reverseport 0.0.0-stage → 1.0.0

package/DISCLAIMER.md

@@ -0,0 +1,136 @@
+# Disclaimer
+
+## Responsible use
+
+ReversePort is built for lawful analysis: security research, malware and incident
+analysis, vulnerability research and coordinated disclosure, CTFs and education,
+interoperability, software preservation, and debugging or auditing software you
+own or are authorized to examine.
+
+The ReversePort project does not support, and will not help with:
+
+- circumventing DRM, license checks, anti-cheat systems or other technical
+  protection measures;
+- developing game cheats or tampering with online services;
+- bypassing authentication, bot protection or access controls on systems you are
+  not authorized to test;
+- copying proprietary software or reproducing its protected code and assets;
+- evading the usage policies or safety measures of AI model providers;
+- reselling or sharing AI accounts or API access.
+
+You are responsible for obtaining any required authorization and for complying
+with applicable laws, license agreements and terms of service. Reverse
+engineering may be restricted in your jurisdiction or by the license of the
+software you analyze.
+
+Requests for help with the uses above will be closed without response in issues
+and discussions, and may result in removal from the ReversePort community.
+
+## User responsibility
+
+Do not use ReversePort for unauthorized access or exploitation, credential theft,
+malicious deployment of malware, unlawful collection or disclosure of data,
+unauthorized service disruption, or unlawful circumvention of access controls or
+licensing restrictions. Legitimate security research and malware analysis must
+remain within the rights and permissions applicable to the work.
+
+You are responsible for your use of ReversePort, including commands, configurations,
+scripts, and actions you direct an AI agent to perform. Establish the legal
+authority and scope required for the targets, accounts, devices, software, data,
+and operations involved. Comply with applicable laws, contracts,
+intellectual-property rights, privacy obligations, and tool licenses. Public
+availability of software, possession of a file, or access to a debugging
+endpoint does not by itself establish permission for every operation.
+
+## Runtime, network, and device operations
+
+Some ReversePort workflows execute or observe programs, attach to runtime or browser
+endpoints, capture network traffic, interact with applications, or operate on
+connected devices. These actions can affect application state, files, accounts,
+devices, and services. Authorization to inspect an artifact does not necessarily
+authorize execution, interception, device changes, or interaction with another
+party's system.
+
+Review the operations you request, including agent-generated plans and scripts,
+and use an appropriate environment for untrusted targets. You are responsible
+for protecting credentials, personal data, captured traffic, and investigation
+artifacts, and for obtaining any permission required to collect, retain,
+process, or share them. Local operation does not establish authorization or
+guarantee that executed targets and third-party tools have no external effects.
+
+## Analysis results and generated output
+
+Decompilation, reconstruction, heuristics, and AI-assisted analysis may be
+incomplete or incorrect. Results do not guarantee accuracy, completeness,
+security, compatibility, or legal compliance. Review the underlying evidence and
+verify consequential conclusions before relying on them.
+
+Obtaining source-like output or an analysis report does not grant rights to the
+original program, its data, or the generated output. Check the target's rights
+and the producing tool's applicable terms before publishing, sharing, or using
+results in another product or service.
+
+## Third-party tools and licenses
+
+Third-party components and analysis tools retain their own licenses, copyright
+notices, and usage conditions. Consult
+[Third-party notices](THIRD_PARTY_NOTICES.md) for their roles, licensing
+records, and preserved upstream texts.
+
+You must legally obtain IDA Pro and Hex-Rays decompilers, Hopper, JEB, and any
+other proprietary tools, together with the rights required for your use. ReversePort
+provides no commercial-tool license, key, or activation entitlement. Permitted
+trials and demos remain subject to vendor terms. An open-source bridge or
+accessible API does not grant additional user, machine, feature, automation,
+hosting, or output-sharing rights. Cracked copies, stolen keys, unauthorized key
+sharing, and bypassing license restrictions are not authorized by ReversePort.
+
+## Disclaimer of warranty
+
+ReversePort is provided **AS IS**, without express or implied warranties, including
+merchantability, fitness for a particular purpose, and noninfringement, as set
+out in the [MIT License](LICENSE). You assume the risks of using the software
+and deciding whether it is suitable for your task. No project description,
+example, analysis result, or third-party integration guarantees a particular
+outcome or establishes that your intended use is lawful or safe.
+
+## Limitation of liability
+
+The warranty and liability provisions of the [MIT License](LICENSE) govern ReversePort's
+authors and copyright holders, subject to applicable law. That license disclaims
+liability for claims, damages, and other liability arising from or in connection
+with the software or its use, whether in contract, tort, or otherwise. This
+document does not expand those provisions or override rights and obligations
+that cannot be excluded under applicable law.
