Can emit compile-time native shield headers for C/C++ builds via the emit-headers workflow.
Hardens Electron .asar applications and binary fuses by de-literalizing IPC channels, adding decoy handlers, and detecting CDP/Frida probes.
Provides an esbuild plugin for build-time shielding of emitted JavaScript chunks, source maps, and WASM assets.
Protects JavaScript apps and bundles with Counter-REA auditing, chaff/tarpit injection, runtime shields, and verification of hardened output.
Protects Python bytecode with Counter-REA shields and supports auditing and verifying reconstruction resistance.
Can emit compile-time native shield headers for Rust builds via the emit-headers workflow.
Injects honey tables and adversarial chaff into SQLite databases to mislead automated reverse engineering.
Applies the same Counter-REA protection workflow to TypeScript builds, shielding emitted JavaScript and verifying resistance to automated reconstruction.
Provides a Vite plugin that automatically shields emitted JavaScript chunks, source maps, and WASM assets at build time.
Shields WebAssembly modules and emitted .wasm assets with honey name sections and other Counter-REA defenses.
Provides a Webpack plugin for build-time shielding of emitted JavaScript chunks, source maps, and WASM assets.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română
The open-source Counter-REA Blue Defense MCP & CLI that protects software releases against AI reverse-engineering agents (morluto/rea, autonomous decompilers, and LLM recon pipelines) — verified across 14 showcase benchmark targets.
🌐 Official Website · 📖 Defense Guides · 📊 Live Benchmarks · 🎯 CrackMe Arena · 🏢 Enterprise · ⚖️ Disclaimer
Quick Start · How It Works · Empirical Results · Format Coverage · 14-Target Benchmark · CrackMe Arena · FAQ
Defensive Use Only: BLA is engineered strictly for software authors and security teams protecting their own intellectual property and release artifacts. See DISCLAIMER.md.
Always install from official sources: qybaihe/bla or npm i bla-agents.
AI reverse-engineering agents (REA + coding agents) unpack .asar archives, recover SourceMaps, trace IPC bridges, inspect .wasm / .sqlite / .safetensors, and clone core business logic in seconds for ~$0.20.
bla harden .)Every analyzer pass hits deterministic resource ceilings (primitive-candidates > 256, ASAR > 16 MiB, WASM > Wabt cap, SQLite virtual trap), follows realistic shadow state machines, and projects 300×–2,800× modeled token amplification (token-estimator.ts).
Exhaustion graphs and decoy payloads sit behind $O(1)$ number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod 7$) or inert format sections. 14/14 bundled benchmark targets pass input/output equivalence tests (bla verify checks Counter-REA structural gates; run your project's test suite for custom artifacts).
Point BLA at any project or release directory. It auto-discovers build outputs (dist/, build/, .asar, .wasm, .sqlite, .safetensors, native binaries, Python/C/Rust/Go) and runs audit → protect → verify:
# Node.js ^22.23.4 or >=24.0.0 recommended
npx bla-agents harden .Register BLA once with your coding agent (Claude Code, Cursor, Codex, Windsurf, Gemini CLI, GitHub Copilot CLI, VS Code, OpenCode, Antigravity):
npx bla-agents setupThen simply prompt your coding agent:
Harden my software against REAYour host agent automatically orchestrates BLA's MCP tools (bla_weave_plan → source-level logic weaving & string encryption → bla_verify_weave → bla_harden → bla_verify) to harden both your source architecture and compiled artifacts.
Protect JS chunks, strip/replace SourceMaps with VLQ v3 honey maps, and shield .wasm assets automatically at bundle time:
import { defineConfig } from "vite";
import { blaVitePlugin } from "bla-agents/bundler";
export default defineConfig({
plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
});Related MCP server: unrea
Traditional obfuscators only rename variables (_0x1a2b), which modern LLMs effortlessly summarize, or wrap binaries in heavy VM packers that break cross-platform builds and degrade performance.
