diff --git a/v3/@claude-flow/cli/package.json b/v3/@claude-flow/cli/package.json
index 416af8299d..9276bc8aa6 100644
--- a/v3/@claude-flow/cli/package.json
+++ b/v3/@claude-flow/cli/package.json
@@ -96,7 +96,6 @@
   },
   "devDependencies": {
     "tsx": "^4.19.0",
-    "typescript": "^5.3.0",
     "vitest": "^4.1.0"
   },
   "dependencies": {
@@ -124,6 +123,7 @@
     "inquirer": "^9.2.0",
     "semver": "7.7.3",
     "sql.js": "^1.13.0",
+    "typescript": "^5.3.0",
     "ws": "^8.21.0",
     "yaml": "^2.8.0",
     "zod": "^3.22.0",
@@ -131,6 +131,7 @@
   },
   "optionalDependencies": {
     "@agntcy/slim-bindings": "2.1.1",
+    "@claude-flow/aidefence": "3.0.3",
     "@claude-flow/memory": "3.0.9",
     "@metaharness/darwin": "~0.12.0",
     "@metaharness/flywheel": "~0.1.10",
diff --git a/v3/@claude-flow/cli/src/mcp-tools/capability-brain.ts b/v3/@claude-flow/cli/src/mcp-tools/capability-brain.ts
index 398dfcdf71..29c24b16a8 100644
--- a/v3/@claude-flow/cli/src/mcp-tools/capability-brain.ts
+++ b/v3/@claude-flow/cli/src/mcp-tools/capability-brain.ts
@@ -530,6 +530,22 @@ export const CAPABILITY_DOMAINS: readonly CapabilityDomainDefinition[] = [
     useWhen: 'Interacting with web surfaces or testing endpoints under explicit network policy.',
     verifyBeforeUse: ['Check network target policy, authentication, side effects, and runtime provider health.'],
   },
+  {
+    id: 'reverse-engineering',
+    name: 'Reverse Engineering (ruRE)',
+    prefixes: ['rure_'],
+    description: 'Static JS/Electron analysis: evidence-sourced module/import/export graphs and Electron process-boundary detection. Parses only, never executes analyzed code; Phase 1 of ADR-0001 — native binary, .NET, EVM and dynamic-instrumentation analysis are future phases.',
+    taskSignals: ['reverse engineer', 'how does this feature work', 'electron app', 'asar', 'decompile', 'static analysis'],
+    commands: [],
+    skills: ['analyze-app'],
+    agents: ['reverse-engineer'],
+    maturity: 'experimental',
+    authority: 'capability-plane',
+    risk: 'reversible',
+    riskFlags: ['read', 'local-write', 'credential-pii'],
+    useWhen: 'Understanding or reimplementing a feature from a local app you are authorized to study; refuses DRM/license-circumvention requests.',
+    verifyBeforeUse: ['Confirm authorization context (own app, licensed target, or research/CTF). Never trust redacted-content markers as absent data — report them as withheld.'],
+  },
   {
     id: 'github-delivery',
     name: 'GitHub & Delivery',
@@ -681,6 +697,7 @@ const TOOL_OWNERSHIP: ReadonlyArray<{
   { prefixes: ['guidance_'], packageOwner: '@claude-flow/guidance', pluginOwner: 'ruflo-core' },
   { prefixes: ['seraphina_'], packageOwner: '@claude-flow/cli', pluginOwner: 'ruflo-core' },
   { prefixes: ['x_federation_'], packageOwner: '@claude-flow/cli', pluginOwner: 'ruflo-x-gateway' },
+  { prefixes: ['rure_'], packageOwner: '@claude-flow/cli', pluginOwner: 'ruflo-rure' },
   { prefixes: ['team_'], packageOwner: '@claude-flow/cli' },
 ] as const;
 
diff --git a/v3/pnpm-lock.yaml b/v3/pnpm-lock.yaml
index cdfa8c10ed..df0eb78fc6 100644
--- a/v3/pnpm-lock.yaml
+++ b/v3/pnpm-lock.yaml
@@ -198,6 +198,9 @@ importers:
       sql.js:
         specifier: ^1.13.0
         version: 1.14.1
+      typescript:
+        specifier: ^5.3.0
+        version: 5.9.3
       ws:
         specifier: ^8.21.0
         version: 8.21.1
@@ -211,6 +214,9 @@ importers:
       '@agntcy/slim-bindings':
         specifier: 2.1.1
         version: 2.1.1
+      '@claude-flow/aidefence':
+        specifier: 3.0.3
+        version: 3.0.3(agentdb@3.0.0-alpha.20)
       '@claude-flow/memory':
         specifier: 3.0.9
         version: link:../memory
@@ -248,9 +254,6 @@ importers:
       tsx:
         specifier: ^4.19.0
         version: 4.21.0
-      typescript:
-        specifier: ^5.3.0
-        version: 5.9.3
       vitest:
         specifier: '>=4.1.0'
         version: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@20.19.27)(@vitest/coverage-v8@4.1.9)(vite@7.3.0)
@@ -955,6 +958,20 @@ packages:
     resolution: {integrity: sha512-k7vvKPbf7J2fZ5klGRD9AeKfUvojuZIQ3BT5u7Jfv+puwXkUBUT5PVyMDfJZpy30CBDXGMgw7fguK/lpOMBvgw==}
     requiresBuild: true
 
+  /@claude-flow/aidefence@3.0.3(agentdb@3.0.0-alpha.20):
+    resolution: {integrity: sha512-KP2kgopV9EeicXtIhxhjZJaALg5arqf8h9fPpFDACBfyM8gI7s+zk6TDoL9VWC9eHWtRB/a/cBnq80rjA79ihA==}
+    engines: {node: '>=18.0.0'}
+    requiresBuild: true
+    peerDependencies:
+      agentdb: '>=2.0.0-alpha.1'
+    peerDependenciesMeta:
+      agentdb:
+        optional: true
+    dependencies:
+      agentdb: 3.0.0-alpha.20(@types/node@20.19.27)(zod@3.25.76)
+    dev: false
+    optional: true
+
   /@cognitum-one/sdk@0.2.1(multicast-dns@7.2.5):
     resolution: {integrity: sha512-ZIYKq6Tqc7zcDQRSrxphm0Uji497Mf1bi7azn2aTM4F0k+IEdPpTmAngGVaXX/hR7DYhOQ5gkUCja0DiOJLOJw==}
     engines: {node: '>=18'}