Provides static analysis of Electron applications, including JavaScript/Electron code and ASAR archive inspection, to support reverse engineering of Electron app structure and behavior.
Provides static analysis of JavaScript/Electron applications using oxc, enabling reverse engineering of JavaScript source and bundled application code.
Provides analysis of .NET PE/CLI metadata according to ECMA-335, enabling reverse engineering of .NET assemblies.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Fathom reverse engineer this binary and list its imported functions"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Rust port of REA (Reverse Engineer Anything): one provider-neutral MCP server for reverse engineering — native binaries, JavaScript/Electron applications, .NET assemblies, web captures, EVM bytecode, and process behavior — where every result is an evidence envelope that states what was observed, what was derived, what was not examined, and what the provider cannot establish.
The design is specified in SPEC.md: capability inventory mapped from upstream's public contracts, per-capability Rust strategy, evidence and error models, a deterministic fail-closed policy engine, and the staging plan. Design source: morluto/rea (MIT), credited in NOTICE; no upstream code is used.
Upstream REA is TypeScript/Node distributed through npm. This port exists to keep the capability on a Rust-first, pinned, auditable supply chain — the estate's standing direction (SPEC §1).
Related MCP server: REA
fathom-core — config, error contracts, evidence model, policy,
tool registry, confinement, bounded processes.
fathom-mcp — MCP stdio + streamable HTTP transports.
fathom-a2a — signed A2A agent card (JCS + Ed25519).
fathom-native — Ghidra headless provider + binary layout (goblin).
fathom-js — JavaScript/Electron static analysis (oxc) + ASAR.
fathom-managed — .NET PE/CLI metadata (manual ECMA-335).
fathom-observe — process capture, HAR reading, EVM selectors.
fathom-cli — the fathom binary (serve, card, doctor,
one-shot analysis).
nix build # or: nix develop, then cargo build --workspace
cargo test --workspaceThis project is licensed under the Apache License, Version 2.0.
This server cannot be deployed
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Governed MCP: agent audit, provenance, deterministic checks, and receipt-backed FragGate execution.
