Introduction
"See a feature you like. Understand how it works, down to the binary level."
This is article #235 in the "One Open Source Project a Day" series. Today's project is REA (Reverse Engineer Anything) — an MCP server that connects AI agents to reverse-engineering tools, by morluto, 187,000+ Stars, MIT license, and already a Trendshift trending repository less than six months after launch.
Reverse engineering has always been a high-barrier craft: you need to know assembly, operate professional tools like Hopper/Ghidra/IDA, and piece business logic back together from decompiled pseudocode. REA's approach is to package that capability as MCP tools an AI agent can call. You just tell your agent, in plain language, "I want to understand how this app does X," and the agent calls REA's analysis tools on its own, drilling down to bytecode, assembly, and symbol tables as needed, coming back with evidence-backed findings it can use to help you implement something similar.
What You'll Learn
- REA's core positioning: MCP tools + an agent, not a standalone reverse-engineering platform
- Just how broad its analysis target list is — websites, Electron apps, native binaries, EVM bytecode, Android APKs, firmware
- Why the "evidence + limitations" result design matters specifically for AI-assisted analysis
- Quick start: from
npx rea-agents setupto letting the agent start investigating - Native binary analysis needs Hopper/Ghidra/IDA, but JS/Electron analysis doesn't need any native engine
Prerequisites
- A basic understanding of MCP (Model Context Protocol)
- Experience using an MCP-capable AI agent like Claude Code, Cursor, or Codex
- Familiarity with reverse-engineering terms (disassembly, pseudocode, symbol tables) helps but isn't required
Project Background
Overview
REA's core pitch is simple: see a feature in an app you want in your own product? Ask your agent to investigate it with REA. No source code required — the agent can inspect the app, explain how the feature works, show the evidence, and build a version for your project. REA itself isn't an "all-in-one reverse-engineering platform" — it wraps existing tools (Hopper, Ghidra, IDA, and more) into a standardized MCP interface so an agent can drive them. All analysis runs locally.
Author / Team
- Author: morluto
- Primary language: TypeScript
- License: MIT License
- Created: 2026-04-14 (roughly six months old at the time of writing)
- Status: Actively developed, with a healthy multi-contributor base and an active Discord community
Project Stats
- ⭐ GitHub Stars: 187,000+
- 🍴 Forks: 45,000+
- 📄 License: MIT
- 📅 Created: 2026-04-14
- 🔥 A Trendshift trending repository (trendshift.io/repositories/82054)
- 👥 Core contributors: author morluto leads with 1,389 commits, followed by N0zoM1z0 (504), kaoru0822-kitauji (407), and several other active contributors
- 🏷️ Topics: agent-skills, ai-agents, binary-analysis, claude-code, cli, codex, ctf, decompiler, disassembler, ghidra, hopper, llm, mcp, model-context-protocol, reverse-engineering, static-analysis
A note on the numbers: nearly 190,000 stars in six months is a striking figure. But the official Trendshift trending badge and a stable, multi-contributor commit history (rather than a single account inflating the count) both point to this being a genuinely popular project riding the "AI agent + reverse engineering" wave — not a fake-star repository.
Quick Start
Set Up Your Agent
With Node.js and npm installed, run:
npx rea-agents setupThe command lets you choose which agents to configure, shows you the proposed changes, and only writes them after you approve (with automatic backups of your existing config). Restart your agent afterward. REA currently supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and other agents out of the box.
Ask Your Agent
Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.Swap in the app you want to investigate and the feature you want to understand — the agent and REA take care of the rest.
Use the Terminal Directly
Inspect an extracted JavaScript/Electron app directory or ASAR archive:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --jsonThe result includes modules, imports, and Electron process boundaries, each with its evidence. For regular use, install globally:
npm install --global rea-agents
rea --helpNative binary analysis requires configuring an analysis provider first (Hopper, Ghidra, or IDA).
Core Deep-Dive: The Investigation Flow and the "Evidence + Limitations" Design
The Agent Calls REA Through MCP, and REA Returns Evidence-Backed Findings
REA's workflow is straightforward: your agent calls REA through MCP to inspect a target and trace relevant code. REA returns findings with their evidence, and the agent uses them to ask follow-up questions, explain the behavior, or write and test an implementation. CLI commands use the same underlying workflow, so you can also skip the agent entirely and run analysis commands, generate snapshots, or script things directly from the terminal.
The key design decision here: REA itself doesn't draw conclusions — it only provides evidence-backed analytical facts. The actual reasoning, explanation, and code generation is left to whatever agent is calling it. This division of labor keeps REA focused on a single responsibility, while giving the final results natural "auditability" — every conclusion the agent makes can be traced back to a specific disassembled line, string reference, or module dependency.
