# claude_re_setup

A Docker-based reverse-engineering workstation for Linux. Claude Desktop is
connected over MCP to Ghidra and to REA ("Reverse Engineer Anything"), and
binwalk, unblob and esptool are installed alongside them. Nothing beyond
Docker and an X server (or XWayland) is needed on the host.

## Usage

```bash
./run.sh            # build the image if needed, pick a folder to share, start
./run.sh --build    # rebuild the image first
./run.sh --workspace ~/re/target-x    # share this folder without asking
docker stop claude-desktop            # stop everything
```

The shared folder is mounted at `/workspace` in both containers. Sign in to
Claude Desktop on every start; the sign-in is not kept. Closing Claude
Desktop or Ghidra's project window stops everything.

## What runs where

| Container        | Contents                                                        | Network                    |
| ---------------- | --------------------------------------------------------------- | -------------------------- |
| `claude-desktop` | Claude Desktop, Ghidra GUI + GhidraMCP, binwalk, unblob, esptool | default + internal         |
| `claude-re-mcp`  | REA MCP server (headless Ghidra, binwalk, unblob), no display   | internal only, no internet |

Both containers run from the same image. REA gets its own container because
some of its tools run the target. Claude Desktop reaches it at
`http://rea:8765/mcp` through `mcp-remote`.

MCP servers in Claude Desktop (`claude-desktop/claude_desktop_config.json`):

- **ghidra**: needs a program open in Ghidra's CodeBrowser.
- **rea**: opens files from `/workspace` by itself, with its own headless
  Ghidra project.

## Sources

- Claude Desktop: Anthropic's apt repository (https://code.claude.com/docs/en/desktop-linux)
- Ghidra 12.1.4: https://github.com/NationalSecurityAgency/ghidra
- GhidraMCP 2.0: https://github.com/LaurieWired/GhidraMCP
- ESP32 Flash Loader: https://github.com/dynacylabs/ghidra-esp32-flash-loader
- REA 6.8.0 (Reverse Engineer Anything): https://github.com/morluto/rea, npm `rea-agents`
- mcp-remote 0.15.1: https://github.com/punkpeye/mcp-remote (formerly geelen/mcp-remote)
- binwalk 3.1.1: https://github.com/ReFirmLabs/binwalk
- unblob 26.6.4: https://github.com/onekey-sec/unblob
- esptool 5.6.0: https://github.com/espressif/esptool

Versions and checksums are pinned in the `Dockerfile`. `CLAUDE.md` has the
details.