REA (Reverse Engineer Anything) lets you do reverse engineering with your code agent: analyze binaries, Electron apps, or APKs without having the source code. Your agent investigates how a specific feature works and responds with the evidence behind each conclusion. It works with Claude Code, Codex, Cursor, Gemini CLI, and other MCP-compatible agents, and installs with a single npx command. As of October 19, 2026, the repository has 336,000 stars on GitHub, six months after its creation.
The pitch is straightforward. You see a function in an application and want to know how it’s built. You ask your agent, and REA gives it the tools to inspect the app, trace the relevant code, and come back with findings, the evidence that supports them, and the limits of what it could determine. The same tools are available from your terminal as a CLI.
What is REA?
REA combines three pieces in one package: an MCP server, a CLI, and a skill for your agent with investigation instructions. It’s licensed under MIT, published on npm as rea-agents, and listed in the official MCP registry as io.github.morluto/rea.
REA doesn’t replace a decompiler. It sits between your agent and analysis tools. For native code, it controls an engine you already have installed: Hopper, Ghidra, or IDA. For JavaScript, Electron, and .NET, it does the inspection itself. In both cases, your agent receives structured results it can reason about, rather than raw assembly.
What is an MCP and why does REA use it?
MCP (Model Context Protocol) is an open standard that lets an AI agent discover external tools and call them during its work. An MCP server is the program that exposes those tools.
REA uses MCP so any compatible agent can call its analyses without a specific integration. Your agent doesn’t need to know how to operate Ghidra or Hopper: it asks REA to inspect a target, and REA returns the result in a format the agent understands. That’s why the same server works in Claude Code, Codex, or Cursor. If you search in English, you’ll find it as reverse engineering MCP.
What can REA analyze without Ghidra or IDA?
Quite a lot. The decompiler is only needed for deep native analysis.
| Target | Needs a native engine? |
|---|---|
| JavaScript / Electron apps (modules, imports, IPC, source maps) | No — Node.js and npm |
| .NET assemblies (metadata, CIL, native dependencies) | No — static analysis only |
| Go and Rust binaries (build info, crate versions) | No — built-in inspection |
| Websites (structure, scripts, network) | No — a Chrome-based browser |
| Android APKs (manifest, classes, decompiled methods) | JADX and a full JDK |
| Native binaries (pseudocode, assembly, symbols, references) | Yes — Hopper, Ghidra, or IDA |
The README lists more targets, including firmware, network captures, SQLite databases, WASM, and EVM bytecode. Several only work on Linux.
How do I install REA on Claude Code, Codex, or Cursor?
You need Node.js 22.19 or higher on the 22.x branch, 24.11 or higher on 24.x, or any version from 26 onwards, plus npm. Then run:
npx --yes rea-agents@latest setup
The installation follows four steps:
- Detects which agents you have installed.
- Shows you the exact changes it proposes.
- Doesn’t write anything until you approve it.
- Registers REA’s MCP server, installs the skill, and saves a backup of your config files.
Restart your agent when done. There are two details worth knowing:
- The installation pins the MCP registry to the exact version of REA that ran it. If you run the same command later, it migrates to the new version.
- On Codex, it also adds 30 seconds to startup time.
To see the changes without applying anything, or to choose specific agents, use:
rea setup --client codex --client cursor --dry-run
That command requires the CLI installed globally, with npm install --global rea-agents. You can check the status anytime with rea doctor --json, which only reads and doesn’t modify anything.
If your client isn’t among those the guided setup supports, register the server by hand with the JSON from the official documentation. It’s the same way a claude code mcp configuration works:
{
"mcpServers": {
"rea": {
"command": "npx",
"args": ["-y", "rea-agents@latest", "mcp"]
}
}
}
How do I do reverse engineering with my code agent?
Ask about a specific function, not “explain this app to me”. The README itself suggests an example you can adapt:
Understand how search works in the Notes app, show me the evidence,
and build a similar function for my project.
Swap Notes for your target application and search for the function you care about.
From the terminal, you can inspect an extracted Electron app, or its ASAR file, without using any agent:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
The project publishes three complete case studies:
- Notion: traces the clipboard bridge from the renderer process, through preload and IPC, to the main process.
- DX-Ball: reconstructs a sound pan calculation from x86 code. According to the project, the reconstructed C passes 3,205 test cases against the original and reproduces the 63 compiled bytes of the function. These are results published by the project itself, not independently verified.
- TH04: recovers the mathematics of a bullet pattern from a 16-bit PC-98 game.
Does REA work on Windows, macOS, and Linux?
It works partially on each one. The answer depends on which engine you need.
| Platform | Static JS / .NET analysis | Hopper | Ghidra |
|---|---|---|---|
| Linux | Yes (requires a procps-compatible ps) |
Yes, demo mode runs headless | Yes, x64 only |
| macOS | Yes | Yes | Not supported |
| Windows | Yes | Not documented | Experimental, PE x86-64 apps only |
These details are from the documentation as of October 19, 2026:
- REA requires exactly Ghidra 12.1.4 with a 64-bit JDK 21. You install Ghidra yourself and tell REA where it is using the
GHIDRA_INSTALL_DIRvariable. - On Windows, the guided setup doesn’t modify your agent’s configuration. You register
rea mcpby hand, as shown in the official Windows guide.
Is REA free?
REA is free and MIT licensed. The cost can appear in deep native analysis:
- Hopper is commercial software. It has a free demo with limits set by its maker, and REA’s setup can download it if you approve.
- IDA is commercial.
- Ghidra is free and open source, but for now REA only supports it on Linux x64, plus an experimental path on Windows.
If your targets are Electron, JavaScript, or .NET, you might not need any of the three.
Does REA upload your application to the cloud?
No. REA runs the analysis on your machine. But the results go to your agent, and thus to your agent’s model provider, under their own data policy. Keep this in mind before analyzing anything sensitive.
Can you use REA to copy a function from another app?
The project’s own warning limits REA to legal investigation, education, interoperability, software preservation, and analysis of software you own or have permission to examine. Commercial engines like IDA, Hopper, and JEB require their respective licenses, and the project explicitly rules out cracked copies and license restriction evasion.
Understanding how something works is not the same as having permission to copy it. Check the license and terms of service of what you’re going to inspect.
How do I know I installed the official REA?
Install it only from the GitHub repository, from rea.tools, or from the rea-agents package on npm. The README itself warns that a similar repository name or a copied README don’t make a download official. Popular tools for agents attract imitations, and this one installs an MCP server with access to your files.
REA or Ghidra?
If you want to learn the craft, start with Ghidra on its own: Ghidra: how to analyze a program without its source code. If you already have a question about a specific function and want your agent to do the heavy lifting, with evidence you can verify, REA is the fastest way.
What about you? What application would you like to open to see how one of its functions works?
- A desktop or Electron app I use every day
- A legacy binary from work, no source code
- An Android app
- I’d prefer another option (tell us which)
Comment below or, if this article reached you by email, reply directly to the email: your answer gets published here.
Related: Ghidra: how to analyze a program without its source code