pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for REA

Pod holds 24 of 56 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to REA.

Most discussed

Use MCP elicitation for scoped process-capture session grants

Problem

Dynamic and filesystem-backed REA capabilities currently require policy to be configured through startup environment variables. This is a strong ceiling, but first use is cumbersome: users must edit MCP configuration and restart the client even when they want a narrow grant for the current workspace and session.

The problem is broader than process capture. The same ceremony affects evidence import/export, investigation inputs/workspaces, persistent snapshots, native DMG mounting, co

Read the thread · 2026-07-13 · open · 9 comments

Make trace_feature operation-budget limits discoverable and errors actionable

Problem

trace_feature rejects max_operations values above 100, but the effective ceiling is not visible on at least one real MCP host tool surface, and the validation failure does not provide a structured repair path.

Observed with REA 1.7.0 through Codex MCP:

rea.trace_feature({
  "query": "Finding useful first work",
  "case_sensitive": true,
  "limit": 50,
  "max_operations": 300
})
Input validation error: Invalid arguments for tool trace_feature:
max_operations: Too big: ex

[Read the thread](https://github.com/morluto/rea/issues/261) · 2026-07-16 · closed · 4 comments

### Make MCP tool discovery capability- and policy-aware

## Summary

Make REA's MCP discovery and workflow guidance reflect negotiated client features, installed providers, active target state, operator/session policy, and operation-specific limits.

Accurate static annotations have shipped. The remaining work is dynamic availability, truthful routing, and schema-visible constraints.

## Current problem

Agents still often discover only after invocation that:

- a provider or target does not support the operation;
- no target is open;
- process/eviden

[Read the thread](https://github.com/morluto/rea/issues/101) · 2026-07-13 · closed · 4 comments

### Complete Hopper function dossiers with real references and CFG edges

## Problem

`analyze_function` is honest but incomplete: callers/callees and references are weakly typed, comments are entry-only, strings/names are unavailable, and CFG successors are not populated.

## Outcome

Return a complete bounded dossier using Hopper's public APIs without guessing unavailable reference kinds.

## Scope

- Independent pseudocode, assembly, and collection offsets.
- Typed procedure identity, signature, and parsed locals.
- Typed caller/callee identities.
- Procedure-wide 

[Read the thread](https://github.com/morluto/rea/issues/54) · 2026-07-12 · open · 4 comments

### Support MCP Tasks for long-running analysis operations

## Summary

Add a provider-neutral asynchronous job model and expose eligible long-running REA operations through capability-negotiated MCP Tasks. Preserve synchronous tool calls for clients that do not support Tasks.

MCP Tasks are experimental. REA's core execution model must not depend directly on unstable SDK APIs; the MCP Tasks adapter should sit over an internal operation abstraction with explicit ownership, status, cancellation, retention, and result identity.

## Current state in REA 1.3

[Read the thread](https://github.com/morluto/rea/issues/97) · 2026-07-13 · closed · 3 comments

### Doctor should detect broken and ambiguous Node runtime installations

## Problem

`rea doctor` can report the active Node runtime as healthy while another
installed Node/npm toolchain that an agent or REA-adjacent workflow can resolve
is dynamically broken. The resulting failure looks like an analysis/build
failure even though it is host-runtime drift.

