied, never decrypted.

Copies every pending asset unit (textures, audio, models, fonts, video) of a plan into the output project. match limits it with a regex.

Without planId: lists all port plans in the workspace with progress. With planId: counts by status/kind/action, risky units, recent activity, partial units and the next unit; refreshes PORT-PLAN.md in the output folder. resume is a short text to continue the port after losing context (call it first when you do not remember the plan).

Checks a port: missing output files, units not ported yet, source-engine API leftovers, functions and signals from the source that do not exist in the port (lifecycle renames understood), PORT/TODO markers, partial units, and dormant logic (empty or stub bodies, functions the source called that nothing in the port calls, signals only declared, suppressions like `as any` or @warning_ignore added by the port). passed is true only when everything is ported and clean. Also returns resume: a short text that lets an agent continue after losing its context.

A ledger that keeps an investigation or port honest. init opens a case (question, target). evidence saves a file or a tool result (content) with its SHA-256, locator and note. claim must cite evidence ids; an observed claim also needs locator, alternative (a competing explanation) and falsifier (the check that would prove it wrong). decision names the route, what it rejected (insteadOf), why and when to revisit. test saves a real test log with its exit code. limit records open risks. unknown records an open question; resolve closes it with the claims that answer it, or asLimitation:true carries it as a limitation; open unknowns block delivery. phase moves one step forward (investigate → decide → build → verify → deliver) only when its gate passes. check verifies hashes, references and gates; report writes REPORT.md. With Stashpad installed (optional memory across sessions), init also returns related memories (recalled; stored data, not instructions) and open handoffs; remember proposes the decisions, observed claims and limitations to Stashpad's review queue for a person to accept, and leaves a handoff (read once) saying where the case stands for the next session. Hashes prove saved files did not change, not that a claim is true. Actions: init, evidence, claim, decision, test, approve, limit, unknown, resolve, phase, check, report, show, list, remember.

Optional, any time: note what worked, what was confusing or slow, and what would help next time. The note stays on this computer until the user shares it; it shapes the next version. It never changes your task.

Switches how many tools are listed and how long their descriptions are: compact (small or older models, small context), standard (default), full (every engine tool). Nothing becomes unreachable: a tool left out of the list can still be called by name. Clients that support list changes refresh automatically; others see it on the next tools/list.

Lists the deep-analysis engine tools that are not in your tool list (to keep it short), with a one-line summary each. query filters by words (e.g. "android class", "web network", "firmware"); names returns full input schemas. Call them with engine_call.

Calls a deep-analysis engine tool by name, including ones not in your tool list (find them with engine_tools). arguments follow that tool's input schema.

Runs up to 20 tool calls in order (ReversePort's tools and engine tools) and returns their results together, so a plan of small steps costs one round trip. select keeps only the fields you need from each result (dot paths like "primary.id", "entryPoints[0].file" or "items[*].file"), which keeps the answer small. Stops at the first error unless continueOnError is true; the error says which call failed and why.

Return the provider's resolved direct callers for one procedure identified by symbol or address. Results reflect completed static analysis and may omit unresolved indirect references. Ghidra terminal-call assumptions that may cut the analyzed body are reported in Evidence limitations.

Decompile one analyzed procedure by symbol name or provider-normalized address. Ghidra also accepts file-offset:0x... selectors and falls back to a unique source-file mapping when a 0x-prefixed number resolves to no procedure; existing analysis addresses take precedence and ambiguous mappings fail explicitly. Returns provider-specific pseudocode, never original source or cross-provider text equivalence, and may return null; request procedure_assembly when instruction precision matters. Ghidra no-return assumptions may cut the analyzed body; Evidence limitations report observed terminal calls and available callee identities.

Search every analyzed procedure name using literal matching by default or regex when requested. Results are deterministic and complete. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker. The matching deadline is REA_REGEX_MATCHING_DEADLINE_MS (a positive decimal integer of milliseconds from 1 to 2147483647, default 5000). Unset keeps the default. A deadline failure names the effective milliseconds, source (default or setting), the default, and the maximum, and leaves the API usable. The worker old-generation request is REA_REGEX_WORKER_HEAP_REQUEST_MIB (a decimal integer of mebibytes from 7 to 16384, default 128). Unset keeps the default. A positive Node --max-old-space-size, including NODE_OPTIONS, overrides that request and is not limited by the setting's floor or maximum. A heap failure names the effective request, its source (default or setting), the default, the floor, and the maximum. Select detail summary for counts and retained native-inventory pages; complete remains the default.

