What is REA?ReverseEngineerAnything.
REA is the open-source MCP that hands your AI coding agent a disassembler, a decompiler and a runtime observer — so it can take any app apart, explain how a feature works down to the binary, and rebuild it for you.
npx rea-agents@latest setup› Why does 200 + 10% give 220?
0x180124945 MOVEAX, dword ptr [R13 + 0x18]
0x180124949 CMPEAX, 0x5c
0x18012494c JZ0x180124aba
0x180124952 CMPEAX, 0x5b
0x180124955 JZ0x180124aba
0x18012495b MOVEDX, 0x64
0x180124960 LEARCX, [RSP + 0x160]
0x180124968 CALL0x180122650
0x180124992 CALL0x180123190
0x180124a34 CALL0x180123c10
↓ evidence → readable rule
// recovered % handler if (op == MUL || op == DIV) pct = cur / 100; else pct = cur * prev / 100; // 200 + 20 = 220
- GitHub stars
- 126k
- forks
- 28k
- npm downloads / week
- 74k
- latest npm release
- v6.4.0
Live figures from GitHub and npm, refreshed every six hours.
REA, defined
REA (Reverse Engineer Anything) is an MIT-licensed Model Context Protocol server and CLI that lets AI agents inspect native binaries, JavaScript & Electron apps, .NET assemblies, Android APKs, firmware and live websites — locally, without source code — and return every finding with its evidence.
One MCP, every target. Binaries, apps and runtime behavior share one tool surface instead of one bridge per disassembler.
Evidence, not vibes. Results carry addresses, instructions, digests, coverage and explicit unknowns.
Runs on your machine. REA analyzes targets locally. Open source since April 2026; installs with one command.
How REA works
From “how does that work?” to working code.
Your coding agent
- Claude Code
- Codex
- Cursor
- Gemini CLI
- Grok Build
- any MCP client
MCP server · CLI
REA
Analysis engines
- Hopper
- Ghidra
- IDA Pro
- JADX
- JEB
- Chrome DevTools
- 01
You ask
Describe the feature you want to understand — in plain English, inside the coding agent you already use.
- 02
REA inspects
Your agent calls REA over MCP. REA drives Hopper, Ghidra, IDA, a browser or a static parser and traces the relevant code.
- 03
Evidence comes back
Every result carries its evidence, coverage and known unknowns — addresses, instructions, file digests, call paths.
- 04
Your agent builds
With real findings instead of guesses, the agent explains the behavior, writes an implementation and tests it against the original.
What REA can reverse engineer
“Anything” is not a figure of speech.
Native binaries
Pseudocode, assembly, strings, symbols, calls and cross-references.
needs · Hopper, Ghidra or IDA
JavaScript & Electron
Modules, imports, source maps, routes, IPC and native add-ons.
needs · Node.js only
Websites
Page structure, loaded scripts, network observations and screenshots.
needs · A Chrome-family browser
Android APKs & devices
Manifest, classes, decompiled methods, logs, packages and screen captures.
needs · JADX / adb
.NET assemblies
Metadata, CIL instructions, native dependencies and build diffs.
needs · Nothing — static only
Firmware
Regions, extraction results and handoffs into native analysis.
needs · Binwalk / Unblob
Go binaries
Compiler version, modules, replacements and build settings.
needs · Built in · main branch
WebAssembly
Validation, sections, import/export WAT forms and decoded WAT.
needs · WABT · main branch
EVM bytecode
Dispatch selectors, byte offsets, inferred arguments, mutability.
needs · Offline, Linux x64
Network captures
Requests, responses, exposed payloads and source locations.
needs · HAR / mitmproxy
Recorded crashes
Thread registers, signals and mapping candidates from core dumps.
needs · pwntools, optional GDB
Process behavior
Terminal output, interactions, filesystem effects, run diffs.
needs · Linux / macOS PTY
Before REA · you, alone
Decode branches. Trace calls. Recover the rule.
Hours in a disassembler, looking up command IDs, guessing which CALL 0x180123190 divides — then rewriting it all by hand.
- 0x5b? 0x5c? → look up operator IDs
- 0x64 → that's 100, but which input?