Observed while running a local reconstruction verifier:

```text
dyld: Library not loaded: /opt/homebrew/opt/simdjson/lib/libsimdjson.29.dylib
  Referenced from: /opt/homebrew/Cellar/node/25.2.1/bin/node
  Reason: 

[Read the thread](https://github.com/morluto/rea/issues/262) · 2026-07-16 · closed · 2 comments

### Build a Playwright/CDP differential recorder

## Problem

Static bundle inspection cannot establish the complete interactive state machine of a browser or hosted renderer.

## Outcome

Add an approval-gated `capture_browser_scenario` provider using Playwright and CDP.

## Contract

Scenarios declare browser/connect mode, start URL, permitted origins, viewport/locale/timezone/theme, deterministic actions, timeouts, storage seeds, request replay, secret declarations, redaction, and capture limits.

Step-indexed output includes screenshots, DO

[Read the thread](https://github.com/morluto/rea/issues/63) · 2026-07-12 · closed · 2 comments

### Add protocol and distributed-client investigation workflows

## Goal

Reverse engineer how desktop, mobile, browser, and CLI clients communicate with services while preserving a reproducible evidence trail.

## Scope

- HTTP and REST
- WebSocket and Server-Sent Events
- GraphQL
- JSON-RPC and MessagePack
- gRPC and Protocol Buffers
- custom TCP and UDP framing
- local IPC, Unix sockets, named pipes, and XPC
- authentication flows and token lifecycle metadata with secret redaction

## Capabilities

- capture_protocol_session
- infer_message_schema
- correl

[Read the thread](https://github.com/morluto/rea/issues/40) · 2026-07-12 · closed · 2 comments

## Most recent

### Publish REA as a discoverable MCP server in the MCP Registry

## Current limitation

REA exposes an MCP server through its npm distribution, but the repository does not currently publish MCP Registry metadata or an automated registry release path. Users therefore cannot discover the server through the official MCP Registry and may need to configure it manually.

## Desired outcome

Publish REA under the registry name `io.github.morluto/rea`, with:

- an `mcpName` ownership marker in the npm package;
- a checked-in `server.json` describing the npm package, 

[Read the thread](https://github.com/morluto/rea/issues/460) · 2026-08-01 · closed · 1 comment

### [Bug] MCP cold start exhausts Codex startup deadline

## Bug Description

REA's MCP process can exhaust the 30-second Codex startup deadline that `rea setup` configures. On a cold launch, importing the production entrypoint consumed about 20 seconds before the server could answer MCP `initialize`; modest client startup contention is therefore enough for Codex to report:

```text
MCP client for `rea` timed out after 30 seconds.
MCP startup incomplete (failed: rea)

This is also a package-validation gap. The current runtime and package smoke test

Read the thread · 2026-07-26 · closed · 0 comments

[Bug] Bare npx setup can again select a stale local REA release

Bug Description

REA's recommended setup command, npx rea-agents setup, can select an older project-local rea-agents dependency instead of the current npm release. The stale bootstrap then plans setup and version-pinned MCP registration using its own older product identity.

This behavior was previously reported in #291 and fixed by #292, which made rea-agents@latest canonical. PR #307 later restored the bare npx rea-agents setup entrypoint and the current main README recommends tha

Read the thread · 2026-07-26 · closed · 0 comments

Add end-to-end agent reconstruction readiness conformance

Problem

REA has individual capabilities for artifact classification, provider analysis, Evidence v2, process/browser/Electron capture, differential comparison, residual unknowns, and reconstruction verification. Individual feature tests do not prove that an agent can traverse the complete workflow without discovering hidden limits, incompatible providers, stale servers, missing authority, broken host runtimes, or false equivalence only after invocation.

Several previously separate failures

Read the thread · 2026-07-22 · closed · 0 comments

Agent integration capability selection is unclear and can silently drop the bundled skill

Problem

The "Agent integration (MCP + guided workflow)" capability bundles MCP client configuration and the REA reverse-engineering skill. However, the UI flow for selecting which agents to configure is unclear, and selecting the capability without selecting any agents can silently omit the skill installation.

Observed behavior

  1. The capability label says "MCP + guided workflow" but the second prompt "Which agents should use REA?" appears only after the capability is select

Read the thread · 2026-07-21 · closed · 0 comments

setup wizard defaults to cancellation at every step despite explicit setup intent

Problem

Running npx rea-agents setup is an explicit statement that the user wants to set REA up. The current interactive wizard, however, starts every choice from a "do nothing" state and the final confirmation defaults to "No, cancel", which contradicts the intent of running the command.

Observed behavior

  1. The "What should REA set up?" capability picker starts with nothing selected (src/cliSetup.ts, selectCapabilities, lines 195-213). The installation docs explicitly do

Read the thread · 2026-07-21 · closed · 0 comments

Add Node/Electron V8 inspector runtime observation provider

Add a focused Node/Electron runtime observation provider using the V8 inspector protocol (Node --inspect, Electron --remote-debugging-port with the Inspector domain, or an equivalent loopback transport).

