re-patch

MCP server for on-disk patching of binary artifacts. Provides:

• SHA-256 manifest of a binary (so the original can be verified / restored)

• Byte-level patch application: copy a file, write new_bytes at offset, save the result

• Manifest-driven restore: read the manifest, copy the original back

The server does not enforce policy — it surfaces an audit log (confirm_legal parameter) so the calling agent records the justification for every patch. The user / run policy is the caller's responsibility.

Why

The 2026-06-05 stress test surfaced a need for an on-disk patch primitive that's:

• Auditable — every call carries a confirm_legal text the analyst must type in

• Reversible — the SHA-256 manifest + restore_original tool let the analyst roll back to the exact original bytes

• Non-destructive — apply_patch writes a copy at dst, not in place; the original at src is never modified

Related MCP server: mcp-policy-guardian

Tools

Install

Part of the RE-AI plugin; ./install.sh installs the package. To install standalone:

pip install -e ./servers/re-patch

Run

re-patch                                # stdio transport (default for MCP)
python -m re_patch                      # equivalent