- …123190 → step through, rename, repeat
With REA · you ask
One prompt. The rule, with receipts.
› Use REA to inspect Windows Calculator. Why does 200 + 10% give 220?
After +, the % button takes a percentage of the first number:
10% of 200 = 20 → 200 + 20 = 220
Example from rea.tools, verified against Microsoft's public Calculator source.
Things to ask your agent
See a feature you like? Ask how it works.
- ›Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.
- ›Use REA to inspect Windows Calculator. Why does 200 + 10% give 220?
- ›Use REA to inspect this dinosaur game. Why does it get faster? Build a version with adjustable speed.
- ›Use REA to reconstruct this game from its executable. Recover the gameplay logic in C and test it against the original.
Real investigations
Checked against the original, not “close enough”.
DX-Ball: rebuild a sound-pan calculation
Follow a sound call into its position-to-pan helper and turn incomplete pseudocode into C that passes 3,205 original-x86 cases and reproduces all 63 compiled bytes.
Read the case study Electron · IPCNotion: trace the clipboard bridge
Find the renderer's clipboard API, follow it through preload and IPC into the main process, and inspect the rich clipboard format.
Read the case study DOS · 16-bitTH04: recover a bullet-ring calculation
Inspect a PC-98 game's 16-bit instructions, recover the fixed and aimed angle math, and compare reconstructed C++ to the historical compiler output.
Read the case studyLearn REA
Guides with commands that actually run.
Built with REA
What people are taking apart.
dx-ball
WH3SaveEditor
OpenBSD_netcat_REA
vitals-clone
rea-practice
Driveindex
rea-ski-or-die-reconstruction
REA-ZWO
What is REA?
+
REA — short for Reverse Engineer Anything — is an open-source MCP server and CLI that gives AI coding agents real reverse-engineering tools. It lets an agent inspect native binaries, JavaScript and Electron apps, .NET assemblies, Android apps, firmware and live websites, then explain how a feature works with evidence attached.
What does REA stand for?
+
REA stands for “Reverse Engineer Anything”. The project's tagline is “See a feature you like. Understand how it works, down to the binary level.”
How do I install REA?
+
With Node.js 22.19+ (or 24.11+) and npm installed, run `npx rea-agents@latest setup`. Choose your agents, approve the proposed changes and restart your agent. Setup registers REA's MCP server and installs matching workflow instructions, backing up your existing config.
Which AI agents work with REA?
+
Any agent that supports local MCP servers. Setup configures Claude Code, Codex, Cursor, Gemini CLI, Grok Build and others automatically; other clients can register the MCP server manually.
Do I need Ghidra, Hopper or IDA?
+
Only for deep native analysis. REA can drive an existing Hopper, Ghidra or IDA install, and setup can optionally install Hopper with your approval. Static JavaScript, Electron and .NET analysis need no native engine at all.
Does REA upload my app or binary?
+
No. REA analyzes targets locally. Your agent receives the tool results, and the agent's model provider applies its own data policy.
Is REA free?
+
Yes. REA's own code is MIT-licensed. Commercial tools it can drive — IDA Pro, Hopper, JEB — still require your own legitimate licenses.
Is reverse engineering with REA legal?
+
REA is intended for lawful research, education, interoperability, software preservation and analysis of software you own or are authorized to examine. Laws differ by country and license terms still apply — check before you dig into someone else's software.
How is REA different from GhidraMCP?
+
GhidraMCP is a focused bridge into a running Ghidra project and can rename things there. REA is one MCP across many targets — binaries via Hopper, Ghidra or IDA, plus Electron, websites, .NET, Android and firmware — and every result returns evidence, coverage and limitations. Our REA vs GhidraMCP guide compares them in detail.
Where can I find projects built with REA?
+
Right here. REAdirectory is a community directory of open-source projects reverse-engineered with REA — browse them by category, or submit your own GitHub repo.
Reverse engineer anything.
Install REA, ask your agent a question, then share what you found with the community.
npx rea-agents@latest setupREA is meant for lawful research, education, interoperability, preservation and software you own or are authorized to examine. Commercial tools (IDA Pro, Hopper, JEB) need your own licenses. REAdirectory is a community project, not affiliated with REA.