English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română

BLA: Blind LLM Agents

One MCP for defending binaries, applications, and runtime behavior against AI reverse engineering.

Ship a feature you built. Blind the agents trying to clone it, down to the binary level.

Website · Guides · Showcases

Quick start · How BLA works · What you can protect · Showcases · FAQ · Documentation

npx bla-agents setup · npx bla-agents defend ./dist --manifest

[!IMPORTANT] Get BLA from qybaihe/bla or the bla-agents npm package. Follow the installation and release links from these official sources.

Worried that someone will point REA or a coding agent at your shipped product and clone your core logic in seconds? Ask your agent to harden it with BLA (Poison → Exhaust → Hallucinate). It audits your build without requiring source-code rewrites, shows what an attacking agent would recover, injects adversarial chaff and algorithmic tarpits, and verifies that automated reconstruction fails.

BLA connects your agent to tools for protecting native binaries, JavaScript and Electron apps, WebAssembly modules, Python bytecode, SQLite databases, AI model files, and mobile packages. You can also run the same tools from your terminal or build bundler. Protection runs locally and preserves 100% of original runtime behavior.

Setup registers BLA with your agent and installs matching workflow instructions. Every static, bytecode, and binary shield is built in—no commercial packer, external LLVM toolchain, or third-party obfuscator is required.

Quick start

Set up your agent

With Node.js and npm installed, run:

npx bla-agents setup

Choose your agents (or pass --all-detected --yes), review the proposed changes, and approve them. Setup registers BLA's MCP server and installs the blind-llm-agents skill, with backups of existing configuration. Restart your agent afterward.

Setup supports Claude Code, Codex, Cursor, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. See installation and setup for manual MCP registration.

Ask your agent

Every defense stage—or the entire 5-stage pipeline—can be triggered directly in natural language once your agent is connected:

• ⚡ One-Click Full Defense Hardening (bla_defend — Inspect → Audit → Bankrupt Protect → Verify → Manifest):

  Run bla_defend on ./dist with bankrupt intensity and emit a signed Counter-REA defense manifest.
  

• 1. Audit exposure before shipping (Pre-flight REA Audit):

  Audit my ./dist directory against REA, show me every exposed module and IPC channel, and estimate how much it would cost Claude to reconstruct it.
  

• 2. Inject Counter-REA protection (Poison + Exhaust + Hallucinate):

  Protect ./dist/app.asar with BLA at bankrupt intensity, inject enclave chaff and algorithmic tarpits, and output to ./dist/app.shielded.asar.
  

• 3. Verify defense gates & token amplification (Verify):

  Verify ./dist/app.shielded.asar against the original ./dist/app.asar and confirm that REA's examination degrades to limited status.
  

Use the terminal

Every workflow is available directly from your terminal with npx bla-agents (or bla when installed globally):

• ⚡ One-Click Full Defense Pipeline (defend) — runs release exposure scan, pre-flight REA audit, bankrupt exhaustion + deception injection, verification, and .bla-manifest.json generation in one command:

  npx -y bla-agents@latest defend /absolute/path/to/app --manifest
  

• 1. Audit a target (audit) — inspect exposure score (0–100), exposed symbols, and estimated attacker clone cost:

  npx -y bla-agents@latest audit /absolute/path/to/app --json
  

• 2. Protect a target (protect) — inject semantic budget breakers, tarpit state machines, enclave chaff, and runtime shields:

  npx -y bla-agents@latest protect /absolute/path/to/app -o /absolute/path/to/app.shielded --intensity bankrupt
  

• 3. Verify Counter-REA resistance (verify) — check that REA's static/semantic passes hit resource limits and >10x token amplification:

  npx -y bla-agents@latest verify /absolute/path/to/app.shielded /absolute/path/to/app
  

• 4. Run the 8-target Counter-REA benchmark (benchmark):

  npx -y bla-agents@latest benchmark
  

• 5. Emit compile-time native headers (emit-headers) for C/C++, Rust, or Go builds:

  npx -y bla-agents@latest emit-headers --lang c -o ./include/bla_shield.h
  

To install the bla command for regular use:

npm install --global bla-agents
bla --help

Use in your build bundler

Import bla-shield/bundler in Vite, Rollup, Webpack, or esbuild to automatically shield emitted JavaScript chunks, Honey Source Maps, and .wasm assets at build time:

import { defineConfig } from "vite";
import { blaVitePlugin } from "bla-agents/bundler";

export default defineConfig({
  plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
});

Update BLA

For a CLI installed with npm install --global or bun add --global:

bla update

bla --update is an alias for this workflow. If you use npx, refresh your agent registrations and skill with:

npx bla-agents@latest setup

Review the setup changes and restart your agent. For one-off CLI commands, use npx bla-agents@latest (or bunx bla-agents@latest) followed by the command.

