Reverse Engineer Anything (REA)
REA — short for Reverse Engineer Anything — is an open-source tool that connects AI coding agents to reverse-engineering tools, so the agent can work out how a piece of software behaves without its source code. It hit the top of GitHub trending in early October 2026.
- What: a local MCP server plus CLI. Tagline: “Reverse engineer anything with agents, from app behavior down to native binaries.”
- Install:
npx rea-agents setup(needs Node.js 22.19+, 24.11+ or 26+). - Works with: Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other MCP-capable clients.
- Targets: native binaries, JavaScript/Electron apps, .NET assemblies, websites, Android APKs, firmware and more.
- Needs for native code: an existing Ghidra, IDA or Hopper install. Static JavaScript and .NET analysis needs no native engine.
- License: MIT. Intended for lawful research, education, interoperability and software you are authorized to examine.
What does REA actually do?
REA does not replace a disassembler. As Cyber Security News puts it, “REA acts as a bridge between the agent and analysis tools.” It runs a local Model Context Protocol (MCP) server; your agent asks it for analysis, follows the relevant code, and gets back findings that come with evidence, limitations and unknowns. The agent can then ask follow-up questions or write and test its own implementation.
The README’s example prompt shows the intended workflow:
Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.
Analysis runs locally on your machine. Note, however, that the results are handed to your agent, so they are subject to your model provider’s data policy.
Quick start
- Check Node.js
You need Node.js 22.x (22.19 or newer), 24.x (24.11 or newer) or 26+, with npm. - Run setup
npx rea-agents setup— choose your agents, review the changes and approve. Setup registers the MCP server, installs workflow instructions and backs up your existing configuration. - Restart your agent
Restart Claude Code, Cursor, Codex or whichever client you registered. - Ask a question about a target
Point the agent at an app you are authorized to examine and one specific feature. Full walkthrough on the install page.
What REA can analyze
| Target | What you get | Extra requirement |
|---|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls, references | Hopper, Ghidra or IDA |
| JavaScript / Electron apps | Modules, imports, source maps, routes, IPC, native add-on relationships | None for static analysis |
| .NET assemblies | Metadata, CIL instructions, native dependencies, build comparisons (static only) | None |
| Websites | Page structure, scripts, network observations, screenshots | A Chrome-family browser |
| Android APKs / devices | App code and resources | JADX and a JDK, or adb |
| Firmware | Unpacked contents | Binwalk / Unblob (Linux) |
| Packet captures | Recorded traffic | TShark |
From the project README, which also lists Go binaries, WASM, EVM bytecode, SQLite databases, Flutter apps, JEB projects and saved network captures (HAR, Fiddler SAZ). See supported targets and backends.
Guides
FAQ
What does REA stand for?
Reverse Engineer Anything. The npm package is called rea-agents and the repository is morluto/rea on GitHub.
Is REA free?
Yes, it is open source under the MIT license. Some backends it can drive, such as IDA Pro, Hopper and JEB, are commercial tools you must license yourself.
Does reverse engineering with an AI agent actually work?
On narrow, testable features, the project reports strong results — for example a DX-Ball sound-pan calculation that passes 3,205 original-x86 cases. Cyber Security News cautions that “these are project-reported demonstrations, not proof that every target can be fully reconstructed.”
Is it illegal to reverse engineer something?
It depends on your jurisdiction, the software’s license and what you do with the result. The REA README limits intended use to lawful research, education, interoperability, software preservation and software you own or are authorized to examine. See legal and safety. This is not legal advice.
Can I use REA online, without installing?
No. REA is a local tool: it runs on your machine and talks to your agent over MCP. There is no official hosted version.
Does REA need Ghidra or IDA Pro?
Only for deep native-binary analysis. Static JavaScript/Electron and .NET analysis work without any native engine.
Does my code get uploaded?
REA analyzes targets locally, but the findings are passed to your AI agent and are therefore covered by that model provider’s data policy.
What is the latest REA version?
A Kingy AI write-up noted 6.4.0 as the latest release on GitHub and npm as of October 13, 2026. Run rea update or npx rea-agents@latest setup to stay current.
Sources
- morluto/rea README (official)
- Cyber Security News — REA Tool Connects Claude Code and Cursor to Ghidra and IDA Pro (Oct 10, 2026)
- Kingy AI — Reverse Engineer Anything with AI: REA Tested
- International Cyber Digest on X — “number ONE trending repo on GitHub”
Unofficial, independent guide. Not affiliated with the REA project or its author (morluto). The official source is github.com/morluto/rea. Only analyze software you own or are authorized to examine.