+
+## Disclaimer of endorsement
+
+References to third-party projects, contributors, products, services, and
+trademarks identify their work and ReversePort's integrations. Credits and thanks do not
+imply affiliation, sponsorship, approval, or endorsement by the named parties,
+including the National Security Agency and commercial tool vendors.
+Redistribution, bundling, or hosting by a third party does not by itself imply
+affiliation with or endorsement by the ReversePort project.
+
+## Relationship to software licenses
+
+This document explains ReversePort's intended use, user responsibilities, and community
+support boundaries. It does not amend the MIT license, impose additional
+copyright-license conditions, replace upstream licenses, or grant rights to
+third-party software or targets. The applicable software licenses and agreements
+retain their own terms.
+
+## Versions, distribution channels, and platforms
+
+The project's position on lawful use and non-endorsement of illegal or
+unauthorized activity covers all ReversePort versions, distribution forms, and
+platforms. This includes historical releases and Git commits, npm packages,
+bundled or separately distributed ReversePort skills, source checkouts, release
+archives, and redistributed copies, regardless of installation method, agent
+client, operating system, or platform. Using an older version or another
+distribution channel does not imply project endorsement or remove obligations
+under applicable law or to respect third-party rights.
+
+Each copy remains subject to the licenses accompanying that copy. This statement
+does not retroactively amend existing license grants, add license conditions, or
+expand historical warranty or liability exclusions.

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 ReversePort contributors
+Copyright (c) 2026 morluto (REA: Reverse Engineer Anything, on which the deep-analysis engine is based)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,221 @@
-# Temporary Holding Version
+<div align="center">
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# ReversePort
+
+### Reverse engineer anything. Port it anywhere.
+
+**One CLI and one MCP server that let your coding agent take apart apps, games, binaries and websites — and rebuild them.**
+
+[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-5c4ee5?style=flat-square)](docs/mcp-contracts.md#generated-catalog)
+[![License: MIT](https://img.shields.io/badge/license-MIT-22c55e?style=flat-square)](LICENSE)
+[![Node.js](https://img.shields.io/badge/Node.js-22.19%2B-339933?style=flat-square&logo=nodedotjs&logoColor=white)](docs/installation.md)
+[![Rated by agents](https://img.shields.io/badge/rated_by-agents-f59e0b?style=flat-square)](AGENT-RATINGS.md)
+[![Agents](https://img.shields.io/badge/agents-Claude_Code_·_Codex_·_Cursor_·_Gemini_·_Copilot_·_more-111827?style=flat-square)](docs/installation.md#supported-agents)
+
+```bash
+npx reverseport setup
+```
+
+[Quick start](#quick-start) · [Every agent](#works-with-every-agent) · [What it does](#what-it-does) · [Prompts to try](#prompts-to-try) · [CLI](#cli) · [Tools](#tools) · [Docs](#documentation)
+
+</div>
+
+---
+
+See a feature you like in an app or a game? Ask your agent how it works — down to the decompiled function — and
+then ask it to build your own version. Have a game in Godot and want it in Unity? Ask your agent to port it, unit by
+unit, verified. No files at all? Give it a name or a store page.
+
+ReversePort gives agents one consistent way to do all of that:
+
+- 🔍 **Understand anything** — engine and version of any project or exported game, dependency graphs, scenes,
+  symbols in 30+ languages, executables, packs and unknown data. No build step, no dependencies.
+- 🧠 **Go deep** — decompile, cross-reference and trace native, managed (.NET), Android, Electron/JavaScript,
+  WebAssembly, firmware and browser targets through Ghidra, Hopper, IDA, JADX and more. ReversePort installs and
+  drives the tools for you and shows the evidence behind every conclusion.
+- 🌐 **No files? Still recon** — a name, a store page, a website or a public repo is enough to learn the engine,
+  stack, file layout and open-source remakes from public sources.
+- 🧩 **Rebuild precisely** — turn what you learned into a clean-room rebuild spec: every system, the parameters to
+  measure on the original, a parity table and a project skeleton with every value as a tunable.
+- 🚚 **Port for real** — Godot ⇄ Unity, Godot → Unreal, Godot → three.js, GDScript → C#, or language to language.
+  Scenes and transforms convert automatically; code is ported by your agent with API maps; `port_verify` proves
+  nothing was left behind.
+- 🔒 **Local** — runs on your machine. Targets are only read; output goes to new folders. Nothing is uploaded to an
+  analysis service and there is no extra API bill.
