Provides tools for dynamic analysis of Android apps via Frida and adb, including listing and spawning apps, hooking Java and native functions, tracing APIs, dumping UI, scanning crypto, and capturing traffic.
Provides tools for tracing and instrumenting Linux processes, including process listing, syscall tracing, function hooking, memory map inspection, memory scanning, file watching, and stalking.
Provides tools for tracing and instrumenting macOS processes, including process listing, syscall tracing, function hooking, memory map inspection, memory scanning, file watching, and stalking.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@tracea Trace what this app actually does at startup, hook its crypto calls, and show me the evidence."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
The dynamic half of reverse engineering, built for AI coding agents.
🚧 Status: under active development. v0.1 (network evidence engine) ships this week; v1.0 launches November 2026. See the roadmap. Stars watch the build. 📈
Static-analysis MCPs tell your agent what software looks like. tracea shows your agent what software does — spawn it, hook it, trace it, capture its traffic — and returns every finding as a structured Evidence Record, so the agent cites proof instead of guessing.
Runtime, not guesses — API hooks, syscall summaries, memory inspection, HTTP/TLS/DNS reconstruction from live traffic or pcaps
Evidence over assertion — every result carries observation, artifacts, confidence, and explicit limitations
Token-efficient by design — deduplicated summaries + artifact references; never a 10 MB strace dump in your context window
Works where you already work — Claude Code, Codex, Cursor, Gemini CLI via MCP; or standalone CLI
uvx tracea setupDetects your agents, backs up configs, registers the MCP server, installs matching workflow instructions. Restart your agent and ask:
Trace what this app actually does at startup, hook its crypto calls,
and show me the evidence.Or use it straight from the terminal:
tracea net-pcap-summary capture.pcap --json
tracea run-diff run-a run-b # what changed between two runs?
tracea evidence-export --html # standalone, shareable reportRelated MCP server: ChaiChai
Domain | Tools | Provider |
Network & protocols |
| scapy / dpkt / mitmproxy |
Linux & macOS processes |
| Frida + /proc |
Android |
| Frida + adb |
Cross-cutting |
| built-in |
Agent (Claude Code / Codex / Cursor / Gemini CLI)
│ MCP (stdio)
┌───────▼────────────────────────────────────────┐
│ tracea MCP server (Python, FastMCP) │
│ • 24 tools • session manager • evidence DB │
└───────┬────────────────────────────────────────┘
│ provider adapters
┌────┴─────┬──────────┬───────────┬──────────┐
▼ ▼ ▼ ▼ ▼
Frida adb /proc mitmproxy dpktThe agent calls a tracea tool → tracea drives the mature instrumentation stack → findings come back as Evidence Records, not raw dumps:
{
"id": "ev_01HZX...",
"tool": "android_hook_java",
"provider": "frida",
"target": "com.example.app",
"observation": "SharedPreferences.getString('api_key') from AntiTamper.check()",
"confidence": "observed",
"artifacts": [{"type": "stacktrace", "ref": "artifacts/0001.txt"}],
"limitations": ["string value not captured (hook depth 1)"]
}observed outranks inferred. Every record states what it couldn't see. That's the whole philosophy.
Asset | What | Why |
Live Space: pcap explorer, APK static teaser, evidence viewer | Try it in the browser, zero install | |
TraceBench — annotated runtime traces + hook-script corpus with ground truth | Train/eval dynamic-analysis agents | |
Small model fine-tuned on TraceBench: trace → plain-English report | Proof the data works |
Security researchers — triage, malware lab analysis, pinning checks, protocol documentation
Developers — "why does our release build phone home?" answered with evidence, not vibes
Agent builders — give your agent runtime perception; eval against TraceBench
Software preservationists — understand abandoned binaries by watching them run
tracea is for authorized analysis only: your apps, your devices, your captures, your labs. No DRM circumvention, no piracy tooling, no malware development. Evidence exports redact high-entropy secrets by default. Full policy in docs.
v0.1 network engine → v0.3 native processes + setup wizard → v0.5 Android + Space demo → v1.0 launch (Nov 2026). Details in docs/ROADMAP.md.
Evidence philosophy inspired by morluto/rea — the static half. tracea is the dynamic half.
Ideas from the whole agentic-RE community: ida-pro-mcp, GhidraMCP, hooker
MIT © 2026 Nabid Nur
This server cannot be deployed
Context and control for any AI. Agent identity, scoped access, and proof across tools.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
AI agent observability for production traces, natural-language insights, and improvement loops.
Browser-local and CLI static evidence for deployed AI model artifacts.
