MCP · DYNAMIC ANALYSIS · EVIDENCE

🔍 tracea — trace anything running

The dynamic half of reverse engineering, built for AI coding agents. Hook APIs, trace syscalls, inspect memory, reconstruct network traffic — every finding returned as a structured Evidence Record, never a raw dump.

🏠 GitHub 📊 TraceBench dataset 🤖 tracea-explainer

Why it matters

Static MCPs tell your agent what software looks like. tracea shows your agent what software does — live, hooked, captured — with proof for every claim.

🧪 Runtime, not guessesAPI hooks, syscall summaries, memory inspection, HTTP/TLS/DNS reconstruction

🧾 Evidence over assertionobservation + artifacts + confidence + explicit limitations on every record

📉 Token-efficientdeduplicated summaries + artifact refs — never a 10 MB strace in context

🔌 Where you workClaude Code, Codex, Cursor, Gemini CLI via MCP, or standalone CLI

Install (shipping with v0.1): uvx tracea setup

🧾 Evidence Viewer — works right now

Paste a JSONL of Evidence Record v1 lines (from tracea evidence-export --jsonl). This is exactly the structured view your agent receives.

🗺️ Roadmap — v1.0 lands November 2026

v0.1	Network evidence engine — pcap → HTTP/TLS/DNS evidence records	Oct 20
v0.3	Native process tools + uvx tracea setup wizard	Oct 27
v0.5	Android tools (Frida) + in-browser Pcap Explorer	Nov 3
v1.0	Full launch + tracea-explainer auto-explain + TraceBench 1k	Nov 10–12

⚖️ Ethics

tracea is for authorized analysis only — your apps, your devices, your captures, your labs. No DRM circumvention, no piracy tooling, no malware development. Evidence exports redact high-entropy secrets by default.