How BLA works

Your agent calls BLA through MCP to audit a build artifact, inject format-specific Counter-REA shields, and verify the hardened output. When an attacking agent later inspects the protected artifact with REA, REA hits deterministic internal resource limits, drowns in decoy cross-references, and misattributes core logic to hardware enclave stubs:

1. Poison (Architectural Chaff & Honey Assets): Embeds benign hardware enclave delegation manifests (SGX / TPM2 / Secure Enclave), VLQ v3 Honey Source Maps (enclave://tee-runtime/), honey WASM "name" sections, and honey SQLite tables across dead branches and constant pools.
2. Exhaust (Semantic Budget Breakers & Algorithmic Tarpits): Trips morluto/rea's hardcoded analyzer caps (primitive-candidates > 256, alias-selections > 512, getter-expansion > 512, primitive-bytes > 1 MiB, maximum_rustc_hashes > 64, maximumSentinelsPerSlice > 32) at zero runtime cost, while weaving 14–36 interconnected Fake XRef state machines into the call graph.
3. Hallucinate (Anti-CDP Runtime Deception & Fuse Hardening): Hardens Electron V1 fuse wires in-place (RunAsNode=0, EnableNodeCliInspectArguments=0) and injects the "Truman Show" runtime guard that serves synthetic enclave attestation telemetry whenever CDP, Node Inspector, Frida, or WebDriver probes attach.

What you can protect

BLA requires Node.js 22.5+ (or 24.x+) and npm. All shields run self-contained with zero external tool dependencies:

Showcases

Run npx bla-agents benchmark to execute all 8 counter-showcases locally and verify both REA failure modes and 100% runtime equivalence:

DX-Ball: bankrupt a sound-pan reconstruction

REA's flagship showcase reconstructs DX-Ball's clampPan and calculateSoundPanFromX helpers in seconds ($0.20). After running npx bla-agents protect examples/dx-ball-sound-pan/sound-pan.js --intensity bankrupt, REA's parse_status drops to "partial", examination.status degrades to "limited" (["alias-selections", "primitive-bytes", "primitive-candidates"]), and the obligation ledger expands from 2 functions to 38 interconnected state machines (2,121.3x token amplification) while returning identical pan values for every input coordinate.

Notion: blind the Electron clipboard IPC bridge

REA traces Electron apps by matching unique literal strings between ipcRenderer.invoke("clipboard:write-rich-format") and ipcMain.handle(...). BLA replaces real IPC channel strings with $\ge 9$-chunk number-theoretic opaque expressions (electron.ipc[0].channel === null) and registers duplicate decoy handlers on the same literal channel names—forcing electron_call_paths_limited: true and uncertainty: ["dynamic-findings", "returned-reference-widening"].

Native, SQLite & Edge AI: trip REA's binary and container capacity limits

When an attacker runs REA's inspect_rust_binary, inspect_electron_fuses, inspect_sqlite_database, or inspect_model_artifact on BLA-protected files, REA's own parsers deterministically abort with capacity and evaluation failures (Read-only data contains more than 64 distinct rustc commit paths, Slice 0 contains more than 32 Electron fuse sentinels, SqliteColumnEvaluationFailure, and ModelFormatFailure: json-nesting).

FAQ

npx bla-agents@latest doctor
npx bla-agents@latest setup

Documentation

• Installation and agent setup: agent registration, bundler plugins, updates, and uninstall.
• CLI and MCP contracts: commands, options, exit codes, and JSON-RPC 2.0 MCP tool schemas.
• Counter-REA technical defense matrix: exact morluto/rea source limits and how BLA exploits them.

Report security issues through SECURITY.md.

Disclaimer

See DISCLAIMER.md for responsible-use guidance.

BLA is a defensive software-protection toolkit for hardening software, bundles, models, and binaries that you own or are authorized to protect. All injected chaff payloads are strictly benign architectural metadata and synthetic decoy functions that preserve 100% of original runtime behavior.

Contributing

Issues and pull requests are welcome at qybaihe/bla. Run npm run build && npm test && node dist/cli.js benchmark before submitting changes.

License

MIT