Scope:

  • Launch or attach to an approved Node/Electron process with the V8 inspector enabled and an explicit administrator/policy approval.
  • Capture runtime module load/unload, require/import graph, event names, and IPC calls without evaluating arbitrary expressions or mutating the target.

Read the thread · 2026-07-20 · closed · 0 comments

Add target/policy-aware tool filtering and catalog tests

Integrate provider, target, host, and policy availability into tool discovery and add catalog tests covering client/provider/target/host matrices and list-change events.

Part of #101.

Acceptance:

  • Disabled tools have a stable machine-readable reason and remediation path.
  • Every public tool annotation is covered by a catalog-level contract test.

Read the thread · 2026-07-20 · closed · 0 comments

Implement dynamic MCP tool availability engine

Implement dynamic tool availability that recomputes based on client capabilities, installed providers, active target, host, and policy, and emits tools/list_changed when the visible catalog changes.

Part of #101.

Acceptance:

  • Tool discovery incorporates negotiated client capabilities.
  • REA advertises tools.listChanged when it may change the catalog.

Read the thread · 2026-07-20 · closed · 0 comments

Add MCP Tasks conformance adapter

Add the MCP Tasks adapter that maps the retained-operation state machine to tasks/get, tasks/result, tasks/list, and tasks/cancel.

Part of #97.

Acceptance:

  • Long-running operations expose progress and cancellation.
  • Results retain Evidence v2 identity.

Read the thread · 2026-07-20 · closed · 1 comment

Select and pin MCP Tasks extension revision and build retained-operation state machine

Select and pin an exact SEP-2663 MCP Tasks extension revision, then implement an SDK-independent retained-operation state machine with ownership, status, cancellation, retention, and result identity.

Part of #97.

Acceptance:

  • Core execution does not depend on unstable SDK APIs.
  • Synchronous tool calls are preserved for clients that do not support Tasks.

Read the thread · 2026-07-20 · closed · 1 comment

Strengthen elicited grant signing and run real MCP client tamper/expiry proof

Add stronger persisted-state signing for elicited grants and run real modern MCP client tamper/expiry proof.

Part of #96.

Acceptance:

  • Tampered or expired grants fail closed.
  • Grant rollback on returned or thrown authorization failure is preserved.

Read the thread · 2026-07-20 · closed · 0 comments

Persist MCP elicited grants with Windows handle/reparse/DACL semantics

Extend elicited process-capture grant persistence to use Windows handle/reparse/DACL authority once #289/#290 land.

Part of #96.

Acceptance:

  • Grants remain valid only within the admitted authority.
  • POSIX and Windows paths share a single policy model.

Read the thread · 2026-07-20 · open · 0 comments

Define out-of-tree provider SDK manifest and sample provider

Define the out-of-tree provider SDK manifest, compatibility/deprecation/distribution contract, and a sample external provider.

Part of #45.

Acceptance:

  • Providers cannot register undeclared operations.
  • Capability negotiation is deterministic and explainable.

Read the thread · 2026-07-20 · closed · 1 comment

Add gRPC/Protobuf and JSON-RPC/MessagePack protocol capture

Add capture and schema inference for gRPC/Protocol Buffers and JSON-RPC/MessagePack protocols.

Part of #40.

Acceptance:

  • Raw observations, decoded fields, inferred schemas, and hypotheses are separated.
  • Credentials are never persisted by default.

Read the thread · 2026-07-20 · closed · 0 comments

Add inspect_artifact provider-neutral inspection tool

Add inspect_artifact that returns observations, derived relationships, hypotheses, contradictions, unexplored branches, limitations, and next probes for one artifact.

Part of #18.

Acceptance:

  • Substeps and evidence IDs are inspectable.
  • Substep errors cannot become success.
  • Fan-out is bounded and cancellable.

Read the thread · 2026-07-20 · closed · 0 comments

The remaining reports are on the project's issue tracker.