BinSight

Most files are black boxes: an .exe you downloaded, a firmware dump, a driver, a game, an ECU calibration, an app update. BinSight opens the box — statically, on your own machine, without ever running the file — and answers the three questions that matter, in plain language and with the evidence to back them up.

You: What is this file? Is it hiding anything? And what changed vs the old version?
BinSight: PE/Windows x64, compiled with MSVC, UPX-packed (entropy 7.9),          imports consistent with network + process injection, Authenticode          signature present, and vs the previous build 3 regions changed —          here are the offsets. All static, all offline, with evidence.

The three questions

🔎 What is it?

triage_file and inspect_executable read ELF, PE/Windows and Mach-O (and raw blobs) and tell you the type, architecture, entry point, imports/exports, sections, hashes, and a compiler/packer fingerprint — without starting Ghidra or IDA, on macOS, Windows or Linux.

🕵️ What does it hide?

detect_binary_toolchain, measure_binary_entropy, classify_import_capabilities, identify_crypto_constants, extract_binary_strings, inspect_code_signature and scan_embedded_content surface packing, high-entropy regions, imported capabilities (network, process, crypto…), IOC strings, embedded files, and whether a signature is real — reported as evidence and inference, never as a verdict.

🔁 What changed?

compare_binaries diffs any two files byte-for-byte and explains the change — which regions moved, what was zeroed or maxed out, the before/after values. Works on app updates, drivers, firmware and ECU calibration dumps alike. compare_executables adds import/export/section/hardening deltas for executables.

All 17 tools

Every result separates observations, inferences and unknowns, carries file offsets, and states its limitations. Detection only — nothing is unpacked, decrypted, cracked or executed.

Quickstart

npx binsight triage-file /path/to/file --jsonnpx binsight compare-binaries /path/to/old /path/to/new --jsonnpx binsight generate-triage-report /path/to/file --json

Register BinSight as an MCP server for your AI agent, then just ask it in plain language ("what is this file, what does it hide, what changed?"):

npx binsight setup

BinSight supports the same agents as REA — see supported agents; other clients can use manual MCP registration.

Verified against the reference tools

BinSight's parsers and hashes are checked against the tools analysts already trust: imphash matches pefile byte-for-byte, structure matches LIEF / readelf / otool, and hardening and packing results match checksec and Detect It Easy on a real corpus of ELF, PE and Mach-O binaries.

Documentation

• Static intelligence suite: the 17 tools, with CLI and MCP examples.
• Tool catalog: generated inventory of tools, providers and CLI commands.
• Installation and setup: providers, agents and manual registration.

Built on REA

BinSight builds on REA and adds the static intelligence suite above. REA is MIT-licensed; this project keeps that license and attribution. This is not an official REA release — for REA itself, go to morluto/rea.

License

MIT. See LICENSE. Portions © the REA authors.