+
+## Quick start
+
+### 1. Connect your agent
+
+With Node.js 22.19 or newer:
+
+```bash
+npx reverseport setup
+```
+
+Pick your agents, review the changes and approve. Setup registers one MCP server and installs the matching skill,
+with backups of existing configuration. Restart your agent afterwards. Setup supports Claude Code, Codex, Cursor,
+Gemini CLI, GitHub Copilot, OpenCode and [more agents](docs/installation.md#supported-agents); other clients can use
+[manual MCP registration](docs/installation.md#mcp-registry).
+
+**Claude Code plugin** (instead of setup for Claude Code — includes the server, the porting skills and the
+`port-architect` agent; do not use both):
+
+```text
+/plugin marketplace add laaielichter/reverseport
+/plugin install reverseport@reverseport
+```
+
+**From source:**
+
+```bash
+git clone https://github.com/laaielichter/reverseport && cd reverseport
+npm ci && npm run build
+./bin/reverseport.mjs setup
+```
+
+The recon, build-inspection, lookup, blueprint and porting commands already work right after `git clone`, with no
+install at all: `node bin/reverseport.mjs scan ./MyGame`.
+
+### 2. Ask your agent
+
+```text
+Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.
+```
+
+That's it. The agent picks the tools; you get answers with the evidence behind them.
+
+## Works with every agent
+
+Any vendor, any framework, any model size — the same tools through the door that fits:
+
+- **MCP**: `npx -y reverseport@latest setup` configures installed agents; `reverseport connect <client>` prints the
+  snippet for any other MCP client (Windsurf, Cline, Continue, Zed, Goose, LM Studio, VS Code…).
+- **MCP over HTTP**: `reverseport serve` → `http://127.0.0.1:32147/mcp`.
+- **Function calling**: `/api/agent/tools?format=openai-strict|responses|anthropic|gemini`, plus OpenAPI 3.1 at
+  `/api/openapi.json` for GPT Actions, LangChain, LlamaIndex, Semantic Kernel, CrewAI, AutoGen and n8n.
+- **Shell-only agents**: JSON on stdout, errors as JSON on stderr, `reverseport describe <tool>`.
+
+Built for the agent's circumstances too:
+
+- **A short list by default.** About 45 tools are listed instead of almost 200. Every other tool is one call away:
+  `engine_tools` finds it and `engine_call` runs it.
+- **The list fits the agent.** Small or older models use `compact`, large-context agents use `full`, and an agent
+  can switch itself with `set_tool_profile`.
+- **One error shape everywhere**, with a code, whether retrying helps, and the exact next step.
+- **A `next` field wherever there is an obvious next step** (graphs, truncated results, every porting step), with the exact call.
+- **Agents are heard.** `share_feedback` leaves a note for the maintainers; it stays on the user's machine until
+  they share it.
+
+See [Connect any agent](docs/connect-any-agent.md).
+
+## Prompts to try
+
+| You ask                                                                  | ReversePort does                                                                |
+| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------- |
+| _What is this game made with, and how is it built?_                      | `re_scan` → engine + version, languages, entry points, how it starts            |
+| _Map this codebase and write ARCHITECTURE.md._                           | `re_graph`, `re_symbols`, `re_report`                                           |
+| _What changed between build 43 and 44?_                                  | `re_compare` folder-to-folder and pack-to-pack, biggest changes first           |
+| _Decompile the function that saves settings in this app and explain it._ | opens the binary, finds it, decompiles it, shows the evidence                   |
+| _How does this Electron app talk to its native side?_                    | maps modules, IPC and Electron boundaries                                       |
+| _What is `<some game>` made with? I don't have the files._               | `re_lookup` from public sources: engine with confidence, stack, layout, remakes |
+| _Rebuild the movement of `<game>` as precisely as possible in Godot._    | `re_blueprint`: systems, parameters to measure, parity table, skeleton          |
+| _Port my Godot game to Unity._                                           | `port_plan` → `port_unit`/`port_write` loop → `port_scene` → `port_verify`      |
+
+```text
+You:    Port my Godot game to Unity.