The Analysis Target List: This Project's Most Impressive Feature
REA's list of supported analysis targets is remarkably broad. The README includes a detailed table — here are some representative entries:
| Target | What REA returns | Requirements |
|---|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls | Hopper / Ghidra / IDA |
| Go binaries | Embedded compiler version, modules, build settings | Built-in static inspection, no Go install needed |
| EVM bytecode | Dispatch selectors, byte offsets, inferred arguments and mutability | Local offline analysis |
| JavaScript / Electron | Modules, imports, source maps, routes, IPC, native add-on relationships | Node.js and npm |
| Websites | Page structure, scripts, network observations, screenshots | A Chrome-family browser |
| .NET assemblies | Metadata, CIL instructions, declared native dependencies, build comparisons | Static only, no extra dependency |
| Android APKs | Manifest declarations, classes, decompiled methods, references | Headless JADX plus a full JDK |
| Firmware | Regions, extraction results, native-analysis handoffs | Binwalk / Unblob on Linux |
| Recorded network captures | Requests, responses, exposed payloads, source locations | HAR or Fiddler SAZ |
Static JavaScript and .NET inspection read the supplied files without ever running the application. Analysis involving runtime behavior — like interacting with websites, or capturing process behavior — actually runs or interacts with the target using your own user permissions, and each corresponding guide spells out exactly what effects to expect. This "static by default, runtime only when needed" layering means most lightweight analysis — like peeking at an Electron app's IPC structure — never has to touch runtime risk at all.
Pluggable Native Engines, No Engine Required for JS/.NET
REA doesn't reinvent decompilation — it reuses whatever Hopper, Ghidra, or IDA you already have installed. Setup can optionally install Hopper after your approval; Ghidra and IDA use your existing installations as-is. That's a pragmatic choice: building a decompilation engine is an enormously high-effort undertaking, and REA has no reason to duplicate that work. Its actual job is the integration problem — exposing those existing engines' capabilities to an agent. For scenarios that don't require binary decompilation at all — purely static JavaScript, .NET, or Flutter analysis — REA ships complete parsing capability out of the box, with no third-party engine dependency, meaning you can start using a meaningful chunk of its functionality even with zero reverse-engineering tooling installed.
Resources
- 🌟 GitHub: morluto/rea
- 🌐 Website: rea.tools
- 📖 Guides: rea.tools/guides
- 🎬 Showcases: rea.tools/showcase (including reconstructing DX-Ball's sound-pan calculation, tracing Notion's Electron clipboard bridge, and recovering TH04's DOS-era bullet-ring algorithm)
- 📦 npm: rea-agents
- 💬 Discord: discord.gg/GkcryMnJDM
- ⚠️ Disclaimer: See the project's DISCLAIMER.md, which scopes usage to lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine
Summary
REA makes a clear-eyed bet about "AI + reverse engineering": the specialized tooling for reverse engineering already exists; what's actually been missing is a layer that lets an AI agent drive those tools autonomously and organize the results into trustworthy evidence.
Three things worth noting:
Leaving "drawing conclusions" to the agent, while REA itself only supplies evidence-backed facts, is a disciplined and correct architectural split. Many AI analysis tools try to have the model directly state "here's what this code does," which invites hallucination and is hard to verify. REA insists on returning raw findings and their evidence chain, letting the agent reason on top of that — this design choice is itself a strong answer to the question of how AI-assisted reverse engineering should actually work.
The breadth of analysis targets — from websites and Electron apps to EVM bytecode, firmware, and Android devices — far exceeds what a typical reverse-engineering tool covers. This signals a deliberate strategy: build one MCP that covers as many reverse-engineering scenarios as possible, rather than specializing narrowly — which also explains why it attracts security researchers, CTF players, and product developers trying to understand a competitor's feature, all at once.
Nearly 190,000 stars and 45,000 forks in six months, backed by a genuinely multi-contributor ecosystem rather than inflated numbers, points to a real trend. When "using an AI agent to analyze closed-source software behavior" moves from a niche hacker trick into an engineering practice with a proper toolchain behind it, it can attract developers fast — a direction worth watching closely.
If you've ever been curious how some app's feature actually works under the hood but didn't want to learn disassembly from scratch, REA's agent-driven investigation path is worth trying for yourself.
Explore PrimeSkills — a curated marketplace of AI agents and skills, each validated against real enterprise workflows. No hype, just what actually works.
Visit my personal site for more insights and interesting products.