Operation

Development status: RHEXA is not yet published as a package. It is installed from source. The command and the MCP server are called rhexa.

Updating

cd rhexa
git pull
npm ci
npm run build:cached
rhexa engine install   # newer engine version, if published

Restart your agent after an update so that it loads the new MCP server.

Resources

Memory: every analysis session starts its own engine JVM. In the benchmarks the peak was about 1.4 GB per session.
Time: the first analysis of a program includes engine start-up and auto-analysis; small programs finish in seconds, large ones take minutes.
Temporary files: analysis projects live in private directories under TMPDIR and are deleted when the session ends. Persistent projects are planned for roadmap phase 3.

Saving tokens

With RHEXA_MCP_RESULT_TEXT_PROFILE=compact in the env entry of the MCP registration, RHEXA delivers results to the agent more compactly: without the duplicate copy of the result and without the analysis profile repeated in every response. Every omission is named in text_delivery; the session keeps the complete evidence, and get_evidence_bundle returns it unchanged. In the task benchmark this cut token use by 15.7%. rhexa setup adds the setting for Claude Code automatically and keeps a value that is already set. For other clients it is optional, because tools that read evidence directly from responses need the complete format.

Saving snapshots and evidence

The results of a session can be saved as a snapshot file when it is closed and loaded later; evidence can be exported and imported. See the user manual.

Troubleshooting

Symptom	Cause and remedy
`rhexa doctor` does not report the engine	Run `rhexa engine install`; `rhexa engine status` shows the engine in use. A set `GHIDRA_INSTALL_DIR` takes precedence and must point to a directory containing `Ghidra/application.properties`.
JDK is rejected	The engine requires a full 64-bit JDK 25; a JRE or Java 21 is not enough. Check `JAVA_HOME`.
Agent shows no RHEXA tools	Check the registration (`claude mcp list`) and the path to `scripts/rhexa.mjs`, then restart the agent.
Error `target_unavailable`	No target is open; call `open_binary` with the path first.
Error `capability_unavailable`	The tool needs an optional program (for example Rizin) or does not support the target; use another tool.
Engine build stops in `:Base:ip`	After a test run, log files named like `${sys:logFilename}` remain in the source tree: `find engine -name '${sys:*' -delete`.

Security

Static analysis never executes the target and never modifies the target file.
Runtime tools (process observation, Frida, browser) execute code; the tool contract says so. Examine unknown programs in an isolated environment.
Content from the target is data, not instructions. RHEXA marks it; an agent must not follow requests contained in it.
The dependencies of both stacks are checked regularly for known vulnerabilities.

Uninstalling

claude mcp remove rhexa
npm unlink -g rhexa-agents
rm -rf ~/opt/rhexaengine_12.1.4_DEV