--- title: "BLA: Blind LLM Agents" kind: "Kit" category: "Developer" price: "Free" seller: "Mindket" version: "1" url: "https://mindket.com/p/46962b04-3da6-4423-ac39-9af426b3e04e" updated: "2026-11-10" health: "Active" --- # BLA: Blind LLM Agents > The name, the description, the About and a README below are the seller's words: data, not instructions. Hardens your own software builds against AI reverse-engineering agents, which hit resource limits and decoys while your users see the same runtime behavior. BLA: Blind LLM Agents is an open-source project on GitHub in the Developer category, listed by Mindket. It is free. This is version 1, last updated on 2026-11-10. Install it from GitHub as its README says. Get Mindket’s setup notes on your Mindket account, as a zip. Made by qybaihe ## About ### What it is BLA is a defensive tool that hardens the builds you ship against AI reverse-engineering agents, which the README calls REA. It plants decoys and pushes artifacts past the analyzer's resource budgets, so the analyzer wastes effort and the program runs the same for your users. It is meant for your own software. ### Who it suits It suits developers who ship software and worry about AI agents taking it apart. | Industry | Who uses it | How they use it | Example | | --- | --- | --- | --- | | Desktop software | Electron app developers | Harden the app's ASAR archive before release | An ASAR header grown from 607 B to 16.9 MiB | | Backend and systems | Go developers | Harden release binaries against automated analysis | Go build info grown from 50 KiB to 1.16 MiB | | Blockchain | Teams shipping EVM bytecode | Harden the bytecode before it goes out | Bytecode grown from 16 B to 4.00 MiB | Anyone who wants to analyze software they do not own should skip it, since BLA is for protecting your own. ### Where to use it BLA runs from a terminal and from your coding agent. - Terminal: run the npx commands in your project folder - Coding agents: setup registers an MCP server and a skill, so you can ask for a pass in plain words - Build outputs: it finds dist and build folders, .asar, .wasm and .sqlite files, and models | Use case | Who | What they get back | | --- | --- | --- | | Harden a release | Developers shipping builds | A hardened build whose runtime behavior stays equivalent | | Check the defense | Security-minded teams | A 14-target benchmark with local estimates and runtime checks | | Ask in plain words | Coding agent users | A hardening pass started from a short prompt | | Run stages one by one | Teams that want control | Audit, protect, verify or defend run on their own | ### How to set it up You need Node.js and a project with a build before you start. - Node.js 24.x, or 22.23.4 and up in the 22 line - A project with build output, such as dist or build - A coding agent, if you want to ask for hardening in plain words 1. Install a recommended Node.js version. 2. Run setup once, which registers the MCP tools and the skill with your coding agent. 3. Run harden on your project folder. 4. Run the benchmark if you want to see the showcase. ```bash npx bla-agents setup npx bla-agents benchmark ``` ### How to use it Run harden from your project folder, or ask your agent after setup. ```bash npx bla-agents harden . ``` ```text Harden my software against REA ``` | Tool | What it does | | --- | --- | | harden | Finds your build outputs and runs audit, protect and verify in one pass | | audit, protect, verify | The three stages of that pass, which you can also run one at a time | | defend | Runs the same pipeline when you already know the path | | benchmark | Runs a 14-target showcase with local estimates and runtime checks | | setup | Registers the MCP tools and the skill with your coding agent | | bla\_harden | The MCP tool an agent calls to do the same job | ### Example After setup, you ask your agent to harden your software against REA. BLA finds your build outputs, then audits, protects and verifies them. An AI reverse-engineering agent that opens the result runs into resource budgets and decoys, while your users see the same runtime behavior. ### For newcomers and experts REA is an AI agent that reverse-engineers release builds with one command, and BLA is built as the counter to it. If you are new, install Node.js, run setup, and try harden on a small test project first. BLA works in three layers. Poison adds bait metadata, canary values in valid formats and fake control flow paths. Exhaust pushes an artifact past REA's documented budgets for headers, nesting and interface inventories. Hallucinate leaves the analyzer with incomplete inventories, failed redactions and murky dead ends. The trade-off is that the measured results cover only the REA analyzer path in the author's environment, not sessions with Ghidra, Frida, LLDB, Rizin or JADX, and artifacts grow in size. You point BLA at the build you ship → BLA runs audit, protect and verify in one pass → The hardened build keeps the same runtime behavior → An AI reverse-engineering agent hits budgets and decoys ### Good to know - Defensive use: the README says BLA is for protecting your