English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română

BLA: Blind LLM Agents

One MCP for defending binaries, applications, and runtime behavior against AI reverse engineering.

Ship a feature you built. Blind the agents trying to clone it, down to the binary level.

Website · Guides · Showcases

Quick start · How BLA works · What you can protect · Showcases · FAQ · Documentation

npx bla-agents setup

Worried that someone will point REA or a coding agent at your shipped product and clone your core logic in seconds? Ask your agent to harden it with BLA (Poison → Exhaust → Hallucinate). It audits your build without requiring source-code rewrites, shows what an attacking agent would recover, injects adversarial chaff and algorithmic tarpits, and verifies that automated reconstruction fails.

BLA connects your agent to tools for protecting native binaries, JavaScript and Electron apps, WebAssembly modules, Python bytecode, SQLite databases, AI model files, and mobile packages. You can also run the same tools from your terminal or build bundler. Protection runs locally and preserves 100% of original runtime behavior.

Setup registers BLA with your agent and installs matching workflow instructions. Every static, bytecode, and binary shield is built in—no commercial packer, external LLVM toolchain, or third-party obfuscator is required.

Quick start

Set up your agent

With Node.js and npm installed, run:

npx bla-agents setup

Choose your agents (or pass --all-detected --yes), review the proposed changes, and approve them. Setup registers BLA's MCP server and installs the blind-llm-agents skill, with backups of existing configuration. Restart your agent afterward.

Setup supports Claude Code, Codex, Cursor, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. See installation and setup for manual MCP registration.

Ask your agent

Every defense stage can be triggered directly in natural language:

• 1. Audit exposure before shipping (Pre-flight REA Audit):

  Audit my ./dist directory against REA, show me every exposed module and IPC channel, and estimate how much it would cost Claude to reconstruct it.

• 2. Inject Counter-REA protection (Poison + Exhaust + Hallucinate):

  Protect ./dist/app.asar with BLA at bankrupt intensity, inject enclave chaff and algorithmic tarpits, and output to ./dist/app.shielded.asar.

• 3. Verify defense gates & token amplification (Verify):

  Verify ./dist/app.shielded.asar against the original ./dist/app.asar and confirm that REA's examination degrades to limited status.

Use the terminal

Every workflow is available directly from your terminal with npx bla-agents (or bla when installed globally):

• 1. Audit a target (audit) — inspect exposure score (0–100), exposed symbols, and estimated attacker clone cost:

  npx -y bla-agents@latest audit /absolute/path/to/app --json

• 2. Protect a target (protect) — inject semantic budget breakers, tarpit state machines, enclave chaff, and runtime shields:

  npx -y bla-agents@latest protect /absolute/path/to/app -o /absolute/path/to/app.shielded --intensity bankrupt

• 3. Verify Counter-REA resistance (verify) — check that REA's static/semantic passes hit resource limits and >10x token amplification:

  npx -y bla-agents@latest verify /absolute/path/to/app.shielded /absolute/path/to/app

• 4. Run the 8-target Counter-REA benchmark (benchmark):

  npx -y bla-agents@latest benchmark

• 5. Emit compile-time native headers (emit-headers) for C/C++, Rust, or Go builds:

  npx -y bla-agents@latest emit-headers --lang c -o ./include/bla_shield.h

To install the bla command for regular use:

npm install --global bla-agents
bla --help

Use in your build bundler

Import bla-shield/bundler in Vite, Rollup, Webpack, or esbuild to automatically shield emitted JavaScript chunks, Honey Source Maps, and .wasm assets at build time:

import { defineConfig } from "vite";
import { blaVitePlugin } from "bla-agents/bundler";

export default defineConfig({
  plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
});

Update BLA

For a CLI installed with npm install --global or bun add --global:

bla update

bla --update is an alias for this workflow. If you use npx, refresh your agent registrations and skill with:

npx bla-agents@latest setup

Review the setup changes and restart your agent. For one-off CLI commands, use npx bla-agents@latest (or bunx bla-agents@latest) followed by the command.

Related MCP server: REA

How BLA works

Your agent calls BLA through MCP to audit a build artifact, inject format-specific Counter-REA shields, and verify the hardened output. When an attacking agent later inspects the protected artifact with REA, REA hits deterministic internal resource limits, drowns in decoy cross-references, and misattributes core logic to hardware enclave stubs:

1. Poison (Architectural Chaff & Honey Assets): Embeds benign hardware enclave delegation manifests (SGX / TPM2 / Secure Enclave), VLQ v3 Honey Source Maps (enclave://tee-runtime/), honey WASM "name" sections, and honey SQLite tables across dead branches and constant pools.

2. Exhaust (Semantic Budget Breakers & Algorithmic Tarpits): Trips morluto/rea's hardcoded analyzer caps (primitive-candidates > 256, alias-selections > 512, getter-expansion > 512, primitive-bytes > 1 MiB, maximum_rustc_hashes > 64, maximumSentinelsPerSlice > 32) at zero runtime cost, while weaving 14–36 interconnected Fake XRef state machines into the call graph.

