AI Reads Inside Programs: Agent Tool Design That 'Returns Evidence' with REA (Reverse Engineer Anything) and the Lines That Must Not Be Crossed

About this case

This week's #1 GitHub trending, REA (Reverse Engineer Anything), received 25,000 stars in a single day. It is an MCP server that lets coding agents read executables, Electron apps, .NET, Android apps, and websites without source code and explain their behavior. This video looks at three things, not usage. The Evidence record that separates and returns 'what was seen, what was inferred, what is unknown' for each result, and the MCP contract design that prevents agents from overstepping. AI decompilation and vibe-coding game clones that poured out the same week and publishers' responses. And now that the cost of reading inside programs has dropped, how we should view code handed over to user devices.

Topics covered

• REA: #1 GitHub trending (★25,784 in a day), 647 points on Hacker News
• Reverse engineering MCP server: connects to Claude Code and Codex, Ghidra/IDA/Hopper engines, analysis is local
• Observation is the tool, interpretation is the model
• Showcases: Chrome dinosaur game speed rule (6 → +0.001 → 13), Windows calculator % button, DX-Ball 3,205 cases
• Design ①: Evidence record — separates and records observations, inferences, and unresolved questions
• Design ②: Availability contract — configured ≠ supported, in progress ≠ ready, timed out ≠ stopped
• Other faces of the same week: Fallout-like browser game shutdown, Modern Warfare 2 decompilation video copyright strike
• Three questions before writing: permission · original assets · distribution
• Defensive perspective: API keys in apps, production source maps, client-side checks — checks and secrets belong on the server
• Three things our team will take away

Chapters 00:00 #1 GitHub trending REA 00:34 Reverse engineering MCP server for agents 01:19 Observation is the tool, interpretation is the model 01:48 Showcase: Chrome dinosaur game 02:11 Showcase: calculator % button 02:49 Design ①: Don't just return conclusions 03:26 Design ②: Promises that prevent overstepping 04:05 AI-made game clones 04:43 The line of permission and legal compliance 05:19 Code handed over to user devices is not a secret 05:57 Three things our team will take away 06:31 Summary

References

• REA official site: https://rea.tools/
• REA repository: https://github.com/morluto/rea
• MCP contract docs: https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md
• CLI and Evidence: https://github.com/morluto/rea/blob/main/docs/cli.md
• Kotaku, Activision/Bethesda response: https://kotaku.com/activision-and-bethesda-crackdown-on-genai-mw2-and-fallout-projects-2000739580
• OWASP Secrets Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

Channel: AI-Native Software Engineer https://www.youtube.com/channel/UCQBZdu2hpBHGY5rjBN4xk7Q

※ This video is summary content whose script, voice, and animation were created by AI based on public original sources (official site, repository docs, press). It is not an official video of the mentioned companies or projects; please check the originals for accurate content. The showcase numbers are REA's own demonstrations and not legal advice. Only reverse engineer targets whose permissions and licenses you have confirmed.