English Français العربية

Fathom

Official registry AI and agents

Reverse-engineering tools for agents over MCP/A2A, with evidence-carrying findings.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

MCPB package https://github.com/qompassai/fathom/releases/download/v0.1.1/fathom-mcp-0.1.1-linux-x64.mcpb

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. fathom
  2. Why a Rust port
  3. Shape
  4. Build
  5. License

fathom

Rust port of REA (Reverse Engineer Anything): one provider-neutral MCP server for reverse engineering — native binaries, JavaScript/Electron applications, .NET assemblies, web captures, EVM bytecode, and process behavior — where every result is an evidence envelope that states what was observed, what was derived, what was not examined, and what the provider cannot establish.

The design is specified in SPEC.md: capability inventory mapped from upstream's public contracts, per-capability Rust strategy, evidence and error models, a deterministic fail-closed policy engine, and the staging plan. Design source: morluto/rea (MIT), credited in NOTICE; no upstream code is used.

Why a Rust port

Upstream REA is TypeScript/Node distributed through npm. This port exists to keep the capability on a Rust-first, pinned, auditable supply chain — the estate's standing direction (SPEC §1).

Shape

  • fathom-core — config, error contracts, evidence model, policy, tool registry, confinement, bounded processes.
  • fathom-mcp — MCP stdio + streamable HTTP transports.
  • fathom-a2a — signed A2A agent card (JCS + Ed25519).
  • fathom-native — Ghidra headless provider + binary layout (goblin).
  • fathom-js — JavaScript/Electron static analysis (oxc) + ASAR.
  • fathom-managed — .NET PE/CLI metadata (manual ECMA-335).
  • fathom-observe — process capture, HAR reading, EVM selectors.
  • fathom-cli — the fathom binary (serve, card, doctor, one-shot analysis).

Build

nix build          # or: nix develop, then cargo build --workspace
cargo test --workspace

License

This project is licensed under the Apache License, Version 2.0.

Frequently asked questions

What is Fathom?

Reverse-engineering tools for agents over MCP/A2A, with evidence-carrying findings.

How do I install Fathom?

Follow the installation steps in its documentation, shown on this page and in its repository.

Does Fathom need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Fathom open source?

Yes. Its code is on GitHub under the Apache-2.0 license.

Who maintains Fathom?

It is published by qompassai. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.