REA

Open source project by morluto (morluto/rea, MIT).

Why use it?

Understanding how a program works without its source code takes reverse engineering tools, and each kind of target has its own: Ghidra, Hopper or IDA for native binaries, the extracted bundle for an Electron app, a browser for a website. A coding agent can’t drive those tools by itself.

REA puts them behind one MCP. Your agent calls REA through MCP to inspect the target and trace relevant code. REA returns findings with their evidence, and the agent uses them to ask follow-up questions, explain the behavior, or write and test an implementation. CLI commands use the same workflows.

What you can do with it

The showcases on the REA website are worked examples:

• DX-Ball: reconstruct a sound-pan calculation — Follow a sound call into its position-to-pan helper, inspect the instructions, and turn incomplete pseudocode into C. The reconstruction passes 3,205 original-x86 cases and reproduces all 63 compiled function bytes.
• Notion: trace the Electron clipboard bridge — Find the renderer’s clipboard API, follow it through preload and IPC into the main process, and inspect the rich clipboard format.
• TH04: recover a DOS bullet-ring calculation — Inspect the original PC-98 game’s 16-bit instructions, recover the fixed and aimed angle calculations, and compare the reconstructed C++ with the historical compiler output.

Some of the targets from the README’s “What you can analyze” table (see the README for the full list):

Key features

• Evidence and limitations with every result

  Results include the evidence and limitations behind each conclusion. The agent gets the returned code, references and unknowns to explain, implement and test.

• Your choice of native analysis engine

  Native analysis can use an existing Hopper, Ghidra, or IDA installation; setup can optionally install Hopper with approval. REA starts Hopper when an operation needs it.

• Static inspection and runtime capture are separate

  Static JavaScript and .NET inspection read the supplied files without running the application. Runtime capture runs or interacts with the selected target using your user permissions; each runtime guide describes its effects.

• MCP and CLI share the same workflows

  You can use the same tools from your terminal, with JSON output for scripting.

• Setup previews changes and keeps backups

  Setup previews configuration changes and asks for approval before applying them. Agent configuration writes preserve unrelated entries and comments and create backups.

How to use

REA requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, plus npm. Run:

npx rea-agents setup

Choose your agents, review the proposed changes, and approve them. Setup adds REA’s MCP server and matching workflow instructions. Restart your agent afterward.

Then ask your agent. The README’s example prompt:

Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.

From the terminal, inspect an extracted JavaScript/Electron app directory or ASAR:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

The result includes modules, imports, Electron boundaries and their evidence. To install the rea command for regular use, run npm install --global rea-agents.

To remove it, rea uninstall removes only REA-owned agent registrations and skill files.

Notes

• Use it only on targets you’re authorized to examine — Per DISCLAIMER.md, REA is built for lawful analysis of software you own or are authorized to examine. The project does not support circumventing DRM, license checks or anti-cheat systems, developing game cheats, or copying proprietary software. Reverse engineering may be restricted in your jurisdiction or by the license of the software you analyze, and you are responsible for obtaining any required authorization.
• Not a sandbox — Per SECURITY.md, opening an untrusted binary delegates parsing and analysis to the selected local provider with your user’s permissions, and runtime capture runs the target. Use an appropriate environment for untrusted targets.
• Local analysis — REA analyzes targets locally. Your agent receives the tool results, and its model provider has its own data policy.
• Commercial tool licenses are separate — You must legally obtain and be authorized to use commercial tools, including IDA Pro, Hopper, and JEB. REA grants no tool license, key, or activation entitlement.
• It changes quickly — “REA changes quickly, and new releases include frequent bug fixes.” Update a global install with rea update, or run npx rea-agents@latest setup, then restart your agent.
• Skill-only installation — npx skills add morluto/rea --skill reverse-engineer-anything installs agent instructions and bundled references, not REA MCP registration or analysis engines.
• Host support varies by target — Some targets need specific hosts and tools; firmware, packet captures and recorded crashes, for example, require Linux plus caller-supplied tools. Check the README table for each target.
• Source — morluto/rea (MIT). Guides: rea.tools/guides.