About Fathom
Fathom is a provider-neutral Rust MCP server for reverse engineering native binaries, applications, assemblies, captures, bytecode, and process behavior. Its findings distinguish observations, inferences, and limits on what was examined or established.
Key features
- 01Native binary analysis
- 02JavaScript and Electron analysis
- 03.NET assembly metadata inspection
- 04Process capture and HAR reading
- 05EVM selector inspection
- 06Evidence envelopes for findings
Use cases
- 01Analyze a native binary
- 02Inspect JavaScript or Electron applications
- 03Examine .NET assemblies
- 04Review process captures or web HAR files
MCP support
Fathom exposes reverse-engineering capabilities through MCP stdio and streamable HTTP transports. Findings include evidence envelopes describing observations, derived results, unexamined areas, and provider limits.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
We haven’t collected a package or remote endpoint for this server. Follow the instructions in the project README.
Tools
Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.
Details
From the project READMEfathom
Rust port of REA (Reverse Engineer Anything): one provider-neutral MCP server for reverse engineering — native binaries, JavaScript/Electron applications, .NET assemblies, web captures, EVM bytecode, and process behavior — where every result is an evidence envelope that states what was observed, what was derived, what was not examined, and what the provider cannot establish.
The design is specified in SPEC.md: capability inventory mapped from upstream's public contracts, per-capability Rust strategy, evidence and error models, a deterministic fail-closed policy engine, and the staging plan. Design source: morluto/rea (MIT), credited in NOTICE; no upstream code is used.
Why a Rust port
Upstream REA is TypeScript/Node distributed through npm. This port exists to keep the capability on a Rust-first, pinned, auditable supply chain — the estate's standing direction (SPEC §1).
Shape
fathom-core— config, error contracts, evidence model, policy, tool registry, confinement, bounded processes.fathom-mcp— MCP stdio + streamable HTTP transports.fathom-a2a— signed A2A agent card (JCS + Ed25519).fathom-native— Ghidra headless provider + binary layout (goblin).fathom-js— JavaScript/Electron static analysis (oxc) + ASAR.fathom-managed— .NET PE/CLI metadata (manual ECMA-335).fathom-observe— process capture, HAR reading, EVM selectors.fathom-cli— thefathombinary (serve,card,doctor, one-shot analysis).
Build
nix build # or: nix develop, then cargo build --workspace
cargo test --workspace
License
This project is licensed under the Apache License, Version 2.0.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.