3. Hallucinate (Anti-CDP Runtime Deception & Fuse Hardening): Hardens Electron V1 fuse wires in-place (RunAsNode=0, EnableNodeCliInspectArguments=0) and injects the "Truman Show" runtime guard that serves synthetic enclave attestation telemetry whenever CDP, Node Inspector, Frida, or WebDriver probes attach.

What you can protect

BLA requires Node.js 22.5+ (or 24.x+) and npm. All shields run self-contained with zero external tool dependencies:

Showcases

Run npx bla-agents benchmark to execute all 8 counter-showcases locally and verify both REA failure modes and 100% runtime equivalence:

DX-Ball: bankrupt a sound-pan reconstruction

REA's flagship showcase reconstructs DX-Ball's clampPan and calculateSoundPanFromX helpers in seconds ($0.20). After running npx bla-agents protect examples/dx-ball-sound-pan/sound-pan.js --intensity bankrupt, REA's parse_status drops to "partial", examination.status degrades to "limited" (["alias-selections", "primitive-bytes", "primitive-candidates"]), and the obligation ledger expands from 2 functions to 38 interconnected state machines (2,121.3x token amplification) while returning identical pan values for every input coordinate.

Notion: blind the Electron clipboard IPC bridge

REA traces Electron apps by matching unique literal strings between ipcRenderer.invoke("clipboard:write-rich-format") and ipcMain.handle(...). BLA replaces real IPC channel strings with $\ge 9$-chunk number-theoretic opaque expressions (electron.ipc[0].channel === null) and registers duplicate decoy handlers on the same literal channel names—forcing electron_call_paths_limited: true and uncertainty: ["dynamic-findings", "returned-reference-widening"].

Native, SQLite & Edge AI: trip REA's binary and container capacity limits

When an attacker runs REA's inspect_rust_binary, inspect_electron_fuses, inspect_sqlite_database, or inspect_model_artifact on BLA-protected files, REA's own parsers deterministically abort with capacity and evaluation failures (Read-only data contains more than 64 distinct rustc commit paths, Slice 0 contains more than 32 Electron fuse sentinels, SqliteColumnEvaluationFailure, and ModelFormatFailure: json-nesting).

FAQ

Any coding agent that supports local MCP servers or SKILL.md workflows. npx bla-agents setup auto-configures Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. See supported agents.

No. BLA's semantic budget breakers (alias-selections, getter-expansion, primitive-bytes) and tarpit call graphs are guarded by $O(1)$ number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod 7$) that never execute at runtime. Every benchmark target verifies 100% input/output equivalence against the unprotected build.

Traditional obfuscators rename variables (calculatePrice $\rightarrow$ _0x1a2b), which modern LLMs effortlessly reverse via control-flow semantics, while heavy VM packers slow down execution. BLA is engineered specifically against AI coding agents and morluto/rea's static/semantic analyzers—tripping REA's exact internal resource caps, breaking IPC literal pairing, poisoning source maps/metadata with hardware-enclave delegation chaff, and multiplying agent MCP token consumption by up to 2,500x.

No. All 19 format shields (Babel AST, Chromium .asar, LEB128 .wasm, CPython .pyc, ELF/Mach-O/PE, SQLite3, .safetensors/.gguf, and .dex/Il2Cpp) are built directly into bla-shield with zero external binary dependencies.

1. REA's JavaScript/Electron analyzer degrades from complete to partial / limited and fails to pair IPC channels (channel: null).

2. REA's binary, Fuse, SQLite, and AI model inspectors hit hard capacity limits (>64 rustc hashes, >32 Electron fuse sentinels, SqliteColumnEvaluationFailure, >32 JSON/ARRAY nesting).

3. If the agent attempts feature tracing (trace_application_feature), it enters 14–36 Fake XRef state machines and Honey Source Maps (enclave://tee-runtime/), exhausting its context window and API budget.

The blind-llm-agents skill teaches your coding agent how to run pre-release Counter-REA audits, select the right protection intensity (stealth, balanced, maximum, bankrupt), integrate bundler plugins, and verify defense gates automatically.

Never. BLA audits, protects, and verifies all files 100% locally on your machine with deterministic seeded PRNG transforms (--seed) and zero network calls.

Update first and run bla doctor to check engine readiness:

npx bla-agents@latest doctor
npx bla-agents@latest setup

If the issue persists, open an issue with your BLA version (bla --version), target format, and steps to reproduce.

Documentation

• Installation and agent setup: agent registration, bundler plugins, updates, and uninstall.

• CLI and MCP contracts: commands, options, exit codes, and JSON-RPC 2.0 MCP tool schemas.

• Counter-REA technical defense matrix: exact morluto/rea source limits and how BLA exploits them.

Report security issues through SECURITY.md.

Disclaimer

See DISCLAIMER.md for responsible-use guidance.

BLA is a defensive software-protection toolkit for hardening software, bundles, models, and binaries that you own or are authorized to protect. All injected chaff payloads are strictly benign architectural metadata and synthetic decoy functions that preserve 100% of original runtime behavior.

Contributing

Issues and pull requests are welcome at qybaihe/bla. Run npm run build && npm test && node dist/cli.js benchmark before submitting changes.

License

MIT