LinusandClaude Opus 5.5
0315d5816e
run.sh shows a window (zenity form, terminal prompts without zenity) for a base URL, token, auth header and optional model list. Left empty, Claude Desktop starts normally with the claude.ai sign-in. Otherwise it runs in its third-party gateway mode: run.sh writes the managed config (inferenceProvider "gateway" and friends) and copies it into the created container as root, because Claude Desktop ignores /etc/claude-desktop/managed-settings.json unless root owns it. The host copy is deleted right away; nothing is kept between starts. Claude Desktop only allows plain http to loopback, so for an http:// gateway launch-apps.sh runs socat on 127.0.0.1:18080 and forwards to it. localhost is rewritten to host.docker.internal for servers on the host. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
70 lines
3.4 KiB
Markdown
70 lines
3.4 KiB
Markdown
# claude_re_setup
|
|
|
|
A Docker-based reverse-engineering workstation for Linux. Claude Desktop is
|
|
connected over MCP to Ghidra and to REA ("Reverse Engineer Anything"), and
|
|
binwalk, unblob and esptool are installed alongside them. Nothing beyond
|
|
Docker and an X server (or XWayland) is needed on the host.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
./install.sh # build the image and add "Claude RE Workstation" to the app menu
|
|
./install.sh --uninstall # remove that launcher again
|
|
./run.sh # build the image if needed, pick a folder to share, start
|
|
./run.sh --build # rebuild the image first
|
|
./run.sh --workspace ~/re/target-x # share this folder without asking
|
|
docker stop claude-desktop # stop everything
|
|
```
|
|
|
|
On every start a window asks for the model provider:
|
|
|
|
- **Base URL empty:** Anthropic's models; sign in to claude.ai as usual.
|
|
- **Base URL set:** Claude Desktop runs in its third-party "gateway" mode, with
|
|
no claude.ai account: Chat, Code and Cowork send their requests to that URL
|
|
with the token. The server must speak the Anthropic Messages API
|
|
(`/v1/messages`), e.g. a self-hosted model behind LiteLLM. Models are
|
|
optional (comma-separated, first = default); without them Claude Desktop
|
|
asks the server's `/v1/models`. A server on this machine is reachable as
|
|
`http://host.docker.internal:PORT` (`localhost` is rewritten to that) and must
|
|
listen on an address Docker can reach. With `http://` the token is sent
|
|
unencrypted.
|
|
|
|
The shared folder is mounted at `/workspace` in both containers. Neither the
|
|
sign-in nor the token is kept between starts. Closing Claude
|
|
Desktop or Ghidra's project window stops everything.
|
|
|
|
The launcher runs `run.sh` from this checkout, so re-run `./install.sh` after
|
|
moving it. Started from the menu, errors appear in a dialog.
|
|
|
|
## What runs where
|
|
|
|
| Container | Contents | Network |
|
|
| ---------------- | --------------------------------------------------------------- | -------------------------- |
|
|
| `claude-desktop` | Claude Desktop, Ghidra GUI + GhidraMCP, binwalk, unblob, esptool | default + internal |
|
|
| `claude-re-mcp` | REA MCP server (headless Ghidra, binwalk, unblob), no display | internal only, no internet |
|
|
|
|
Both containers run from the same image. REA gets its own container because
|
|
some of its tools run the target. Claude Desktop reaches it at
|
|
`http://rea:8765/mcp` through `mcp-remote`.
|
|
|
|
MCP servers in Claude Desktop (`claude-desktop/claude_desktop_config.json`):
|
|
|
|
- **ghidra**: needs a program open in Ghidra's CodeBrowser.
|
|
- **rea**: opens files from `/workspace` by itself, with its own headless
|
|
Ghidra project.
|
|
|
|
## Sources
|
|
|
|
- Claude Desktop: Anthropic's apt repository (https://code.claude.com/docs/en/desktop-linux)
|
|
- Ghidra 12.1.4: https://github.com/NationalSecurityAgency/ghidra
|
|
- GhidraMCP 2.0: https://github.com/LaurieWired/GhidraMCP
|
|
- ESP32 Flash Loader: https://github.com/dynacylabs/ghidra-esp32-flash-loader
|
|
- REA 6.8.0 (Reverse Engineer Anything): https://github.com/morluto/rea, npm `rea-agents`
|
|
- mcp-remote 0.15.1: https://github.com/punkpeye/mcp-remote (formerly geelen/mcp-remote)
|
|
- binwalk 3.1.1: https://github.com/ReFirmLabs/binwalk
|
|
- unblob 26.6.4: https://github.com/onekey-sec/unblob
|
|
- esptool 5.6.0: https://github.com/espressif/esptool
|
|
|
|
Versions and checksums are pinned in the `Dockerfile`. `CLAUDE.md` has the
|
|
details.
|