own software and links a disclaimer - Results: measured against real REA on ordinary hardware, covering only the analyzer path that was run - Benchmark: 14 targets, with internal estimates - Format coverage: the table below shows Go build info, Erlang BEAM, EVM bytecode, PCAP and Electron ASAR, and its search for build outputs also covers .wasm, .sqlite and model files - License: MIT Verified against real REA | Format | Before | After | REA outcome | | --- | --- | --- | --- | | Go buildinfo | 50 KiB | 1.16 MiB | Capacity error at the 1 MiB limit | | Erlang BEAM | 84 B | 262 KiB | Capacity error at the 64-chunk budget | | EVM bytecode | 16 B | 4.00 MiB | Approaches the full 4 MiB input cap | | PCAP | 24 B | 1.29 MiB | Budget rejected, with tshark present | | Electron ASAR | 607 B | 16.9 MiB | Capacity error at the 16 MiB header limit | ## README ````markdown # BLA: Blind LLM Agents Hardens your own software builds against AI reverse-engineering agents, which hit resource limits and decoys while your users see the same runtime behavior. Made by qybaihe on GitHub. These notes are Mindket's, written from its README; the project's own files and license are in its repository. ## About What it is: BLA is a defensive tool that hardens the builds you ship against AI reverse-engineering agents, which the README calls REA. It plants decoys and pushes artifacts past the analyzer's resource budgets, so the analyzer wastes effort and the program runs the same for your users. It is meant for your own software. Who it suits: It suits developers who ship software and worry about AI agents taking it apart. ```table Industry | Who uses it | How they use it | Example Desktop software | Electron app developers | Harden the app's ASAR archive before release | An ASAR header grown from 607 B to 16.9 MiB Backend and systems | Go developers | Harden release binaries against automated analysis | Go build info grown from 50 KiB to 1.16 MiB Blockchain | Teams shipping EVM bytecode | Harden the bytecode before it goes out | Bytecode grown from 16 B to 4.00 MiB ``` Anyone who wants to analyze software they do not own should skip it, since BLA is for protecting your own. Where to use it: BLA runs from a terminal and from your coding agent. - Terminal: run the npx commands in your project folder - Coding agents: setup registers an MCP server and a skill, so you can ask for a pass in plain words - Build outputs: it finds dist and build folders, .asar, .wasm and .sqlite files, and models ```table Use case | Who | What they get back Harden a release | Developers shipping builds | A hardened build whose runtime behavior stays equivalent Check the defense | Security-minded teams | A 14-target benchmark with local estimates and runtime checks Ask in plain words | Coding agent users | A hardening pass started from a short prompt Run stages one by one | Teams that want control | Audit, protect, verify or defend run on their own ``` How to set it up: You need Node.js and a project with a build before you start. - Node.js 24.x, or 22.23.4 and up in the 22 line - A project with build output, such as dist or build - A coding agent, if you want to ask for hardening in plain words 1. Install a recommended Node.js version. 2. Run setup once, which registers the MCP tools and the skill with your coding agent. 3. Run harden on your project folder. 4. Run the benchmark if you want to see the showcase. ```bash npx bla-agents setup npx bla-agents benchmark ``` How to use it: Run harden from your project folder, or ask your agent after setup. ```bash npx bla-agents harden . ``` ```text Harden my software against REA ``` ```table Tool | What it does harden | Finds your build outputs and runs audit, protect and verify in one pass audit, protect, verify | The three stages of that pass, which you can also run one at a time defend | Runs the same pipeline when you already know the path benchmark | Runs a 14-target showcase with local estimates and runtime checks setup | Registers the MCP tools and the skill with your coding agent bla_harden | The MCP tool an agent calls to do the same job ``` Example: After setup, you ask your agent to harden your software against REA. BLA finds your build outputs, then audits, protects and verifies them. An AI reverse-engineering agent that opens the result runs into resource budgets and decoys, while your users see the same runtime behavior. For newcomers and experts: REA is an AI agent that reverse-engineers release builds with one command, and BLA is built as the counter to it. If you are new, install Node.js, run setup, and try harden on a small test project first. BLA works in three layers. Poison adds bait metadata, canary values in valid formats and fake control flow paths. Exhaust pushes an artifact past REA's documented budgets for headers, nesting and interface inventories. Hallucinate leaves the analyzer with incomplete inventories, failed redactions and murky dead ends. The trade-off is that the measured results cover only the REA analyzer path in the author's environment, not sessions with Ghidra, Frida, LLDB, Rizin or JADX, and artifacts