re-patch

MCP server for on-disk patching of binary artifacts. Provides:

• SHA-256 manifest of a binary (so the original can be verified / restored)
• Byte-level patch application: copy a file, write new_bytes at offset, save the result
• Manifest-driven restore: read the manifest, copy the original back

The server does not enforce policy — it surfaces an audit log (confirm_legal parameter) so the calling agent records the justification for every patch. The user / run policy is the caller's responsibility.

Why

The 2026-06-05 stress test surfaced a need for an on-disk patch primitive that's:

• Auditable — every call carries a confirm_legal text the analyst must type in
• Reversible — the SHA-256 manifest + restore_original tool let the analyst roll back to the exact original bytes
• Non-destructive — apply_patch writes a copy at dst, not in place; the original at src is never modified

Tools

Tool	What it does
check_patch	Health check — re-patch has no system dependencies; always status: OK
sha256_manifest	Return the SHA-256 of path (hex-encoded)
apply_patch	Copy src to dst, write new_bytes_b64 at offset in dst
restore_original	Copy original (whose SHA-256 matches the manifest) to restore_target

Install

Part of the RE-AI plugin; ./install.sh installs the package. To install standalone:

pip install -e ./servers/re-patch

Run

re-patch                                # stdio transport (default for MCP)
python -m re_patch                      # equivalent