The old setup-kit URL now serves Reverify 0.11.0
GitHub returns a 301 redirect from 2akouwu/codex-cli-portable-setup-kit to 2akouwu/reverify. The current package is Reverify 0.11.0, a Python reverse-engineering and claim-checking toolkit, rather than a portable Codex CLI installer. That identity change matters if you found the project through an old link or name. The measured commit, f32ea84, is also current main, so our sandbox result applies to the code now behind the redirect.
Reverify gives an AI a constrained way to make claims about a binary or program. The model proposes a falsifiable statement, such as bytes at an offset, an imported function, a string, a disassembly sequence, or an expected register value. Deterministic code returns VERIFIED, REFUTED, or INCONCLUSIVE with observed evidence. A ledger stores accepted facts and known false claims by artifact hash so a later session can recover grounded state without trusting a prose summary.
Version 0.11.0 combines a CLI, MCP server, and optional engines
The base 0.11.0 package has no declared runtime dependencies and can parse common binary formats, scan patterns, disassemble supported instruction sets, emulate code, and compare Python or C behavior. Installing optional Capstone, Unicorn, LIEF, or Z3 backends replaces parts of the pure-Python path with mature engines. Angr is a separate extra for functions, call graphs, and cross-references. reverify backends reports which implementations are active.
The same operations are exposed through an MCP server, which makes the project usable from Claude Code, Cursor, and other MCP clients. Each verdict can include the artifact SHA-256, Reverify version, and judging engines. That receipt is more useful than a confident paragraph because another analyst can replay the claim. It still proves only the claim submitted. A narrow or empty assertion can produce a technically correct result while contributing little knowledge, which is why the open verifier defect matters.
What happened when we ran it
Our 3-CPU, 8 GB sandbox installed commit f32ea84 in 17 seconds. The install added 36 packages and occupied 37 MB, then the build succeeded in 1 second. Pip-audit found 0 known vulnerabilities. The harness discovered no test script or target, so it skipped tests. That is an absent result, not a passing suite, even though the repository contains CI and Python test modules.
We measured 109 files, about 17,503 source lines, and a 1.5 MB checkout. The repository had 7 CI workflow files and no Dockerfile. Under our test method, the package and build path are lightweight, while test behavior remains unverified by our run. We did not install the optional analysis engines, connect a model provider, feed it a private binary, or exercise rollover against a live agent session.
Open issue 22 makes some VERIFIED claims vacuous
Issue 22, opened on September 11, reproduces four assertion shapes that current main marks VERIFIED: an empty string, an all-wildcard pattern, zero expected bytes, and an empty instruction list. The report says these claims also receive positive information weight, letting a caller raise the grounded score without establishing a useful fact. Pull request 21 proposes returning INCONCLUSIVE and adds bounds protection for PE export parsing, but it had not merged when we fetched the repository.
This does not show that ordinary nonempty claims are broadly wrong. It does show that callers must validate claim shape before treating the verdict or information score as a gate. Open issue 14 exposes a second limit in the agent loop: one loosely phrased import goal led the model away from structured claim types into raw byte guesses and never finished. Pull request 19 adds guidance for those structured kinds, and it too remained open.
Rollover changes four agent configurations
Release 0.11.0 can install hooks for Claude Code, Codex, Gemini CLI, and OpenCode. It disables native compaction, writes a fixed handoff file, checks that file before issuing a receipt, and starts a clean session where the host or launcher allows it. The installer keeps backups and documents uninstall. This is a meaningful configuration change, so reverify rollover doctor belongs in setup and recovery checks.
Claude Code and Codex hooks cannot end an ordinarily launched session. Without the Reverify launcher or configured successor, the handoff can be written while the old context keeps growing. Gemini and OpenCode have different replacement paths. That uneven behavior is stated plainly in the README, but it makes the feature operational wiring rather than a universal drop-in fix for context compaction. Test the exact harness, launch mode, approval flow, and recovery path you use.
Seven open items keep this in alpha territory
GitHub showed 1,240 stars, 240 forks, and 7 combined open issues and pull requests. Main was last pushed on September 7, 2026, three days after the v0.11.0 release; new defect reports and proposed fixes continued through September 11. That is active issue work rather than abandonment. The package still labels itself alpha, and the unmerged verifier fix affects the central promise closely enough to outweigh the star count.
Reverify is worth a controlled trial if your work starts with a concrete artifact and you will read the evidence. Ghidra is the stronger choice for an analyst workbench, angr for symbolic exploration, and Rizin for a mature terminal framework. Reverify's distinct value is the claim receipt and persistent ledger around an AI agent. Keep human review in that loop until issue 22 is closed and your own nonempty, false, and malformed claims behave as expected.