# REA (Reverse Engineer Anything) REA (Reverse Engineer Anything) is an [[Open Source]] toolkit that lets [[AI Agents]] reverse engineer software: native binaries, [[Electron]] and JavaScript apps, Android APKs, .NET assemblies, websites and quite a bit more. It ships as a [[Model Context Protocol (MCP)]] server plus a CLI, written in [[TypeScript]] and published on npm as `rea-agents`. The README sums up the pitch in one line: "See a feature you like. Understand how it works, down to the binary level." Why does this matter? Reverse engineering is slow, manual work. You open a binary in a disassembler, read pages of pseudocode, rename functions one by one, and build up a picture of what the program actually does. [[Large Language Models (LLMs)]] are good at that kind of reading; what they're missing is access to the tools. REA wires those tools into one MCP server, so an agent like [[Claude Code]], [[OpenAI Codex]], [[Cursor]] or [[Gemini CLI]] can run the analysis itself. ## How it works `npx rea-agents setup` registers REA's MCP server with the agents you pick and installs a matching skill that describes the investigation workflow (the skill is also listed on [[Skills.sh]]). Setup shows the proposed changes, asks for approval and backs up your existing configuration first. After that, you ask in plain language, e.g. "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project." The agent calls REA to inspect the target and trace the relevant code. REA sends back its findings together with the evidence and the limitations behind each conclusion. The agent then explains the behavior, or writes and tests its own implementation. Every workflow is also available from the terminal through the `rea` command. For deep native analysis, REA drives a decompiler you already have: Hopper, [[Ghidra]] or IDA (setup can install Hopper if you say yes). Static JavaScript, Electron and .NET analysis need none of them. Analysis runs locally, but keep in mind that your agent's model provider still sees the tool results. ## What it can analyze The README lists more than twenty target types. The main ones: - **Native binaries**: pseudocode, assembly, strings, symbols, calls and references - **JavaScript and Electron apps**: modules, imports, source maps, routes, IPC and native add-ons - **Android**: APKs (through JADX), connected devices (through adb), resources and Flutter apps - **Other compiled formats**: .NET assemblies (metadata, CIL), Go and Rust binaries (embedded build and dependency info), WASM, EVM bytecode - **Runtime and data**: websites (through a Chrome-family browser), HAR and packet captures, [[SQLite]] databases, firmware Many targets need external tools you install yourself (pwntools, TShark, Binwalk, WABT...), and some only work on Linux. Check the requirements column before you count on a given target. ## Worked examples The project site walks through a few cases in detail. In DX-Ball, REA follows a sound call into its position-to-pan helper; the reconstructed C passes 3,205 test cases against the original x86 code and reproduces all 63 compiled function bytes. The Notion case traces the clipboard API from the renderer through preload and IPC into Electron's main process. And TH04 recovers a bullet-ring angle calculation from the 16-bit PC-98 version of a Touhou game. ## Things to know before installing - **Author**: the GitHub user morluto, by far the main contributor (1,953 commits as of October 2026). N0zoM1z0, who published the DX-Ball and TH04 reconstructions, comes second with 592. - **License**: [[MIT License]] for REA's own code. Commercial tools (IDA Pro, Hopper, JEB) still need valid licenses of their own; REA grants none. - **Young and moving fast**: created in April 2026, with the latest release on 2026-10-18 (as of October 2026). The README asks you to update often because releases bring frequent bug fixes. - **Lookalikes**: the README says to get REA only from the GitHub repo, rea.tools or the `rea-agents` npm package. With that kind of popularity, copied repos are a real supply chain risk. - **Lawful use only**: the disclaimer covers security research, malware analysis, interoperability, preservation and software you own or are allowed to examine. It refuses help with DRM circumvention, cheats, license bypasses and copying proprietary code. Reverse engineering can also be restricted by local law or by the license of the software you analyze. - **Model safeguards**: providers have their own rules. Security practitioners report that the cyber safeguards of [[Claude Opus 5.5]] sometimes cut off legitimate reverse engineering work. ## My take What I like most is the evidence-first design. An agent that tells you "this function does X" is worthless if you can't check the claim. REA makes the agent bring the pseudocode, the references and the unknowns behind every conclusion, so you verify instead of trusting. I'd want that default in every agent tool, and even more in reverse engineering, where a confident wrong answer is easy to produce and hard to spot. The "see a feature, build your own version" angle is also really appealing for developers. Understanding how a feature works is fair game in most places. Copying protected code is NOT, and the project says so clearly. ## References - Repository: https://github.com/morluto/rea - Website: https://rea.tools/ - Worked examples: https://rea.tools/showcase/ - npm package: https://www.npmjs.com/package/rea-agents - Disclaimer: https://github.com/morluto/rea/blob/main/DISCLAIMER.md ## Related - [[Ghidra]] - [[Model Context Protocol (MCP)]] - [[AI Agent Skills]] - [[AI Agents]] - [[Electron]] - [[IT Security (MoC)]] - [[Tools (MoC)]]