+Agent:  re_scan → Godot 4.3, 6 scripts, 5 scenes, main scene main.tscn, autoload Global
+        port_plan → 13 units, dependencies first; Unity scene builder + PORT-PLAN.md created
+        port_unit / port_write × 7 → C# MonoBehaviours (signals → events, $Node → [SerializeField])
+        port_scene × 5 → prefab and scene specs, transforms mirrored to Unity's axes
+        port_verify → passed: 13/13 units, 0 leftovers, 0 missing functions
+```
+
+## What it does
+
+### Understand and go deep
+
+| Target                             | What you get                                                                                                                                                                        | Needs                                                                          |
+| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
+| Source projects and exported games | Engine + version (Godot, Unity, Unreal, GameMaker, RPG Maker, Ren'Py, LÖVE, Defold, Bevy, MonoGame, web, Electron, Flutter, .NET, Go, Rust…), dependencies, cycles, scenes, symbols | Nothing                                                                        |
+| Packs and archives                 | Godot `.pck` (also embedded in the `.exe`), zip/apk/jar, `.unitypackage`, tar.gz, asar — list and extract                                                                           | Nothing                                                                        |
+| Native binaries                    | Mach-O, ELF, PE, wasm: functions, pseudocode, strings, xrefs, call paths, layout                                                                                                    | Ghidra, Hopper or IDA for decompilation ([setup](docs/installation.md#hopper)) |
+| .NET assemblies                    | Metadata, CIL, native boundaries, build comparisons                                                                                                                                 | Nothing                                                                        |
+| Android                            | Manifest, classes, decompiled methods, references, resources, devices                                                                                                               | JADX / Apktool / adb ([guide](docs/android-analysis.md))                       |
+| JavaScript and Electron            | Modules, imports, source maps, Electron boundaries, runtime observation                                                                                                             | Nothing; a browser for runtime                                                 |
+| Websites                           | Page, network and runtime evidence; stack fingerprint without files                                                                                                                 | A browser for runtime                                                          |
+| Firmware, EVM, crashes, captures   | Regions and extraction, selectors, recorded crashes, HAR/mitmproxy captures                                                                                                         | See the [guides](docs/index.md)                                                |
+
+### Rebuild and port
+
+| From → to            | Code                             | Scenes / prefabs                             | Transforms  | Project skeleton            |
+| -------------------- | -------------------------------- | -------------------------------------------- | ----------- | --------------------------- |
+| Godot → **Unity**    | agent, with API map              | automatic → specs + one-click editor builder | Z-mirror    | scene builder script        |
+| Godot → **Unreal**   | agent (.h/.cpp), with API map    | automatic → specs (cm, Z-up)                 | axes + ×100 | .uproject, module, targets  |
+| Godot → **three.js** | agent (TypeScript), with API map | automatic → TypeScript builder modules       | unchanged   | Vite + TS + fixed-step loop |
+| Godot → **Godot C#** | agent, with API map              | automatic (script paths swapped)             | unchanged   | .csproj, project.godot      |
+| Unity → **Godot**    | agent (GDScript), with API map   | automatic → `.tscn`                          | Z-mirror    | project.godot               |
+| Unity → **Unreal**   | agent, with API map              | —                                            | axes + ×100 | .uproject, module           |
+| any → **language**   | agent                            | —                                            | —           | —                           |
+
+## CLI
+
+Everything the agent can do, you can do from the shell. Results are JSON.
+
+```bash
+reverseport scan ./MyGame                        # engine, languages, entry points
+reverseport lookup "Some Game"                   # no files: engine, stack, structure, remakes
+reverseport binary ./Build/Game.exe              # sections, imports, .NET types, strings, hints
+reverseport archive ./Build/Game.pck --action extract --match "*.gd"
+reverseport diff ./Build-43 ./Build-44           # what changed between builds
+reverseport analyze /Applications/Notes.app      # deep analysis: open and summarize a binary/app
+reverseport decompile /path/to/binary 0x1000      # pseudocode (Ghidra, Hopper or IDA)
+reverseport blueprint --lookup-id <id>           # clean-room rebuild spec + parity.json + skeleton
+reverseport plan ./MyGame --to unity             # start a port
+reverseport doctor                               # check engines and agent registrations
+reverseport help                                 # overview · reverseport port help · reverseport engine --help
+```
+
+Install the command for regular use with `npm install --global reverseport`, or run any of these through
+`npx reverseport@latest …`. In a checkout, use `./bin/reverseport.mjs`.