BLA 3.x combines format-native deterministic shields with host-agent surgical source weaving:
flowchart LR
subgraph S1["1 · Recon & Plan"]
A["bla_audit / bla_lint"] --> B["bla_weave_plan"]
end
subgraph S2["2 · Agent Source Surgery"]
B --> C["bla_encrypt_strings\n(AST Span XOR + Keystream)"]
C --> D["bla_bind_scope\n(Multi-Site State Entanglement)"]
D --> E["bla_verify_weave"]
end
subgraph S3["3 · Artifact Shielding"]
E --> F["bla_harden / bla_defend\n(19+ Format Shields + Self-Seal)"]
end
subgraph S4["4 · Counter-REA Gate"]
F --> G["bla_verify\n(Structural Counter-REA Checks Only)"]
endDefense Pillar | Mechanism | Effect on AI Reverse-Engineering Agents |
1. Poison (Deception) | Plants format-valid canaries, SGX/TPM2/Secure Enclave delegation manifests, VLQ v3 honey SourceMaps, and plausible shadow state machines. | Forces LLM agents to split context across conflicting hypotheses and chase synthetic rabbit holes. |
2. Exhaust (Budget Breakers) | Trips exact analyzer limits ( | Downgrades REA examination from |
3. Entangle (Anti-Strip & Self-Seal) | Binds sibling artifacts (JS ↔ WASM ↔ Native sidecars) via runtime SHA-256 digests ( | Prevents red-team agents from stripping decoys, nop-patching single-point checks, or calling exported functions as offline oracles. |
4. Runtime Truman Show | Hardens Electron V1 Fuses ( | Serves believable synthetic telemetry during live debugging while keeping normal user execution untouched. |
These numbers come from running real morluto/rea against BLA-hardened samples on commodity hardware (npm run redteam:rea). Full machine-readable report: docs/redteam/empirical-rea-validation.md / .json.
How to read this: “Empirically verified” means the live REA analyzer path returned the listed budget / capacity / redaction failure in this environment. It is not a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here.
Recorded under Node v24.22.1 with optional Wabt 1.0.42 + tshark 4.4 when noted. Soft-skips keep Node 22 / CI green when external native tools are absent.
Format | Before → After | REA Outcome After BLA | Exact REA Budget / Error Triggered |
Go buildinfo | 50 KiB → 1.16 MiB | ❌ Capacity error |
|
Erlang BEAM | 84 B → 262 KiB | ❌ Capacity error |
|
EVM bytecode | 16 B → 4.00 MiB | ⚠️ Approaches full cap |
|
PCAP | 24 B → 1.29 MiB | ❌ Budget rejected |
|
Electron ASAR | 607 B → 16.9 MiB | ❌ Capacity error |
|
WASM + Wabt | 54 B → 6.56 MiB · 251 exports | ⚠️ |
|
SQLite (Node 24) | 12 KiB → 56 KiB | ❌ Redaction / eval trap |
|
JavaScript | 761 B → 116 KiB | ❌ Budget rejected |
|
Safetensors | 128 B → 10.1 KiB | ❌ Capacity error |
|
GGUF | 24 B → 7.7 KiB | ❌ Capacity error |
|
Electron fuses | 50 KiB → 1.16 MiB | ❌ Budget rejected |
|
Flutter pool | 50 KiB → 1.16 MiB | ⚠️ Projected cap |
|
Reproduce locally:
export REA_WABT_BIN_DIRECTORY=$HOME/opt/wabt-1.0.42/bin # optional
npm run build && npm run redteam:reaThese shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path requires external native debuggers/decompilers not installed on the CI runner:
Area | Why Unverified Here |
Ghidra / native decompilation depth | Requires a local Ghidra install + REA bridge |
Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach |
JADX / full Android APK pipeline | APK resigning unsupported; standalone DEX shield is in-tree |
Firmware containers | Staging/extraction budgets exist; no honest E2E without firmware corpora |