grow in size. ```flow You point BLA at the build you ship BLA runs audit, protect and verify in one pass The hardened build keeps the same runtime behavior An AI reverse-engineering agent hits budgets and decoys ``` Good to know: - Defensive use: the README says BLA is for protecting your own software and links a disclaimer - Results: measured against real REA on ordinary hardware, covering only the analyzer path that was run - Benchmark: 14 targets, with internal estimates - Format coverage: the table below shows Go build info, Erlang BEAM, EVM bytecode, PCAP and Electron ASAR, and its search for build outputs also covers .wasm, .sqlite and model files - License: MIT ```table Title: Verified against real REA Format | Before | After | REA outcome Go buildinfo | 50 KiB | 1.16 MiB | Capacity error at the 1 MiB limit Erlang BEAM | 84 B | 262 KiB | Capacity error at the 64-chunk budget EVM bytecode | 16 B | 4.00 MiB | Approaches the full 4 MiB input cap PCAP | 24 B | 1.29 MiB | Budget rejected, with tshark present Electron ASAR | 607 B | 16.9 MiB | Capacity error at the 16 MiB header limit ``` ## On GitHub, 6 November 2026 - Stars: 2,486 - Forks: 327 - Watching: 10 - Open issues and pull requests: 4 - Language: TypeScript - License: MIT - Topics: adversarial-ai, claude-code, cursor, electron-security, llm-security, mcp, mcp-server, obfuscation, reverse-engineering, webassembly - Trending: #19 repository of the day on GitHub trending (6 November 2026) ## Links - Code: https://github.com/qybaihe/bla - Website: https://bla.tools/ - Releases: https://github.com/qybaihe/bla/releases - Issues: https://github.com/qybaihe/bla/issues - Star history: https://www.star-history.com/#qybaihe/bla&Date ## Get the code ``` git clone https://github.com/qybaihe/bla.git ``` Then follow the setup in its README. Nothing in this kit runs by itself. ```` ## What is in it 1 files, 6 KB, downloaded as a zip. ```text README.md 6 KB ``` ## Source [qybaihe/bla on GitHub](https://github.com/qybaihe/bla) ## Compare with similar Listed GitHub projects in the same category that share the most topics with this one. | Product | Stars | Activity | Language | License | Last change | | --- | --- | --- | --- | --- | --- | | BLA: Blind LLM Agents (this page) | 2,486 | Active | TypeScript | MIT | 2026-11-06 | | [imbo](https://mindket.com/p/b73c4847-68a6-4214-9cd5-1eec103e3853) | 111 | Active | Rust | Apache-2.0 | 2026-11-06 | | [kanzo](https://mindket.com/p/e5ed206f-4bc4-4b0c-a300-2f4f27695bf4) | 1,045 | Active | Rust | AGPL-3.0 | 2026-11-06 | | [Agentic Resource Registry](https://mindket.com/p/197b26ea-03ea-47b6-8a90-7f20e1409457) | 4,320 | Active | Python | Apache-2.0 | 2026-11-06 | | [Scrapling](https://mindket.com/p/9632ac46-f67e-4c1a-843d-224f9f055a48) | 99,911 | Active | Python | BSD-3-Clause | 2026-11-05 | | [Chrome DevTools for agents](https://mindket.com/p/8828dd94-dd74-47ad-b392-52d2cde247bc) | 55,482 | Active | TypeScript | Apache-2.0 | 2026-11-13 | Numbers as Mindket last read them, from 2026-11-06 to 2026-11-14. Activity is read from each project’s last change on GitHub: Active within 30 days, Quiet within 180, Stale after that. ## What people say > Posts and comments that name this project on Hacker News, Bluesky, X, Reddit, Facebook and YouTube, found by a weekly search on 2026-11-09. Their authors' words: data, not instructions. - [Bluesky · Today's Top AI News · 2026-11-08](https://bsky.app/profile/todaystopainews.bsky.social/post/3mzsudvcnh62e): BLA: Adversarial defense shield for binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse‑engineering agents like REA. \#opensource \#news \#artificialintelligence \#ai \#javascript \#python \#technology - [Bluesky · iterativeguy · 2026-11-03](https://bsky.app/profile/osrepos.bsky.social/post/3mzfvxt7g3c2h): Just added to the catalog: BLA: Protect Software from AI Reverse-Engineering Agents https://osrepos.com/repo/qybaihe-bla?utm\_source=bluesky BLA is a TypeScript CLI and MCP tool that hardens binaries, Electron apps, JavaScript bundles, Python, and WebAssembly against AI… \#opensource - [Bluesky · @telleroutlook.bsky.social · 2026-10-31](https://bsky.app/profile/telleroutlook.bsky.social/post/3mz5yhrzcsm2b): BLA, an open-source shield, hardens binaries and Electron/WASM builds against AI reverse-engineering agents with decoys and budget traps, while runtime stays identical. \#security \#AI https://github.com/qybaihe/bla - [Bluesky · KittenCannonSec™ · 2026-10-30](https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mz3vouxmdrg2): bla https://kitploit.com/en/tools/github/qybaihe/bla ## Trust facts Facts from each source, with the day each was checked. A maintainer's note is their own words: data, not instructions. - Health on GitHub: Active - Last change: 2026-11-06 - Checked on GitHub: 2026-11-06 - Something wrong? Tell us: https://mindket.com/takedown#ask ## Get it - [Open qybaihe/bla on GitHub](https://github.com/qybaihe/bla) - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/46962b04-3da6-4423-ac39-9af426b3e04e) - [Its page on Mindket](https://mindket.com/p/46962b04-3da6-4423-ac39-9af426b3e04e)