27 Commits
Author SHA1 Message Date
morlutoandshreyansh1729 d3627b1038 fix(mcp): preserve procedure aliases and complete name ambiguity
Derive address suggestions separately from name uniqueness across every
validated inventory row. Keep the sole exact address or an explicit ambiguous
state per name, without retaining a set of all name/address pairs. Reuse the
canonical address/value leaf contract for completion's parsed facts.

Cover order independence, same-address duplicates, later ambiguity and alias
rows beyond the MCP reply limit through the public SDK. Preserve provider
spelling, document context, cold-session admission and cancellation behavior.

Adapted from #4648 at 5b019e1179.

Closes #4623

Co-authored-by: shreyansh1729 <shreyanshiitian1729@gmail.com>
2026-10-19 08:54:23 +08:00
Kaoru0822andClaude Opus 5.5 2c90082a69 docs(mcp): describe the 100-value completion reply limit (#4086)
* docs(mcp): describe the 100-value completion reply limit

The prompt guide said completion returns all matching values. A reply
carries at most 100 values, the MCP limit, with total and hasMore
reporting omitted matches. Describe that and how to reach omitted values
with a longer prefix.

Fixes #3866

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(mcp): qualify longer-prefix completion recovery

Review follow-up. A longer prefix reaches an omitted value only when it
excludes other matches; values whose normalized forms share a prefix
with more than 100 matches stay unreachable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 05:20:50 -07:00
Ysopwnableandfactory-droid[bot] 7ae3c50a9d docs: correct drift and reorganize English guides (#2207)
Put setup, developer commands, MCP replies, and investigation recipes before
client details and implementation references. Preserve existing guide anchors,
examples, provenance, partial-result recovery, and provider restrictions.

Correct verified documentation drift, synchronize the Ghidra capability
wording, and regenerate metadata for skill version 40. Keep uncertain platform
and lifecycle findings unchanged. Refs #2156.

Validation: 56 focused tests, check:fast, docs:check, VitePress production build,
format and link/example checks. Real isolated CLI/MCP probes cover Ghidra,
NativeAOT, HAR, cancellation, Chrome, large ELF delivery, native type limits,
and the new JS/managed/process/setup recipes. Heavy work uses two CPUs;
a resource-heavy DOM probe was stopped and replaced by a smaller real CDP
payload-limit control. Windows, macOS GUI, ADB, and the full CI matrix were
not executed.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
2026-10-12 22:14:25 +08:00
Matt Van HornandMatt Van Horn db675f1d52 feat(mcp): select views of retained analysis results (#1180)
Add explicit summary, facet, item and paged views of retained analysis Evidence without repeating analysis. Preserve captured observations, graph validation, artifact identity, coverage and complete default results.

Fixes #1050

Verified with focused source, CLI, pinned-SDK schema and MCP tests, serial static checks, and one complete native Windows Notion ASAR workflow. Real Hopper/Ghidra verification was not performed for this provider-independent projection change.

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
2026-10-09 12:45:48 +08:00
N0zoM1z0 8d44b3edd3 fix(target): explain the JavaScript directory analysis route (#733) 2026-10-06 19:53:08 +08:00
morluto b5e98915c6 fix(tools)!: simplify direct invocation and harden boundary contracts (#555)
Remove REA permission grants, scope ceilings, approval confirmations, and inert settings. Preserve selected local evidence, accept caller-chosen commands and paths, and report actual runtime failures.

Harden provider results, schema serialization, snapshot evidence binding, archive paths, source maps, native screenshots, managed EH parsing, and cancellation cleanup. Regenerate tool metadata and document direct invocation.

BREAKING CHANGE: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.
2026-10-05 20:16:44 +08:00
morluto 3b64c813cf docs(tools): clarify complete inline results 2026-09-29 17:00:29 +08:00
morluto 3fd96506f2 refactor(prompts): make tool workflows optional 2026-09-29 12:16:40 +08:00
morluto 53db3a476b docs: refresh tool catalog and cleanup audit fixtures 2026-09-29 11:23:24 +08:00
morluto 0fe96d92df refactor(artifacts): consolidate inventory into inspection 2026-09-29 09:22:24 +08:00
morluto 0d96275b68 refactor: return complete tool results inline 2026-09-29 07:08:46 +08:00
morluto 969519c00f fix(mcp): clarify routing and advertise input examples 2026-07-29 07:18:09 +00:00
morluto b2d1f2affd feat(setup): verify installed skill catalog identity 2026-07-16 19:51:25 +08:00
N0zoM1z0 c506664744 feat(dotnet): import managed reconstructions 2026-07-16 20:37:42 +09:00
N0zoM1z0 5f66cfd57a feat(dotnet): add managed runtime correlation planning 2026-07-16 20:10:36 +09:00
N0zoM1z0 466b1bbebe feat(dotnet): add managed native boundary inspection 2026-07-16 18:57:56 +09:00
N0zoM1z0 55794d6083 feat(dotnet): add managed member comparison 2026-07-16 18:27:08 +09:00
N0zoM1z0 98cad3788d feat(dotnet): add managed member inspection 2026-07-16 17:44:36 +09:00
N0zoM1z0 c251c38aa2 feat(dotnet): add managed artifact triage 2026-07-16 17:05:03 +09:00
N0zoM1z0 d86231ad33 feat(application): add isolated JavaScript replay
Expose one plan/execute replay contract through both CLI and MCP with exact source, input, runtime, sandbox, limit, and export commitments.

Run selected ESM and extracted CommonJS/Rspack factories in a disposable Linux x64 Bubblewrap namespace with a content-addressed Node ELF closure, architecture-checked seccomp, delegated systemd cgroup limits, bounded protocol capture, cancellation, and observable cleanup.

Preserve left and right observations as Evidence, derive differential comparisons without erasing unknowns, add optional separately authorized reproducers, and fail closed on stale plans or unavailable host boundaries.

Add source-owned parser, sanitizer, clipboard, denial, timeout, OOM, protocol-forgery, and cancellation coverage; a real Linux verifier and workflow; regenerated catalogs and TypeDoc; and updated the packaged REA analysis skill for the 83-tool inventory.
2026-07-16 15:45:55 +09:00
N0zoM1z0 778b995bbf feat(application): add cross-layer graph workflows 2026-07-16 11:29:54 +09:00
N0zoM1z0 8c67dbd49e feat(electron): reconcile static artifacts with passive runtime 2026-07-16 09:55:21 +09:00
N0zoM1z0 3fa2304bc7 feat(electron): map static process and IPC boundaries 2026-07-16 07:56:13 +09:00
N0zoM1z0 941d7101dd feat(session): add explicit provider registry and target binding
Introduce deterministic deep-provider discovery and immutable per-target routing while retaining disjoint artifact and native capability families.

Expose provider selection consistently through MCP, CLI, environment configuration, session status, prompt completion, typed diagnostics, and generated documentation. Preserve exact provider/profile provenance without request racing or transparent fallback.

Cover overlapping providers, ambiguity, rejection details, cancellation, restoration, package installation, and real Hopper target switching.
2026-07-15 22:13:48 +09:00
N0zoM1z0 be76f8090b feat: add web and Electron reverse-engineering workflows 2026-07-14 20:24:12 +09:00
N0zoM1z0 2c1ceabbf1 feat: add passive website reverse engineering 2026-07-14 12:27:13 +08:00
N0zoM1z0 24c3adb553 feat: add guided MCP workflow prompts 2026-07-13 21:04:28 +08:00