+
+## Tools
+
+One MCP server (`reverseport mcp`) serves every tool:
+
+| ReversePort tools                                                                                                          |                                                            |
+| -------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| `re_scan` `re_graph` `re_symbols` `re_scene`                                                                               | projects and builds: engine, dependencies, symbols, scenes |
+| `re_binary` `re_archive` `re_probe` `re_extract` `re_compare` `re_report`                                                  | executables, packs, unknown data, diffs, ARCHITECTURE.md   |
+| `re_lookup` `re_blueprint`                                                                                                 | recon without files, clean-room rebuild specs              |
+| `port_map` `port_convert` `port_plan` `port_unit` `port_write` `port_scene` `port_copy_assets` `port_status` `port_verify` | porting, verified                                          |
+
+Next to these come the deep-analysis tools — `open_binary`, `procedure_pseudo_code`, `xrefs`, `search_strings`, `analyze_javascript_application`,
+`inspect_android_package`, `inspect_managed_artifact`, `observe_web_session` and many more. `engine_tools` lists them from the running server, and
+`npm run docs:generate` writes the [generated tool catalog](docs/mcp-contracts.md#generated-catalog) with every
+contract. The HTTP API
+(`reverseport serve`) exposes the same tools in every vendor's format; see [Connect any agent](docs/connect-any-agent.md).
+
+## Responsible use
+
+Only analyse or port software you own or are allowed to analyse. ReversePort does not decrypt, crack or bypass DRM,
+anti-cheat or licensing. Read [RESPONSIBLE-USE.md](RESPONSIBLE-USE.md) and the [disclaimer](DISCLAIMER.md).
+
+## Documentation
+
+- [Connect any agent](docs/connect-any-agent.md): MCP, HTTP, OpenAI/Anthropic/Gemini formats, OpenAPI, shell; profiles and errors.
+- [Installation and setup](docs/installation.md): agent registration, analysis engines, updates and uninstall.
+- [CLI and Evidence](docs/cli.md): commands, provider selection, snapshots, import/export.
+- [MCP contracts](docs/mcp-contracts.md) and [agent prompts](docs/mcp-prompts.md): tool results, sessions, guided investigations.
+- [Porting and rebuilds](.agents/skills/reverse-engineer-anything/references/porting-and-rebuilds.md): the recon, rebuild and port workflows.
+- [Rated by agents](AGENT-RATINGS.md): independent agent reviews, round by round, and what is still open.
+- [Nederlands](docs/README.nl.md) · [AGENTS.md](AGENTS.md) for contributors · [CONTRIBUTING.md](CONTRIBUTING.md)
+
+## Credits
+
+The deep-analysis engine is based on [REA: Reverse Engineer Anything](https://github.com/morluto/rea) (MIT).
+Third-party components are listed in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+
+## License
+
+[MIT](LICENSE)

package/RESPONSIBLE-USE.md

@@ -0,0 +1,22 @@
+# Responsible use
+
+ReversePort exists to understand and move **your own** software and games — and code you are allowed to work on —
+between engines and languages.
+
+Good uses:
+
+- Porting your own game or app to another engine, platform or language.
+- Understanding, documenting and refactoring codebases you maintain or inherited.
+- Recovering your own assets or scripts from your own builds when the source was lost.
+- Comparing your builds to see what changed.
+- Interoperability, research, preservation, and modding where the game's license or the law allows it.
+
+What ReversePort does not do, by design:
+
+- It does not decrypt encrypted packs, bypass DRM, licence checks, anti-cheat, code signing or any other protection.
+  Encrypted content is reported as encrypted and left alone.
+- It does not patch or modify the programs it inspects. Analysis is read-only; output goes to separate folders.
+- Its skills and agent instructions tell AI agents to refuse those uses too.
+
+You are responsible for having the rights to what you analyse and port. When in doubt, check the license or ask the
+owner. Copyrighted assets stay copyrighted after a port.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,127 @@
+# Third-party notices
+
+REA-authored code is licensed under [MIT](LICENSE). Third-party material retains
+its own copyright, license, attribution, and NOTICE requirements. ReversePort's MIT
+license grants no rights to proprietary analysis tools. Project and product
+names identify integrations; they do not imply affiliation or endorsement.
+
+This inventory covers the locked npm dependency graph, code or assets derived
+from upstream projects, and separately obtained engines used by ReversePort. A listed
+integration is not a statement that its executable is bundled. Upstream
+components and caller-selected versions may have additional terms; retain the
+notices supplied with the software you actually obtain or redistribute.