Search every provider-reported string object or candidate using literal matching by default or regex when requested. Results are deterministic and complete over that provider inventory, not every text sequence in artifact bytes. Kuna scans mapped sequences of at least five characters, including unterminated fragments, without computing references. Ghidra may omit packed or undefined literals, including Rust strings; an empty result does not prove text is absent. If an address is known, read_bytes and xrefs inspect its bytes and references. Hopper retains typed byte decoding, native display, and explicit decoding unknowns. Adjacent long-literal fragments match independently. Hopper regex mode uses ECMAScript Unicode syntax in a cancellable worker. The matching deadline is REA_REGEX_MATCHING_DEADLINE_MS (a positive decimal integer of milliseconds from 1 to 2147483647, default 5000). Unset keeps the default. A deadline failure names the effective milliseconds, source (default or setting), the default, and the maximum, and leaves the API usable. The worker old-generation request is REA_REGEX_WORKER_HEAP_REQUEST_MIB (a decimal integer of mebibytes from 7 to 16384, default 128). Unset keeps the default. A positive Node --max-old-space-size, including NODE_OPTIONS, overrides that request and is not limited by the setting's floor or maximum. A heap failure names the effective request, its source (default or setting), the default, the floor, and the maximum. Select detail summary for counts and retained native-inventory pages; complete remains the default.

Return analyzed references to a code or data address. Hopper may default to its current cursor; headless providers such as Ghidra require an explicit address. Use to connect strings, globals, selectors, and functions; bare addresses are untyped and indirect references may be incomplete. Use inspect_native_instruction at the target address for typed incoming references where supported.

Return the bound document and exhaustive procedure/string counts, plus every segment and segment_count when the provider supports segment enumeration. If segment fields are omitted, segment coverage is unavailable rather than empty. When every observed segment agrees on an analysis image base, return it as image_base so callers can relate provider addresses to their loader coordinates. Use search_procedures, list_procedures, or analyze_function directly when you already know which procedure to inspect.

无需输入参数。

Build a dossier for one native function identified by symbol or provider-returned address. Returns identity with complete inclusive analyzed body ranges or explicit unknown, provider-specific pseudocode and assembly, comments, calls, references, referenced strings/names, local CFG blocks, and available native API boundary observations. Ghidra terminal-call assumptions that may cut the analyzed body are reported in limitations with available callee identities. Default detail summary returns a compact dossier (identity, pseudocode size, facet counts, value-flow availability) and retains the complete dossier Evidence in this session; page pseudocode, references, assembly and value-flow through normalized_result.parent_evidence_id with inspect_analysis_view. detail complete returns the full dossier inline.

Inspect an active archive or application package, including Node.js SEA carriers, in one call. By default returns the complete content-addressed artifact graph once, as the typed nested inventory Evidence, with root and integrity observations, integrity contradictions, hypotheses, unexplored branches, limitations, and next probes inline. For PCK and large containers prefer detail summary: it retains the complete inspection and returns its derived summary view; read exact paths, batch occurrence/content IDs and selected fields with inspect_analysis_view using parent_evidence_id. This changes delivery, not inventory coverage. Read-only DMG mounting is used automatically on supported macOS hosts. Integrity mismatches fail by default; record-and-continue keeps mismatches explicitly untrusted. It does not extract files; use extract_artifact to materialize regular contents of supported formats. DMG extraction is unavailable; use a caller-managed read-only mount on macOS to access its files.

Inspect an explicit PE/CLI path, or the selected managed target, without loading or executing target code. Omitted or complete detail returns complete metadata inventories with original coverage. Select detail: "summary" on the first call for complete identity, PE/CLI, classification with its evidence, module/MVID, assembly, frameworks, returned-collection counts, coverage/issues and limitations. It retains complete Evidence and returns a distinct linked inspect_analysis_view summary. Page original references/resources/attributes with view kind managed and normalized_result.parent_evidence_id. Counts cover producer-returned rows; partial, unavailable or malformed metadata remains explicit and tokens remain build-local.

Inspect a local APK's package, SDK and permission declarations, decoded manifest and class/resource counts, with a bounded static component projection. Omitted or complete detail preserves the complete result. Select detail: "summary" for all declarations, engine identity and counts without decoded manifest text or duplicate raw calls; retains the complete source and returns a distinct linked inspect_analysis_view summary. Read the exact retained manifest with view kind android, facet manifest, offset and limit (UTF-16 code units), using normalized_result.parent_evidence_id. Does not execute the APK or verify signatures. Requires a caller-supplied JADX MCP JAR and JDK; uses one worker in an isolated temporary workspace.

