BLA CLI
A defensive layer for shipped builds against AI reverse-engineering agents: decoys, analyzer overload and unchanged runtime behavior
- 5,407 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The tool rewrites the files of a shipped build in place, so without a copy you cannot restore the original artifacts
- Inflated and tangled artifacts also hinder independent security researchers, and malware authors could use the same moves
- Registering with an agent gives it an MCP tool that changes project files
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/blaDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The tool rewrites the files of a shipped build in place, so without a copy you cannot restore the original artifacts
- Inflated and tangled artifacts also hinder independent security researchers, and malware authors could use the same moves
- Registering with an agent gives it an MCP tool that changes project files
This is third-party code. Review the repository files before installing.
What it does
BLA (Blind LLM Agents) processes a shipped build so that an AI reverse-engineering agent burns resources on it and follows decoys, while users get the same runtime behavior. The author calls this Counter-REA, against the REA analyzer. It works in three moves. Poison: plants plausible canaries, honey metadata and decoy control flow. Exhaust: inflates structure up to the analyzer's documented limits. Hallucinate: leaves the analyzer with truncated inventories and ambiguous dead ends. One command, `npx bla-agents harden .`, discovers `dist/` and `build/` folders, `.asar`, `.wasm` and `.sqlite` files and models, then runs a pipeline of `audit`, `protect` and `verify`. The stages are also available separately, and `defend` chains them when you already know the path. `npx bla-agents setup` registers an MCP server and a skill with your agent, after which you can simply tell it "Harden my software against REA". The MCP side has a `bla_harden` tool. Coverage is broad: JavaScript and TypeScript, Electron ASAR and fuses, WASM, SQLite, Safetensors and GGUF, Go buildinfo, Flutter, Erlang BEAM, EVM, PCAP and more. The author ran the real REA on hardened samples and gives a table where the analyzer hits its own limits, while stating plainly that no such check exists for Ghidra, Frida, LLDB or JADX.
Who it is for. For developers who publish their own software (Electron apps, JS bundles, WASM, models) and want to make automated analysis by AI agents harder.
Good fit when
- You built an Electron release and want to make it harder for an AI agent to analyze before shipping
- You want to know how exposed a build is to automated analysis: `npx bla-agents audit` gives an assessment
- The protection must not change behavior: `verify` checks the program works as before processing
- You want a showcase run on 14 targets: `npx bla-agents benchmark`
- An agent should protect a project from a short phrase through the `bla_harden` MCP tool
Not a fit when
- You need protection against a human reverser with Ghidra, Frida or IDA: the author does not claim to defend against them
- You need Android APK signing and repackaging: resigning an APK after processing is unsupported
- You want independent security researchers to review your build freely
Example request
Harden the build in the dist folder against AI agent analysis with BLA, then run verify and show that behavior did not changeLimitations
- Needs Node.js ^22.23.4 or 24.x. Wabt and tshark are advisable for the full set of checks; without them some checks are skipped.
- Verified empirically against the real REA: JavaScript, ASAR, fuses, WASM, SQLite, Safetensors, GGUF, Go, Erlang, EVM and PCAP. Firmware, SPIR-V, CUDA and AMD GPU objects are skipped, and Ghidra decompilation, live Frida, LLDB and Rizin sessions, and JADX were not tested.
- Token and dollar figures in `benchmark` are internal estimates from a catalog of limits and must not be passed off as measurements. The author notes that `npm run verify:rea` checks constants only.
- File size grows: a 54-byte WASM became 6.56 MiB and a 607-byte ASAR became 16.9 MiB in the author's samples. Keep a copy of the build before processing.
How to disable. Remove the MCP and skill registration that `npx bla-agents setup` added to your agent's configuration. Processed builds do not roll back on their own: restore them from the copy made before `harden`.
FAQ
How do I install BLA in Claude Code?
Run `npx bla-agents setup`: it registers an MCP server and a skill with your agent. Then ask "Harden my software against REA". For a one-off run without registering, `npx bla-agents harden .` in the project folder is enough.
What is REA?
The author's name for an AI agent that reverse-engineers shipped artifacts. BLA is measured against it: processed samples hit the analyzer's documented limits and get capacity or budget errors.
Does BLA change what the program does?
The author states that runtime behavior stays equivalent, and checks it with the `verify` stage and a runtime-equivalence measurement in `benchmark`. For safety keep a copy of the build and run your own tests.
Which formats are supported?
JavaScript and TypeScript, Electron ASAR and fuses, WASM, Python and `.pyc`, SQLite, Safetensors, GGUF, Go buildinfo, Flutter, Erlang BEAM, EVM, PCAP, PTX and more. DEX, IL2CPP, .NET and JVM have protection but it was not tested against the real REA.
Does this protect against Ghidra or Frida?
There is no such claim. The author states plainly that nothing is asserted about those tools because no check was run against them, and lists them as unverified.
Discussion
No questions or reviews yet.
Related
CLI toolsMCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Rebuilds C and C++ functions from compiled programs through Ghidra: one model writes the code and another checks it.
Agentic Radar analyzes multi-agent code on LangGraph, CrewAI, n8n, OpenAI Agents and AutoGen and builds an HTML report on tools and vulnerabilities
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| BLA (this card) | no | 5,407 | ||
| reverse-skill | no | 44,569 | helps an agent take apart other people's binaries, while BLA protects your own builds from such analysis | |
| IDA Pro MCP | no | not required | 13,459 | lets an agent work with IDA for reversing, while BLA stands on the other side and hinders such agents |
README in short
The README presents BLA as a defensive tool for your own software. It explains the three moves, the quick start, a table of results against the real REA on commodity hardware, a format matrix, a showcase run on 14 targets and an FAQ. Caveats about what was not verified sit in separate tables, and the disclaimer is in `DISCLAIMER.md`.