REA: Reverse Engineer Anything with Agents

One MCP server that lets an AI agent investigate native binaries, Electron and JavaScript apps, .NET assemblies, Android packages, websites and more, and report back with evidence.

1. What REA is

REA stands for “Reverse Engineer Anything.” It is an open-source project (MIT licensed) that connects an AI coding agent to a collection of analysis tools through the Model Context Protocol (MCP). Instead of you manually opening a disassembler, searching strings and following call chains, your agent does the legwork and REA supplies the tools and the structure.

The project’s promise is simple: see a feature you like, understand how it works down to the binary level. Analysis runs locally on your machine. The agent receives tool results, and the model provider you use has its own data policy, which is worth remembering when you pick targets.

2. The investigation flow

Every REA investigation follows the same loop. Your agent asks a question about a local target. REA inspects and traces the target using the right analysis tool. The findings return as code, references and a list of unknowns. The agent then explains the behavior, implements it, and tests the result.

Why unknowns matter

A good reverse-engineering report separates what is known from what is guessed. REA’s results include limitations and unknowns so the agent does not present a plausible story as fact. When something is missing, the agent can run another probe instead of inventing an answer.

3. Quick start

You need Node.js and npm. REA requires Node.js 22.x (22.19 or newer), 24.x (24.11 or newer), or 26 and above.

1. Run setup. This registers REA’s MCP server with your agent and installs matching workflow instructions.

   npx rea-agents setup

2. Review and approve. Choose your agents and read the proposed changes. Setup keeps backups of existing configuration.
3. Restart your agent so it picks up the new server.
4. Ask a question.

   Understand how search works in the Notes app,
   show me the evidence, and build a similar
   feature for my project.

Setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents. Any agent that supports local MCP servers can use REA through manual registration.

Using the terminal

To inspect an extracted JavaScript or Electron app directory, or an ASAR archive:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

The result lists modules, imports, Electron boundaries and the evidence for each. To install the rea command permanently:

npm install --global rea-agents
rea --help

Keeping it updated

REA changes quickly, with frequent fixes. For a global install run rea update. If you use npx, run npx rea-agents@latest setup and restart your agent. Bun global updates need Bun 1.2.17 or later.

4. What you can analyze

REA covers a wide range of targets. Some need nothing beyond Node.js, others need a provider such as Hopper, Ghidra or IDA. Swipe the tables sideways on small screens.

Built-in, no extra tool needed

Needs a caller-supplied tool

There are further specialist lanes too: offline ELF layout, EVM bytecode, recorded Linux crashes, JEB projects, Android resources through Apktool, and recorded logic signals through sigrok. Each has its own guide in the project documentation.

5. Choosing the right analysis path

Static versus runtime

Static JavaScript and .NET inspection read the supplied files without running the application. Runtime capture, by contrast, runs or interacts with the target using your user permissions. Each runtime guide describes its effects, so read it before pointing REA at something you do not trust.

6. Providers for native analysis

For deep native work REA drives an existing reverse-engineering suite rather than replacing it.

For large binaries, raise the startup deadline with REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.

7. Showcases

These examples show the range: a 16-bit DOS-era game, an old x86 Windows title and a modern Electron app, all through the same evidence-driven workflow.

The Electron trace, step by step

8. A sample investigation, end to end

Here is how a typical request unfolds when you ask an agent to understand a feature in an installed app. The exact tools vary by target, but the shape stays the same.

Tips for better questions

Name the target and the one behavior you care about. “How does search work in the Notes app?” gives the agent a clear starting point, while “explain this app” does not. Ask for the evidence explicitly, and ask what is still unknown. If the answer cites a code location, ask the agent to show it so you can check it yourself.

9. Troubleshooting and good habits

Good habits

Keep REA current, because releases arrive often. Start with static analysis when you can, since it never runs the target. Treat runtime capture as running software with your own permissions. Save the evidence your agent cites, so you can reproduce a finding later. Remember that your agent’s model provider sees tool results, so avoid sensitive material you would not share with it.

10. Mini glossary

11. FAQ

12. Responsible use and licensing

REA is intended for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine. The project’s disclaimer covers all versions and channels.

REA’s own code is MIT licensed, and third-party material keeps its own licenses. Commercial tools such as IDA Pro, Hopper and JEB must be legally obtained and used under their licenses. REA grants no keys or activation, and cracked copies or bypassing license limits are not authorized.

13. Summary