Fathom — Claude Code MCP server: reverse engineering with evidence
A provider-neutral Rust MCP server for reverse engineering native binaries, Electron apps, .NET assemblies, EVM bytecode and process behaviour. Every result carries an evidence envelope.
Open on GitHubWhat Fathom does
Fathom is a Rust port of REA (Reverse Engineer Anything). One MCP server covers several targets at once: native binaries, JavaScript and Electron, .NET assemblies, web captures, EVM bytecode, process behaviour. What sets it apart is the shape of the answer. Each result arrives as an evidence envelope that separates what was observed from what was derived, names what was never examined, and states what the provider cannot establish. An agent reading that will not mistake a guess for a finding.
The workspace splits into crates. fathom-core holds config, the evidence model, policy, the tool registry, confinement and bounded processes. fathom-mcp provides stdio and streamable HTTP transports, while fathom-a2a issues a signed agent card using JCS and Ed25519. Providers map to targets: fathom-native drives Ghidra headless, fathom-js does static analysis of JavaScript and Electron, fathom-managed reads .NET PE/CLI metadata, and fathom-observe handles process capture, HAR reading and EVM selectors. Build with nix build, or nix develop followed by cargo build --workspace; tests run through cargo test --workspace.
The policy engine is deterministic and fail-closed, so tool calls behave only as far as your policy allows. Ghidra is a hard requirement for the native provider — fathom-native shells out to it headless, and without Ghidra installed that path simply does not run.
What it helps with
- pull structure out of a native binary without disassembling it by hand
- see what sits inside an Electron app and its ASAR archive
- read metadata from a .NET assembly
- parse a HAR file into a list of endpoints
- capture process behaviour and keep observations apart from inferences
Example prompts for the agent
- Analyse this binary with Fathom and show me what was observed versus derived
- Go through the Electron app in this folder and list what was left unexamined
- Read this HAR file and give me the endpoints with the evidence behind each one
How to install Fathom
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Fathom
How do I install Fathom in Claude Code?
There is no install command for Claude. Build the server from source: nix build, or nix develop and then cargo build --workspace. Then run the fathom binary with the serve subcommand and register it as an MCP server.
What does Fathom do?
It is an MCP server for reverse engineering: native binaries, JavaScript and Electron, .NET assemblies, web captures, EVM bytecode, process behaviour. Results come back with a note on what was observed, what was derived and what was not examined.
How is Fathom different from REA?
Fathom is a Rust port of REA. The original is TypeScript and ships through npm, while this one keeps a Rust build with pinned dependencies. No upstream code is used, and the design lives in SPEC.md.