SPIR-V / CUDA fatbinary / AMD GPU objects | Need native GPU object decoders; PTX text is shielded in-tree |
EVMole in-process EVM decode | Not pathable in-process; EVM shield densifies to the 4 MiB input cap |
All 19+ format shields are built directly into bla-agents with zero external packer dependencies:
Format | Canary + Diagnostic | Exhaustion / Budget Trip | Empirically vs. REA | Notes |
JavaScript / TypeScript | ✓ | ✓ semantic budgets | verified (in-process) | Babel AST; AST-safe string encryption; self-seal |
Electron | ✓ | ✓ header 16 MiB | verified | IPC de-literalization + Pickle repackaging |
Electron fuses | ✓ | ✓ >32 sentinels | verified | V1 fuse hardening + sentinel flood |
WebAssembly ( | ✓ custom sections | ✓ export decoys → Wabt | verified (Wabt) | LEB128 parser; preserves |
SQLite ( | ✓ honey + trap cols | ✓ column eval | verified (Node 24) | Magic-byte verified; supports |
Safetensors ( | ✓ string metadata | ✓ JSON nesting >32 | verified | HuggingFace-loadable; tensor bytes preserved |
GGUF ( | ✓ | ✓ ARRAY nesting >32 | verified | Preserves model weights and KV tensors |
Go buildinfo (ELF) | ✓ | ✓ >1 MiB | verified | Mapped ELF section |
Windows PE ( | ✓ | ✓ | verified | Mapped |
Flutter / Dart pool | ✓ | ✓ URI/token caps | verified (projected) | Snapshot magic & toolchain flood |
Erlang BEAM ( | ✓ | ✓ chunks / atoms | verified | Exceeds 64-chunk budget |
EVM + Solidity meta | ✓ | ✓ → 4 MiB input | verified (approach) | CBOR metadata + bytecode densification |
PCAP ( | ✓ | ✓ tshark JSON >8 MiB | verified (tshark) | Synthetic packet + canary injection |
Python ( | ✓ | ✓ | designed-for | CPython 3.7–3.14 marshal & AST support |
NVIDIA PTX ( | ✓ | entry flood | benchmark only | Kernel entry & canary flood |
DEX / IL2CPP / bplist / .NET / JVM / ZIP | ✓ | format-specific | designed-for | Recomputes DEX SHA-1 & Adler32 checksums |
Run npx bla-agents benchmark to execute the 14-target showcase locally:
npx bla-agents benchmarkNote: Token and USD columns below are internal estimates derived from BLA's catalog of REA limits to illustrate relative amplification across formats — for actual process-level REA errors, see the Empirical Results table above.
Aggregate Showcase Result: ~1,068.7× token amplification · ~503.5× cost amplification · 14/14 bundled showcase targets passed runtime-equivalence checks. This result is limited to the benchmark fixtures.
Target Artifact | Unprotected Baseline (est.) | BLA Protected (est.) | Token Multiplier | Runtime Equivalence |
DX-Ball sound-pan ( | 84/100 · 4,800 tok · $0.20 | 2/100 · 15.2M tok · $238.02 · | 3,172.7× | ✅ 100% |
Notion Electron clipboard ( | 98/100 · 9,132 tok · $0.34 | 2/100 · 23.1M tok · $358.57 · | 2,532.3× | ✅ 100% |
Enterprise license validator ( | 87/100 · 4,800 tok · $0.20 | 2/100 · 15.2M tok · $238.02 · | 3,172.7× | ✅ 100% |
NVIDIA PTX compute kernel ( | 81/100 · 4,800 tok · $0.20 | 7/100 · 23.1M tok · $358.20 · | 4,814× | ✅ 100% |
Erlang BEAM module ( | 81/100 · 8,900 tok · $0.34 | 5/100 · 3.86M tok · $62.08 · | 433.2× | ✅ 100% |
WASM crypto kernel ( | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.83M tok · $30.23 · | 381.5× | ✅ 100% |
Edge AI Safetensors ( | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.81M tok · $29.90 · | 376.8× | ✅ 100% |
libpcap network capture ( | 81/100 · 4,800 tok · $0.20 | 7/100 · 23.1M tok · $359.27 · | 4,817.7× | ✅ 100% |
Android Dalvik bytecode ( | 81/100 · 8,900 tok · $0.34 | 7/100 · 13.4M tok · $209.39 · | 1,510.5× | ✅ 100% |
