REA (Reverse Engineer Anything): How Agents Decompile and Rebuild Apps

What Is REA (Reverse Engineer Anything)?

REA, short for Reverse Engineer Anything, is an open-source MCP server and command-line tool that gives AI coding agent’s real reverse-engineering abilities. Rather than guessing how an app works, your agent can decompile a binary, trace the relevant code, and report its findings with the evidence behind each one. It can then writes and test a similar feature for your own project.

REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs, and websites. It uses the Model Context Protocol (MCP), so the agent requests analysis from a local server and gets back structured results that include their stated limits.

Quick facts

• License and language: MIT-licensed and written in TypeScript, published on npm as rea-agents
• Runs locally by default: analysis happens on your machine
• Evidence-first: every conclusion comes with its supporting evidence and limitations
• Popularity: reported as trending #1 on GitHub in October 2026, with 125k+ stars at the time of writing

How REA Works: Decompile, Understand, Recreate

REA sits between your AI agent and a set of established reverse engineering tools. The workflow has three steps:

1. Decompile: point your agent at an app and ask how a feature works. REA decompiles the binary.
2. Understand: the agent follows the code between functions and references, then explains the logic with evidence.
3. Recreate: the agent builds and tests a similar feature in your own project.

Reverse engineering normally means juggling several specialized tools, such as Ghidra for decompilation, Hopper for disassembly, and dynamic tracers for runtime behavior. Each has its own CLI, API, and session handling. REA routes requests to the right tool (Ghidra, Hopper, IDA Pro, or Chrome DevTools for web and Electron-style apps) through one MCP server, so the agent doesn’t need to operate each tool separately.

If you prefer scripting to agents, the same workflows are available from your terminal.

What Can You Analyze With REA?

According to the project’s capability table, REA supports:

• Native binaries: pseudocode, assembly, strings, symbols, calls, and references (via Hopper, Ghidra, or IDA)
• JavaScript and Electron apps: modules, imports, source maps, routes, IPC, and native add-on relationships, inspected statically without running the app
• .NET assemblies: metadata, CIL instructions, and declared native dependencies (static analysis only)
• Android APKs: manifest declarations, classes, decompiled methods, and references (via headless JADX and a JDK)
• Websites: page structure, scripts, network observations, and screenshots (via a Chrome-family browser)
• Other targets: WASM, EVM bytecode, Go binaries, firmware, saved network captures, and recorded Linux crashes

One design choice matters here. Static analysis of JavaScript and .NET reads files without executing them. Runtime capture runs or interacts with the target using your permissions. Native analysis depends on the provider you install, so supported formats and host systems vary.

How to Install and Set Up REA

You need a supported version of Node.js and npm. Then run:

bash

npx rea-agents setup

The setup wizard lets you choose your agents, review the proposed changes, and approve them. It adds the REA MCP server and matching workflow instructions, backs up your existing configuration, and then asks you to restart your agent.

Supported AI coding agents include Claude Code, Cursor, Codex, Gemini CLI, and Grok Build. Any other client that supports local MCP servers can use manual registration.

For deep native analysis, you’ll need a provider: an existing Hopper, Ghidra, or IDA installation. Static JavaScript analysis needs no native engine, and setup can optionally install Hopper with your approval.

Once it’s connected, you just ask in plain language, for example: “Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.”

Is Using REA Legal?

Reverse engineering sits in a nuanced legal area, and REA states it is built for lawful use: research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine. Commercial engines such as IDA Pro, Hopper, and JEB must be obtained under their own licenses, since REA grants no tool license or activation.

Check the relevant license terms and local laws before pointing an agent at software you don’t own.

Why REA Matters for AI Workflows

REA is part of a wider shift toward giving AI agents real tools and verifiable output instead of asking a model to reason from memory. The same idea drives agent runtimes like DeepSeek Harness and developer tools like Cursor Origin.

The “show the evidence” approach is the standout feature. An agent that can cite the exact function, byte offset, or IPC call behind a claim is far more trustworthy than one summarizing a binary from guesswork.

Build Your Own AI Workforce

If you want agents that act with tools rather than guess, look at Eigent, an open-source, local multi-agent workforce that handles tasks like code and pull request review, research, and multi-step workflow automation on your own machine.

Frequently Asked Questions

What does REA stand for?
Reverse Engineer Anything.

Is REA free?
Yes. It’s open source under the MIT license, though commercial providers like IDA Pro and Hopper require their own licenses.

Which AI agents work with REA?
Claude Code, Cursor, Codex, Gemini CLI, and Grok Build, plus any MCP-compatible client through manual setup.

Does REA need Ghidra, Hopper, or IDA?
Only for native binary analysis. Static JavaScript and .NET analysis work without a native engine.

Does REA run in the cloud?
No. Analysis runs locally by default.