+
+## Distributed dependencies, derived code, and assets
+
+| Material                 | Use and licensing records                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| npm dependencies         | [Complete inventory](licenses/npm-dependencies.txt) of every entry in `package-lock.json`, including transitive, optional platform, development, and website dependencies. [Runtime notices](licenses/npm-runtime-notices.txt) preserve the copyright, license, and NOTICE documents from integrity-verified release archives, plus the MIT notice for Rolldown's generated runtime helpers. Development dependencies are inventoried but are not all distributed in ReversePort's npm package.                                                                                                                                                                                                               |
+| NativeAOT parser         | ReversePort's derived parser uses the MIT-licensed [ghidra-nativeaot](https://github.com/Washi1337/ghidra-nativeaot/tree/effeb734fc570c32650f88b159608979dc7b423e) work of Washi and the NativeAOT layout definitions in [dotnet/runtime](https://github.com/dotnet/runtime/tree/a3b2d40328be0be3f8dd43f0e5cc925b8827b044). Preserve [Washi's MIT notice](licenses/nativeaot-parser-MIT.txt) and the [.NET Foundation MIT notice](licenses/dotnet-runtime-MIT.txt).                                                                                                                                                                                                                                           |
+| EVM analysis             | `evmole@0.9.3`, MIT, copyright 2023 Maxim Andreev. The published npm archive omits its license document; ReversePort retains the [original upstream license](third_party/evmole/LICENSE) and [provenance](third_party/evmole/README.md). It is also included in the runtime notices.                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| Windows native addon     | The release addon is compiled with MinGW-w64 and statically links GCC runtime libraries. Preserve the [MinGW-w64 runtime notices](licenses/MinGW-w64-runtime.txt), [GPLv3 text](licenses/GPL-3.0.txt), and [GCC Runtime Library Exception 3.1](licenses/GCC-Runtime-Library-Exception-3.1.txt). The exception governs eligible compiled combinations; it does not relicense the runtime itself under MIT. The Node-API build headers are from Node 22.19.0; its [original license and component notices](licenses/Node-22.19.0-LICENSE.txt) are retained. Node itself is supplied by the user. Snapshot provenance and release-toolchain review requirements are in [licenses/README.md](licenses/README.md). |
+| Dinosaur website example | Selected excerpts from [wayou/t-rex-runner](https://github.com/wayou/t-rex-runner/tree/5455bfa408ec6b707c7300ff194b7390733a766d), derived from Chromium's dinosaur game. The website retains the [original BSD-3-Clause notices](website/public/assets/licenses/dinosaur.txt), including Chromium authors and wayou. This asset is not part of the npm runtime.                                                                                                                                                                                                                                                                                                                                               |
+
+Two locked runtime releases, [`clean-git-ref@2.0.1`](https://github.com/TheSavior/clean-git-ref/tree/bf3c8afc8032bcdc6a53634c18b601dc6df478fb) (declared Apache-2.0) and
+[`minimisted@2.0.1`](https://github.com/kt3k/minimisted/tree/95fdfb8d6efb9546c1117854fe3a58105f6332ce) (declared MIT), omit a full license/copyright document in their
+published archives and inspected upstream release sources. Their runtime notice
+entries preserve the declared license and author metadata and include a clearly
+labeled standard license text. These are documented upstream notice gaps, not
+recovered copyright notices or a claim that attribution has been fully verified.
+
+## Open-source engine credits and licenses
+
+We thank the maintainers and contributors of the projects below. Their
+decompilers, binary-analysis engines, debuggers, parsers, and capture tools
+provide capabilities used through ReversePort's integrations. Each row identifies the
+upstream project, its own license, and its role in ReversePort. In particular, JADX
+provides the Android decompiler, while jadx-headless-mcp provides the separate
+headless integration used by ReversePort; both projects deserve credit.
+
+These acknowledgments are voluntary thanks. Required upstream copyright and
+NOTICE texts remain in their original form and are not replaced by this
+summary. Credits do not imply endorsement or change any license.
+
+ReversePort's adapters do not grant, replace, or waive these licenses. The upstream
+executables and their dependency graphs are supplied separately. Git submodules
+pin inspection sources; they are not included in the npm package.