EVM Solidity metadata ( | 81/100 · 6,440 tok · $0.26 | 6/100 · 1.78M tok · $29.40 · | 276.3× | ✅ 100% |
.NET managed assembly ( | 81/100 · 8,900 tok · $0.34 | 6/100 · 2.01M tok · $33.22 · | 226.3× | ✅ 100% |
Apple binary plist ( | 81/100 · 6,440 tok · $0.26 | 8/100 · 1.79M tok · $29.54 · | 277.6× | ✅ 100% |
SQLite entitlement DB ( | 81/100 · 10,568 tok · $0.29 | 7/100 · 1.71M tok · $28.39 · | 162.1× | ✅ 100% |
Native ELF64 (Rust/Go/Fuse/Dart) | 81/100 · 35,222 tok · $0.73 | 2/100 · 3.72M tok · $60.03 · | 105.6× | ✅ 100% |
Test your reverse-engineering agent against public BLA-hardened challenges (SEAL.json publishes SHA-256 digests only — no plaintext keys or flags in git):
Challenge | Architecture | Hardening Highlights | Try It Locally |
Node Vault + HTML Panel + WASM Core |
|
| |
Polyglot Vault (JS + WASM + Rust + Go + C) | Cross-language state entanglement & multi-binary integrity gates |
| |
Aegis Split-Key Vault | AST-encrypted strings ( |
| |
Agent-Woven Entangled Vault | Full BLA 3.x closed-loop weave ( |
|
Per-Project Random Seed — BLA automatically generates and persists a unique cryptographic seed in .blarc / bla.config.json on first run so two projects never share decoy identifiers.
Strict Packaging Lint Gates (bla lint) — Refuses bankrupt hardening when plaintext FLAG{...} secrets, single-point integrity checks, or unbound exported verifiers remain in source.
Opt-In --llm-directives — Aggressive in-band prompt decoys are off by default; pass --llm-directives (or llmDirectives: true) to enable.
Opt-In Signed Attestation (--manifest) — Emit .bla-manifest.json with --manifest, sign with --sign-manifest --manifest-key <pem>, and verify both ed25519 signature and artifact SHA-256 via bla verify-manifest <file> --public-key <pem>.
Any coding agent supporting MCP or SKILL.md workflows. npx bla-agents setup auto-registers Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. After setup, the bundled blind-llm-agents skill guides your agent through the closed-loop workflow (bla_weave_plan → source weave → bla_harden → bla_verify).
No on the hot path. Exhaustion graphs sit behind $O(1)$ number-theoretic opaque predicates, and binary/model/database decoys live in inert metadata or honey tables. Every benchmark target verifies 100% input/output equivalence against the original build.
No. All 19+ format shields are built into bla-agents in pure TypeScript/Node.js. External tools (Wabt, tshark) are only used if you run the optional live REA red-team suite (npm run redteam:rea).
No. BLA is strictly a Blue Team defensive tool that hardens your own build artifacts before release. See DISCLAIMER.md.
⚖️ DISCLAIMER.md — Defensive use & own-software policy
Issues and PRs are welcome at qybaihe/bla. Before submitting a PR:
npm run build && npm test && node dist/cli.js benchmark
node scripts/verify-website.mjs💬 LINUX DO (linux.do) — 新的理想型社区
Star History draws the GitHub star growth for qybaihe/bla. The chart image is cached for about a day and is not a per-second count. Select it to open the full history.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
Test your AI agents for security and safety weaknesses, and re-verify the fixes.
Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.
The WAF for agents. Pattern-based + heuristic firewall scans prompts, RAG documents, tool argume...
Scan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.