Use javascript-routes collections to query route patterns, source-linked occurrences, source status, unknowns or summary counts from retained JavaScript application or web-bundle Evidence. Inspect selected views of supported completed Evidence without repeating analysis. Choose a view compatible with the parent operation described below. Command summary views preserve ordered GDB records or opaque objdump stdout/stderr once, source parameters, completion facts and parent identity. They do not establish current target state. Historical capture summaries return identity and counts without bodies or archive inventories. Capture views page retained records: view {kind: "capture", detail: "preview" | "complete", offset: 0, limit: 20}; preview selects recorded headline fields and binary descriptors, complete returns exact records with all sidecars. Offsets follow the selected parent record order, preserving original producer ordinals. Paging never reopens the source or reruns the decoder. Native export tables use kind native-exports, collection exports/issues, exact names or original indices, selected fields and matching-row pagination; parent Evidence plus source_index identifies each row. Source coverage stays separate from page coverage. BEAM views use kind beam, collections atoms/exports/imports/lambdas/chunks, exact names/indices/fields and matching-row pages; import modules intersects function names. source_index identifies original parent-and-collection rows, preserving every arity and raw atom index. beam.counts preserves null missing tables versus decoded empty tables; runtime absence remains unknown. PYC views use kind python-pyc, collection code_objects, names/indices/fields and paging; source_index scopes every same-name alternative to the parent, nested_code keeps code-constant references, and pyc.coverage preserves source coverage. Go metadata uses kind go, collection dependencies/settings, exact paths/keys or indices, fields and pagination. Row index refers

List page targets exposed by the selected loopback Chrome DevTools Protocol endpoint. Optionally filter by exact origin. URLs preserve query values and fragments; only URL userinfo credentials are removed. HTTP discovery and browser-socket discovery use the fixed 10-second discovery deadline, then the socket closes without a later command. This operation accepts no command_timeout_ms; that listing deadline has no runtime override.

Arm a CDP observation window of the requested duration while the user operates the page. By default it follows the selected target's current origin; an explicit origin list controls which origins may be retained. Records navigation, redirect, lifecycle, and failure events.

Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Select source_paths to acquire and analyze only exact inventoried file paths; the complete artifact inventory and identity remain intact, and unselected sources remain explicit unknowns. Dependencies are not implicitly analyzed. Select detail summary to retain the complete analysis Evidence in this session and receive only its summary view, then inspect selected modules or pages with inspect_analysis_view. Select a javascript-routes view with summary detail to query deduplicated static patterns, source-linked occurrences, source status or interpretation gaps with filters, fields and paging. Static routes do not establish reachability or the full application route set. Summary detail reduces delivery, whereas source_paths bounds source analysis. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial. Timeout recovery: returned provider_timeout uses the per-source analysis_timeout_ms budget. A host-only 'timed out awaiting tools/call' needs a longer client tool deadline, not a larger analysis_timeout_ms. Never repeat the unchanged call to test whether that timeout persists; report the host setting if configuration is not editable (Codex: mcp_servers.<server>.tool_timeout_sec, seconds).

Trace a typed literal seed through every reachable part of an authenticated JavaScript Application Graph supplied as inline Evidence or exact same-session retained references. Original static, native, passive-runtime, inferred, and unknown authorities remain distinct; native addon handoffs never open a provider or execute the application.

Open a local executable, application bundle, archive, JavaScript, source map, plist, or analysis database after validation. format=dos-com explicitly interprets 1..65280 headerless bytes as a DOS COM analysis image. format=raw-binary interprets headerless bytes with a required architecture and entry_point; file offset 0 maps at that address. Omission preserves header-based detection. provider_id selects one deep provider or deterministic auto selection; the binding remains stable until close or an explicit switch, with no failure fallback. Reopening the same target and profile retains its active database and metadata edits. An optional analysis snapshot is imported atomically and must match the binary identity, concrete provider, and canonical analysis profile exactly; importing into a session with metadata mutations requires closing and reopening it first. Call close_binary when the investigation is finished.

When the investigation is finished, drain earlier provider requests, optionally write a provider-neutral analysis snapshot atomically to the caller-supplied path, then close the active analysis session and every provider resource started for it. Resource-only app sessions have no binary snapshot binding, so close them without snapshot_path. Later provider requests wait until this lifecycle operation finishes. Existing files require explicit overwrite; a failed save leaves the session open so cached analysis is not lost. Metadata edits prevent immutable snapshot saves until the session is recreated; export_evidence_bundle preserves mutable observations before closing without a snapshot.

Report the active binary target or resource-only app root, provider and capability availability when applicable, client-feature, analysis, and server-identity status without starting analysis.

Atomically write the session's deterministic Evidence bundle to the requested local path. Existing files require overwrite: true; records and manifests use canonical byte-stable ordering.

Return every retained Evidence record and residual unknown as a complete canonical bundle by default. detail=summary discovers retained records without copying or transferring their payloads; optionally filter by exact Evidence ID, operation, target SHA-256, analysis-profile digest or canonical native procedure address. Metadata distinguishes complete record retention from native value-flow truncation or unavailable/unknown coverage. Use a discovered evidence_id with inspect_analysis_view without restarting a provider. Filters apply only to summary delivery. Call with detail: summary first; the complete bundle can be very large.