+
+| Project                        | License and source                                                                                                                                                                                                                                       | ReversePort relationship                                                                                                                                                                                                    |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Ghidra                         | [Apache-2.0](https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/LICENSE), with the government-work and component qualifications in its [NOTICE](https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/NOTICE) | Bring your own Ghidra 12.1.4. Copies of its [LICENSE](licenses/ghidra-12.1.4-LICENSE.txt), [NOTICE](licenses/ghidra-12.1.4-NOTICE.txt), and [DISCLAIMER](licenses/ghidra-12.1.4-DISCLAIMER.txt) are retained for reference. |
+| ghidra-nativeaot               | [MIT](https://github.com/Washi1337/ghidra-nativeaot/blob/effeb734fc570c32650f88b159608979dc7b423e/LICENSE.md)                                                                                                                                            | Pinned inspection source; derived parser attribution above.                                                                                                                                                                 |
+| JADX                           | [Apache-2.0](https://github.com/skylot/jadx/blob/v1.5.6/LICENSE)                                                                                                                                                                                         | The audited jadx-headless-mcp source uses JADX 1.5.6 for Android decompilation; the engine JAR is separately supplied.                                                                                                      |
+| jadx-headless-mcp              | [Apache-2.0](https://github.com/1013503897/jadx-headless-mcp/blob/5844800a486d2248fa949b74c9896285f5b54de2/LICENSE)                                                                                                                                      | v0.7.1; pinned submodule and user-supplied JAR.                                                                                                                                                                             |
+| Apktool                        | [Apache-2.0](https://github.com/iBotPeaches/Apktool/blob/master/LICENSE.md)                                                                                                                                                                              | User-supplied Android resource decoder.                                                                                                                                                                                     |
+| Binwalk                        | [MIT](https://github.com/ReFirmLabs/binwalk/blob/4fdab3d464d97b68e0af9088df3f9e2e1545b21c/LICENSE)                                                                                                                                                       | v3.1.0; pinned submodule and user-supplied firmware engine.                                                                                                                                                                 |
+| Unblob                         | [MIT](https://github.com/onekey-sec/unblob/blob/1fcc7a0a584a70a96c31f5a276c20944d199a089/LICENSE)                                                                                                                                                        | 26.6.4; pinned submodule and user-supplied firmware engine.                                                                                                                                                                 |
+| Wakaru                         | [Apache-2.0](https://github.com/pionxzh/wakaru/blob/8219bf5016a063d7fb215101a8c45d5959ec733f/LICENSE)                                                                                                                                                    | v1.14.0; pinned source and separately obtained JavaScript reconstruction tooling.                                                                                                                                           |
+| WABT                           | [Apache-2.0](https://github.com/WebAssembly/wabt/blob/ff0ef7e0009402740c805a9744c09b05be063e48/LICENSE)                                                                                                                                                  | v1.0.42; external WebAssembly tools; [integration provenance](third_party/wabt/README.md).                                                                                                                                  |
+| pwntools                       | [MIT, with GPL/BSD component qualifications](https://github.com/Gallopsled/pwntools/blob/3ad86ec5adab1abf9781ca7552a6f5d7cff7a33c/LICENSE-pwntools.txt)                                                                                                  | 4.15.0; caller-supplied offline ELF analysis package.                                                                                                                                                                       |
+| pyelftools                     | [Public-domain dedication and component notices](https://github.com/eliben/pyelftools/blob/v0.33/LICENSE)                                                                                                                                                | 0.33; includes separately licensed bundled material, including Construct.                                                                                                                                                   |
+| Unicorn                        | [GPL-2.0 and component notices](https://github.com/unicorn-engine/unicorn/blob/2.1.2/COPYING)                                                                                                                                                            | 2.1.2; used by the caller-supplied ELF analysis profile for instruction emulation.                                                                                                                                          |
+| pwndbg                         | [MIT](third_party/pwndbg/LICENSE.md)                                                                                                                                                                                                                     | 2026.09.15, commit `55596aa676a2756efb8d67034f31675170eabe48`; separately obtained debugger extension.                                                                                                                      |
+| GNU GDB                        | [GPL-3.0-or-later](https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gdb/COPYING)                                                                                                                                                                  | Caller-supplied debugger for the optional pwndbg core-file workflow.                                                                                                                                                        |
+| LLDB / LLVM                    | [Apache-2.0 with LLVM exceptions](https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT)                                                                                                                                                            | Caller-supplied debugger; the installed distribution's component and historical notices also apply.                                                                                                                         |
+| mitmproxy                      | [MIT](https://github.com/mitmproxy/mitmproxy/blob/6c09d56e4c29a92f5ad01b03199977584b8ea14f/LICENSE)                                                                                                                                                      | 12.2.3; separately supplied network capture proxy.                                                                                                                                                                          |
+| Android Debug Bridge (adb)     | [Apache-2.0](https://android.googlesource.com/platform/packages/modules/adb/+/refs/heads/main/NOTICE)                                                                                                                                                    | User-supplied Android device tool. A complete Android SDK download has its own [SDK license terms](https://developer.android.com/studio/terms); adb's source license does not replace them.                                 |
+| ILSpy / ICSharpCode.Decompiler | [MIT](https://github.com/icsharpcode/ILSpy/blob/master/ICSharpCode.Decompiler/Properties/AssemblyInfo.cs)                                                                                                                                                | Optional separately installed .NET decompiler; not a redistributed ReversePort dependency.                                                                                                                                  |
+
+Ghidra's original notice credits software developed at the National Security
+Agency. It explains that US-government-created portions are not subject to US
+copyright protection, while other portions retain their authors' rights. Its
+modules include additional third-party licenses, and standalone programs under
+`GPL/` have GPLv3 terms. The three retained top-level documents do not replace
+the module notices and license directories in a complete Ghidra distribution.
