REA Explained: What the 370K-Star Reverse-Engineering Repo Actually Does

100 Days of AI That Actually Works · Day 1

REA (Reverse Engineer Anything) is an open-source MCP server that lets AI coding agents such as Claude Code, Codex and Cursor drive professional reverse-engineering tools. It passed 370,000 GitHub stars within about three months of its first npm release. The viral pitch is "clone any app." This guide covers what it actually does, where it creates real business value, and the security, cost and legal boundaries a technical leader should set before anyone installs it.

What REA is, and what it isn't

When a company ships software, you receive a compiled artifact: native machine code, bundled JavaScript or .NET intermediate language. Reverse engineers read that artifact back with tools like Ghidra (free, from the NSA), IDA and Hopper. It's slow, specialist work.

REA's README describes it as "One MCP for reverse engineering across binaries, applications, and runtime behavior." It packages that tooling as a Model Context Protocol (MCP) server and CLI, so a coding agent can call it directly. Setup currently targets Claude Code, Codex, Cursor, Gemini CLI and Grok Build, and other MCP clients can register it manually.

What it is not: a source-code recovery tool. InfoQ notes that REA "does not claim to recover original source code." You get reconstructed logic, decompiled pseudocode and traces, plus the evidence behind each conclusion.

How it works: agent → MCP → analysis engines

1. You ask a behavioural question in your agent: "How does this app preserve formatting when copying?"
2. The agent calls REA's tools over MCP to locate strings, functions, cross-references and call paths.
3. REA runs the analysis locally, using a native engine (Ghidra, IDA or Hopper) for compiled binaries, or its built-in static readers for JavaScript/Electron, .NET, Go, Rust, Godot, IL2CPP metadata, PyInstaller, Flutter APKs and more.
4. Findings come back with evidence: the functions, addresses and traces that support the explanation, so a human can check it.
5. Optionally, the agent uses those findings to write and test an equivalent implementation in your own project.

Install, per the official site: npx rea-agents@latest setup. Then approve the setup plan and restart your agent. Native analysis also needs an existing Ghidra, IDA or Hopper install, and Windows Ghidra support is labelled experimental.

What the official demos prove

The project's showcases are deliberately narrow and verifiable:

• Notion (Electron): tracing how copy preserves rich block data.
• DX-Ball (1996, native x86): recovering how ball position becomes left/right stereo pan. InfoQ reports the rebuild matched all 3,205 original test cases.
• Aegis (Android): why a one-time code changes every 30 seconds.
• Windows Calculator: why 200 + 10% returns 220.

The pattern matters: each demo answers one bounded question and checks it against ground truth. That's the right mental model for business use too. Viral claims of whole commercial games "rebuilt in 30 minutes" weren't traceable to a named source when we checked, so we've left them out.

Where it creates business value

• Legacy modernization: document what a business-critical binary actually does before you replace it, especially when the vendor or the original team is gone.
• Interoperability: understand an undocumented file format, protocol or integration you depend on.
• Vendor and security due diligence: check what a third-party component does with data, files or the network.
• Software preservation: keep tools running whose source is lost. Homeworld: Cataclysm, for example, was left out of its remaster because its source code was lost.

Five catches the hype skips

The legal line: studying vs copying

REA's own scope statement: "for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine." It grants no licence to commercial tools such as IDA, Hopper or JEB.

• India: Section 52(1)(ab) of the Copyright Act, 1957 permits acts necessary to obtain information essential for operating interoperability of an independently created program, by a lawful possessor, where that information isn't otherwise readily available. Courts haven't tested its full scope.
• EU: Article 6 of the Software Directive allows decompilation only where indispensable for interoperability, with tighter conditions.
• US: DMCA §1201 restricts circumventing technical protection measures, with specific exemptions.
• Licences: many EULAs prohibit reverse engineering outright. Read yours.

The working rule: studying behaviour to interoperate is usually defensible; copying someone's code or protected expression into your product is not. Get legal advice before commercial use.

A safe 60-minute evaluation plan

1. Isolate: create a disposable VM or container with its own home directory, because setup rewrites agent config files.
2. Verify the source: install rea-agents from npm and check it with npm audit signatures.
3. Dry-run setup first, review the planned changes, then apply them.
4. Pick a known target: an internal tool or a program you wrote and compiled yourself, where you already know the right answer.
5. Ask one bounded question and score the agent's explanation against ground truth: correct, partially correct or wrong, and was the evidence relevant?
6. Record cost: time, tokens and context size. Decide whether it beats your current process.

Decision checklist

• ☐ We legally possess, own or are authorized to examine the target.
• ☐ The purpose is interoperability, security, preservation or understanding, not copying.
• ☐ We're allowed to send findings about this target to our model provider.
• ☐ Analysis runs in an isolated environment.
• ☐ Install comes from the official repo or npm package only.
• ☐ Outputs are verified with tests before anyone relies on them.

FAQ

Is REA free?

REA is MIT-licensed and Ghidra is free. IDA, Hopper and JEB are commercial, and your coding agent or model subscription costs money.

Does it work on Windows?

There's a Windows (PowerShell) setup path, but Windows Ghidra support is labelled experimental, and some format readers are Linux-only.

Can it bypass obfuscation or licence checks?

Don't use it for that. Circumventing protection can be illegal, and heavily obfuscated code is far harder for any tool.

Get the full Day 1 guide (PDF)

The PDF expands this article with a setup walkthrough, prompt templates for bounded questions, an evaluation scorecard and the full checklist. Download the free PDF field guide. If you're planning legacy modernization or AI-agent workflows, talk to Zeblio.

Sources

• REA, official GitHub repository (README)
• rea.tools, official site and demos
• InfoQ: Reverse Engineer Anything Project Brings AI Agents to Binary Analysis (17 Oct 2026)
• DEV Community: REA tested with Ghidra and Electron (21 Oct 2026)
• SpicyIP: Is decompilation of software legal under the Indian Copyright Act?
• Homeworld series, Wikipedia

Watch this episode

• Instagram Reel: Day 1, REA
• YouTube Shorts: Day 1, REA
• LinkedIn: what leaders should weigh before using REA
• X thread: REA in 5 posts
• Threads post
• Facebook video