BLA

BLA (Blind LLM Agents) is an open-source Counter-REA toolkit (MIT, npm bla-agents). You point it at the build you own. It plants format-valid canaries and decoy control flow, densifies structures past documented analyzer budgets, and leaves ambiguous rabbit holes — while users still get equivalent runtime. Coverage spans JS, Electron ASAR and fuses, WASM, SQLite, safetensors/GGUF, Go buildinfo, BEAM, EVM bytecode, PCAP, and more. Empirical red-team runs against real REA record capacity errors and redaction failures on hardened samples. Setup registers an MCP server and agent skill so you can say harden my software against REA from Claude Code, Cursor, and similar hosts.

REA and friends can open a release artifact and rebuild the product story in one pass. Founders shipping Electron apps, JS bundles, WASM, models, and binaries need a defensive half of that story — harden the artifact so analyzers hit budgets and decoys instead of a clean map of your internals.

Need Node 22.23.4+ or 24.x. Run npx bla-agents setup to wire MCP and the skill, then npx bla-agents harden . in the project (or bla defend on a known path). The pipeline audits, protects, and verifies; optional npx bla-agents benchmark walks a 14-target showcase. Agents can call bla_harden after setup. Full CLI stages and MCP catalog live in the docs; product site is bla.tools.

Not another obfuscator marketed as security theater, and not Deepsec-style agent behavior audits. BLA is the explicit counter to AI reverse-engineering agents like REA: measured budget hits and decoys on release formats, with runtime equivalence as the product promise.

• MCP server / client support

• REA ↗
• Deepsec ↗