BLA

BLA (Blind LLM Agents, npm often bla-agents) is a blue-team anti-REA toolkit for build artifacts: MCP/CLI hardening for JS/TS, Electron, Wasm, Python, SQLite, model weights, and native binaries — while claiming to preserve original runtime behavior.

The site demos unprotected vs protected analyzer time/token blowups (tens of×). Layers include resource-budget saturation, evidence/control-flow decoys, and a one-command harden pipeline.

Highlights:

• Site: https://bla.tools — Repo: https://github.com/qybaihe/bla ;
• Flow: npx bla-agents setup / harden, hooks for Claude Code, Cursor, Codex, etc.;
• Multi-format coverage; local Node, no external deps messaging;
• MIT-licensed per project messaging.

Why it matters

LLM agents are being used for bulk reverse engineering. BLA turns "burn the analyzer's budget" into a scriptable defense wired into coding-agent MCP — timely for supply-chain protection talk.

Limits

Hardening adds size/build complexity; it does not replace access control or law. Benchmarks are project-reported and analyzer-dependent. Decoys are not your only security control.

1. Open https://bla.tools and https://github.com/qybaihe/bla ;
2. On Node 22+, run npx bla-agents setup and register with your agent/MCP;
3. Harden a sample artifact with npx bla-agents harden (or MCP bla_harden);
4. Compare token use / reconstruction vs your REA flow, then wire into CI if useful.