How to use REA with Claude Code

REA plugs into Claude Code as a local MCP server. Once it’s registered, Claude can open a binary, an Electron app or a website, trace the code behind a feature and answer with the evidence — addresses, source ranges, call paths — instead of a guess. Setup takes one command and a restart.

Requirements

• Node.js 22.x (≥ 22.19), 24.x (≥ 24.11) or 26+, plus the npm that ships with it. Node 23 and 25 are not supported.
• Claude Code, installed and signed in.
• Optional: Hopper, Ghidra 12.1.x or IDA for native binaries. JavaScript, Electron and .NET analysis need no engine at all.

1. Run setup

In any terminal:

npx rea-agents@latest setup

Setup detects your agents and shows a plan before it touches anything. Pick Claude Code, review the exact paths and approve. Declining or pressing Ctrl-C changes nothing; existing configuration is backed up and unrelated MCP servers are preserved. For Claude Code, setup writes two things:

• an mcpServers.rea entry in ~/.claude.json, pinned to the exact version that ran setup — e.g. npx -y [email protected] mcp;
• REA’s workflow skill in ~/.claude/skills, which teaches Claude how to run an investigation.

Prefer to see the plan without the interactive prompts? Scope it to Claude Code and do a dry run first:

npx -y rea-agents@latest setup --client claude_code --dry-run --json
npx -y rea-agents@latest setup --client claude_code --yes --json

Restart Claude Code afterwards — a running session doesn’t pick up new MCP servers.

2. Verify the connection

rea doctor is strictly read-only. Scoped to one client, its healthy value only depends on that registration:

npx -y rea-agents@latest doctor --client claude_code --json

A working setup returns something like this (trimmed from a real run):

{
  "healthy": true,
  "scope": { "mode": "explicit", "clients": ["claude_code"] },
  "scope_checks": [
    { "name": "node", "ok": true, "detail": "22.22.3" },
    { "name": "registration:claude_code", "ok": true, "detail": "/Users/you/.claude.json" }
  ]
}

Doctor checks files and prerequisites, not the live connection. Inside Claude Code, run /mcp to confirm the rea server is connected and its tools are listed.

3. Your first prompt

Ask in plain language and name the target. Include an absolute path for local apps:

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

Want a target that needs no native engine? Download the notes-example Electron app from rea.tools and ask:

Use REA to find what happens when I export notes in /absolute/path/to/notes-example. Where is the CSV created?

Claude should call analyze_javascript_application, find the notes:export IPC channel and its single handler, and point you to the file that writes notes.csv. The Electron guide walks through the same example by hand.

Add a native engine

For executables and libraries REA drives an existing disassembler. Setup can install Hopper with your approval; Ghidra and IDA use installations you already have. For Ghidra 12.1.x with a JDK 21+:

export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
export JAVA_HOME=/absolute/path/to/jdk-21   # optional if java is on PATH
npx -y rea-agents@latest doctor --provider ghidra --json

If several engines are available, choose one with --provider on the CLI or ask Claude to pass provider_id when it opens the binary. On macOS, Hopper may show a first-run demo/license dialog — complete it once before your first analysis.

Manual registration

Setup is the recommended path because it also installs the skill and keeps the registration pinned. If you only want the MCP server, Claude Code’s own CLI works — pin the version you tested:

claude mcp add --scope user rea -- npx -y [email protected] mcp

REA is also listed in the official MCP Registry as io.github.morluto/rea. Without the skill, Claude has the tools but not REA’s investigation workflow; add it with npx skills add morluto/rea --skill reverse-engineer-anything.

Troubleshooting

The REA tools don’t show up

Restart Claude Code, then run the doctor command above. If the registration is reported as drifted or missing, rerun setup for claude_code and restart again.

Context fills up immediately with a third-party model endpoint

Claude Code normally defers MCP tool definitions through tool search. When ANTHROPIC_BASE_URL points to a non-first-party host, it turns that off and sends every REA tool schema with every request — the REA docs measured about 496 KB of definitions with the default profile and about 290 KB with the compact one. Add "REA_MCP_INPUT_SCHEMA_PROFILE": "compact" to the env object of mcpServers.rea in ~/.claude.json and restart. Setup keeps that override.

Does my app get uploaded?

No. REA analyzes targets locally. Claude receives the tool results, and your model provider’s data policy applies to those.

Update & uninstall

REA releases often. Rerun setup with @latest to move the pinned registration forward, then restart Claude Code. With a global install (npm install --global rea-agents), use rea update.

npx rea-agents@latest setup

# global install only
rea update
rea uninstall              # removes REA's registrations and skill files
rea uninstall --purge-data # also removes ~/.rea cache and state

Uninstall leaves Hopper, Node.js, your evidence files and other MCP servers untouched. Ready for a real target? Browse projects built with REA for prompts and approaches that worked.