Add the REA (Reverse Engineer Anything) MCP server

REA 6.8.0 (rea-agents on npm, checked against the registry's integrity
hash) runs in its own container from the same image, because some of its
tools run the target: workspace only, no display, no capabilities, and
only an internal network with no route out. It serves MCP over HTTP and
Claude Desktop reaches it through mcp-remote, installed from a committed
lockfile. It uses the image's Ghidra 12.1.4 headless and binwalk.

run.sh creates the internal network, starts REA before Claude Desktop and
stops it when Claude Desktop's container ends. Adds a README with usage
and sources.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -275,6 +275,53 @@ RUN set -e \
 ENV BINWALK_RM_EXTRACTION_SYMLINK=1 \
     KALEIDO_PATH=/opt/kaleido
 
+# Node.js, from the official tarball checked against nodejs.org's
+# SHASUMS256.txt. Ubuntu's nodejs (18) is too old for REA; 24.22.1 is the
+# version REA's own .nvmrc names.
+ARG NODE_VERSION=24.22.1
+ARG NODE_SHA256_AMD64=6c172a9ab6718f7b801fb5a7bd486af2ee5e32758086a04b84fcce2aa77095e6
+RUN set -e \
+ && arch="$(dpkg --print-architecture)" \
+ && [ "$arch" = amd64 ] || { echo "Node.js checksum only pinned for amd64" >&2; exit 1; } \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends xz-utils procps \
+ && rm -rf /var/lib/apt/lists/* \
+ && curl -fsSLo /tmp/node.tar.xz \
+        "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
+ && echo "${NODE_SHA256_AMD64}  /tmp/node.tar.xz" | sha256sum -c - \
+ && mkdir /opt/node \
+ && tar -xJf /tmp/node.tar.xz -C /opt/node --strip-components=1 --no-same-owner \
+ && rm /tmp/node.tar.xz
+ENV PATH=/opt/node/bin:${PATH}
+
+# REA, "Reverse Engineer Anything" (https://github.com/morluto/rea), from the
+# rea-agents npm package. The tarball is checked against the integrity hash
+# the npm registry lists for it; its dependencies are locked by the
+# npm-shrinkwrap.json it ships. npm blocks dependency install scripts by
+# default, so frida (optional, runtime instrumentation) stays unbuilt.
+# REA runs in its own container (see run.sh), not next to Claude Desktop,
+# because some of its tools run the target. It finds Ghidra through
+# GHIDRA_INSTALL_DIR and needs procps' ps (installed above).
+ARG REA_VERSION=6.8.0
+ARG REA_INTEGRITY=sha512-9QDeRnGqEDzABZyr04eLnBXBv/c6I9/TWu/6M0MD4pEfkySI/BIgwTODIbAReX3C1x6hjw9+Jlx4A2yUSPZ9ww==
+RUN set -e; cd /tmp \
+ && npm pack --silent "rea-agents@${REA_VERSION}" \
+ && actual="sha512-$(sha512sum "rea-agents-${REA_VERSION}.tgz" | cut -d' ' -f1 \
+        | python3 -I -c 'import base64,sys; print(base64.b64encode(bytes.fromhex(sys.stdin.read().strip())).decode())')" \
+ && [ "$actual" = "${REA_INTEGRITY}" ] || { echo "rea-agents integrity mismatch: $actual" >&2; exit 1; } \
+ && npm install --global --omit=optional --no-audit --no-fund "./rea-agents-${REA_VERSION}.tgz" \
+ && rm -rf "rea-agents-${REA_VERSION}.tgz" /root/.npm \
+ && [ "$(rea --version)" = "${REA_VERSION}" ]
+ENV REA_BINWALK_COMMAND=/usr/local/bin/binwalk
+
+# stdio-to-HTTP bridge (mcp-remote) that Claude Desktop starts to reach REA's
+# HTTP endpoint in the other container. Installed from a committed lockfile.
+COPY claude-desktop/mcp-bridge/package.json claude-desktop/mcp-bridge/package-lock.json /opt/mcp-bridge/
+RUN cd /opt/mcp-bridge \
+ && npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
+ && rm -rf /root/.npm \
+ && test -f node_modules/mcp-remote/dist/proxy.js
+
 # Ubuntu 24.04 ships a default "ubuntu" user on UID 1000; replace it.
 RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
  && groupadd -g "${USER_GID}" "${USER_NAME}" \