# Fathom

A provider-neutral Rust MCP server for reverse engineering native binaries, Electron apps, .NET assemblies, EVM bytecode and process behaviour. Every result carries an evidence envelope.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed
- Author: qompassai
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/qompassai/fathom
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/qompassai-fathom

## What it does

Fathom is a Rust port of REA (Reverse Engineer Anything). One MCP server covers several targets at once: native binaries, JavaScript and Electron, .NET assemblies, web captures, EVM bytecode, process behaviour. What sets it apart is the shape of the answer. Each result arrives as an evidence envelope that separates what was observed from what was derived, names what was never examined, and states what the provider cannot establish. An agent reading that will not mistake a guess for a finding.

The workspace splits into crates. `fathom-core` holds config, the evidence model, policy, the tool registry, confinement and bounded processes. `fathom-mcp` provides stdio and streamable HTTP transports, while `fathom-a2a` issues a signed agent card using JCS and Ed25519. Providers map to targets: `fathom-native` drives Ghidra headless, `fathom-js` does static analysis of JavaScript and Electron, `fathom-managed` reads .NET PE/CLI metadata, and `fathom-observe` handles process capture, HAR reading and EVM selectors. Build with `nix build`, or `nix develop` followed by `cargo build --workspace`; tests run through `cargo test --workspace`.

The policy engine is deterministic and fail-closed, so tool calls behave only as far as your policy allows. Ghidra is a hard requirement for the native provider — `fathom-native` shells out to it headless, and without Ghidra installed that path simply does not run.

## Requirements
- Needs: a prebuilt binary from the repository releases

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- pull structure out of a native binary without disassembling it by hand
- see what sits inside an Electron app and its ASAR archive
- read metadata from a .NET assembly
- parse a HAR file into a list of endpoints
- capture process behaviour and keep observations apart from inferences

## Example prompts
- Analyse this binary with Fathom and show me what was observed versus derived
- Go through the Electron app in this folder and list what was left unexamined
- Read this HAR file and give me the endpoints with the evidence behind each one

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md