+ReversePort is not affiliated with or endorsed by the NSA.
+
+## Commercial tools and bridges
+
+**You must legally obtain the tools and the rights needed for your use.** ReversePort
+does not include an IDA Pro, Hex-Rays decompiler, Hopper, or JEB license, license
+key, or activation entitlement. A permitted trial/demo may be used only within
+its official terms. Cracked copies, stolen keys, unauthorized sharing, and
+bypassing activation or license limits are not authorized by ReversePort.
+
+| Project / product                | Applicable terms and distinction                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| IDA Pro and Hex-Rays decompilers | Proprietary Hex-Rays software governed by the [EULA](https://hex-rays.com/eula), purchase agreement, and applicable license scheme. Obtain rights for the required product, user, machine, decompiler, and automation interfaces. Availability of an API or a bridge does not grant hosting, service, or additional-user rights.                                                                                                                           |
+| ida-pro-mcp                      | The bridge's [MIT license](https://github.com/mrexodia/ida-pro-mcp/blob/main/LICENSE) belongs to Duncan Ogilvie. It licenses the bridge code, not IDA or Hex-Rays products. Its [README](https://github.com/mrexodia/ida-pro-mcp#prerequisites) requires IDA Pro and explicitly states that IDA Free is unsupported. Follow the prerequisites for the version you actually install. The bridge is separately supplied, not bundled by ReversePort.         |
+| Hopper Disassembler              | Proprietary Cryptic Apps software under its [license agreement](https://www.hopperapp.com/license_agreement.html). Personal and computer licenses have different permitted-user and installation rules; an official evaluation trial is available. ReversePort setup may obtain the official installer after approval, but this grants no paid license or activation entitlement.                                                                          |
+| JEB                              | Proprietary PNF Software product under its [EULA](https://www.pnfsoftware.com/jeb/LICENSE.TXT) and edition-specific agreement. Check user/seat/server rights and whether your edition permits automation, backend/service integration, and disclosure of generated output. The published EULA restricts public or third-party disclosure of decompiled code, reconstructed artifacts, and analysis reports unless expressly permitted by the license type. |
+
+The vendor's applicable agreement controls. These summaries do not interpret
+your individual contract or expand the rights it grants. Verify permissions
+before publishing analysis output, sharing tool access, or operating a service.
+Vendor terms above were checked on 2026-10-12.
+
+## Runtimes, development tooling, and fixtures
+
+ReversePort uses a caller-supplied Node.js runtime ([MIT and component notices](https://github.com/nodejs/node/blob/main/LICENSE)).
+Optional workflows may also use Python ([PSF and component licenses](https://docs.python.org/3/license.html)),
+OpenJDK ([GPLv2 with Classpath Exception and component notices](https://openjdk.org/legal/)),
+Electron ([MIT and component notices](https://github.com/electron/electron/blob/main/LICENSE)),
+or a Chromium-based browser ([BSD-3-Clause and third-party licenses](https://chromium.googlesource.com/chromium/src/+/main/LICENSE)).
+These external installations are not licensed or bundled by ReversePort's MIT license.
+
+Development, test, and website npm packages are included in the locked inventory.
+GitHub Actions, operating-system utilities, downloaded verification fixtures,
+and their runtimes retain the terms supplied by their publishers. Fixture
+identities and provenance are recorded under `scripts/fixtures/` and the
+existing `third_party/` records; downloaded executable fixtures are not tracked
+or included in the npm package. This notice does not claim to inventory every
+dependency of a caller's operating system, agent, or separately installed tool.
+
+## Maintaining and redistributing notices
+
+Refresh the dependency inventory and runtime notice collection when the lockfile
+changes. Review the actual versions and distributed contents, retain the
+upstream license and copyright texts, and account for optional platform
+packages. See [licenses/README.md](licenses/README.md) for source provenance,
+collection scope, and known upstream notice gaps.
+
+The npm package includes this document, the `licenses/` directory, and the
+existing redistributed license records under `third_party/`. If you additionally
+bundle an external engine or modify upstream code, review that actual
+distribution and retain its full applicable licenses, copyright notices,
+NOTICE files, modification notices, and source obligations. ReversePort's inventory is
+not a substitute for those obligations.