[benjaminkincses]

The default REA server command runs npx -y rea-agents@latest. That is the out-of-the-box path for reagraph pull and reagraph compare when no --rea-cmd or REAGRAPH_REA_CMD is set, and it executes whatever npm serves that day, unpinned, with no integrity check.

The repo already pins this exact package everywhere else: REA_PIN is 6.7.0 in cli.py and the setup-rea Docker path installs rea-agents@6.7.0. The default should match the pin.

Fix: pin the default command to rea-agents@6.7.0 and update the one help string that still shows @latest as the example.

Verified locally: the imported DEFAULT_SERVER_CMD is the pinned command.

[graphify-labs-staging]

Graphify reviewed this change.

No issues found by static checks — no coupling regressions or blocking issues in the code graph. That is not the same as safe to merge: see what was not checked.

Not checked: tests were not run; no formal proof of the changed code.

---

Graphify review — findings

Pins rea-agents to 6.7.0 in both the MCP server command and the --rea-cli-cmd example. The client now always launches that exact version instead of whatever @latest resolves to on a given day. No fallback path exists; an unpinned install is no longer offered.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 151 functions depend on the 60 functions this change touches.

Health — grade A; 3 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• main() — 1 callers, 10 callees (medium)
• test_attest_tampered_pair_surfaces_residual() — 0 callers, 6 callees (medium)
• test_collect_yields_fragments_and_skips_the_erroring_tool() — 0 callers, 6 callees (medium)

Verification — 151 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 151 function(s) in the blast radius were not formally verified this run