mirror of
https://github.com/alexmi256/rea-agent-docker.git
synced 2026-11-07 09:45:59 -10:00
Hermes Agent
ffaff66505
Upstream: https://github.com/morluto/rea/releases/tag/rea-agents-6.8.0 Check: make check-updates -> 0 actionable / 6 pending / 0 unknown Harness: scripts/verify-all-engines.sh 121/0/3 · 109/0/8 · 102/0/7 · 94/0/11 REA 6.8.0 changes two things this image has to follow: - engines.node is now ^22.23.4 || ^24.22.1 || >=26.12.1, so the 24.22.0 runtime that 6.7.0 accepted is *refused*. NODE_VERSION moves to 24.22.1 in the same commit, in the Dockerfile and in the compose default. - the bundled skill is v49 with 229 MCP tools (was v42 / 207), read from the shipped dist/mcp-catalog.json rather than the release notes. No engine admission moved: GhidraReleasePolicy.ts is byte-identical (12.1.4, Java 21) and Hopper is still the vendor feed's 6.6.0 demo, so the engine pins are untouched and the harness re-proved both providers. Two checks had to change shape, and both got stricter: - binwalk/unblob left CapabilityInventory's remediation prose for structured defineToolRequirement() entries in src/contracts/firmware/firmwareToolRequirements.ts. scrape_rea now reads those first and falls back to the prose, so both rows keep showing the admitted value instead of printing `ok` with nothing verified. - extract-artifact lost its second positional (REA picks the destination and reports output_root). The harness now asserts containment_verified, coverage complete, cleanup verified, non-empty created artifacts, and that the reported files exist under the reported root - one check more per image than the exit-status check it replaces. Docs regenerated for this run: docs/verify-engines.txt, docs/verify-summary.txt, the size table (make sizes), and the skill/tool counts in README, HERMES-MCP, IMAGES, ARCHITECTURE and UPDATES.
86 lines
3.6 KiB
YAML
86 lines
3.6 KiB
YAML
# =============================================================================
|
|
# Optional overlay: publish REA's MCP surface over Streamable HTTP.
|
|
#
|
|
# docker compose -f docker-compose.yml -f compose.http.yml up -d
|
|
#
|
|
# Useful when the MCP client does not run `docker exec` itself (other
|
|
# containers, remote agents, a browser-based client, mcp-inspector, ...).
|
|
# The endpoint is http://<bind>:<port>/mcp with the default Docker publish
|
|
# below reachable on the Docker host.
|
|
#
|
|
# Note: with Docker-in-Docker Hermes setups, 127.0.0.1 inside the Hermes
|
|
# container is NOT the Docker host - use the stdio path (docker exec) or
|
|
# point the client at the host gateway address instead.
|
|
# =============================================================================
|
|
name: rea-agent
|
|
|
|
services:
|
|
rea-mcp-http:
|
|
# Works with whichever engine image you are running: set REA_IMAGE +
|
|
# REA_ENGINE in .env to match (see docs/IMAGES.md), e.g.
|
|
# REA_IMAGE=rea-agent-hopper:6.8.0-linux-amd64 REA_ENGINE=hopper
|
|
# `make http-up-ghidra` / `-hopper` / `-ida` do this for you.
|
|
image: ${REA_IMAGE:-ghcr.io/alexmi256/rea-agent:6.8.0-linux-amd64}
|
|
container_name: ${REA_MCP_HTTP_CONTAINER_NAME:-rea-mcp-http}
|
|
platform: linux/amd64
|
|
init: true
|
|
restart: unless-stopped
|
|
user: "${REA_UID:-1000}:${REA_GID:-1000}"
|
|
working_dir: /work
|
|
shm_size: ${REA_SHM_SIZE:-1gb}
|
|
ports:
|
|
- "${REA_MCP_HTTP_BIND:-127.0.0.1}:${REA_MCP_HTTP_PORT:-8811}:8811"
|
|
environment:
|
|
# The image's own /usr/local/share/rea/engine.env supplies the engine paths, so this
|
|
# sidecar carries any engine. Override REA_ENGINE_* here only if you run
|
|
# an engine path that differs from the image default.
|
|
REA_ENGINE: ${REA_ENGINE:-all}
|
|
GHIDRA_INSTALL_DIR: ${GHIDRA_INSTALL_DIR:-/opt/ghidra}
|
|
JAVA_HOME: ${JAVA_HOME:-/usr/lib/jvm/java-21-openjdk-amd64}
|
|
HOPPER_LAUNCHER_PATH: ${HOPPER_LAUNCHER_PATH:-/opt/hopper/bin/Hopper}
|
|
HOPPER_STATE_DIR: ${HOPPER_STATE_DIR:-/home/rea/.local/share/hopper}
|
|
REA_GHIDRA_STARTUP_TIMEOUT_MS: ${REA_GHIDRA_STARTUP_TIMEOUT_MS:-900000}
|
|
REA_HOPPER_STARTUP_TIMEOUT_MS: ${REA_HOPPER_STARTUP_TIMEOUT_MS:-300000}
|
|
GHIDRA_HEADLESS_MAXMEM: ${GHIDRA_HEADLESS_MAXMEM:-4G}
|
|
REA_MCP_INPUT_SCHEMA_PROFILE: ${REA_MCP_INPUT_SCHEMA_PROFILE:-compact}
|
|
IDADIR: ${IDADIR:-/opt/ida}
|
|
REA_IDA_MCP_LOCAL_PORT: ${REA_IDA_MCP_LOCAL_PORT:-8745}
|
|
REA_BROWSER_NO_SANDBOX: ${REA_BROWSER_NO_SANDBOX:-1}
|
|
REA_ENTRYPOINT_DOCTOR: "0"
|
|
TMPDIR: /tmp/rea
|
|
# Optional REA_* settings (REA_ANALYSIS_PROVIDER, IDA/JEB registrations,
|
|
# REA_MCP_MAX_RESPONSE_BYTES, ...) come from ./config/rea.env. REA rejects
|
|
# empty values, so they must not be defined here with empty defaults.
|
|
env_file:
|
|
- path: ./config/rea.env
|
|
required: false
|
|
volumes:
|
|
- ./work:/work
|
|
- ${REA_TARGETS_DIR:-./targets}:/targets:ro
|
|
- ./config:/etc/rea:ro
|
|
- rea-home-http:/home/rea
|
|
- ${IDA_INSTALL_DIR:-./vendor/ida}:/opt/ida:ro
|
|
- ${HOPPER_STATE_VOLUME:-./vendor/hopper-state}:/home/rea/.local/share/hopper
|
|
# supergateway bridges stdio (REA's only transport) to Streamable HTTP.
|
|
command:
|
|
- supergateway
|
|
- --stdio
|
|
- rea mcp
|
|
- --outputTransport
|
|
- streamableHttp
|
|
- --port
|
|
- "8811"
|
|
- --host
|
|
- 0.0.0.0
|
|
- --stateful
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -fsS -o /dev/null http://127.0.0.1:8811/mcp || exit 1"]
|
|
interval: 60s
|
|
timeout: 20s
|
|
start_period: 90s
|
|
retries: 3
|
|
|
|
volumes:
|
|
rea-home-http:
|
|
name: ${REA_HOME_VOLUME:-rea-agent-home}-http
|