---
title: "AI Reads Inside Programs: Agent Tool Design That 'Returns Evidence' with REA (Reverse Engineer Anything) and the Lines That Must Not Be Crossed"
url: "https://reamcp.dev/en/cases/ai-rea-reverse-engineer-anything-60f2e2"
source: "https://www.youtube.com/watch?v=UdoqqS5H164"
source_type: "resource"
author: "AI-Native Software Engineer"
author_handle: "ai-nativesoftwareengineer"
stars: 0
category: "Tools & integrations"
categories: ["tools-integrations"]
tags: ["agent-tools", "evidence-records", "ghidra", "mcp", "reverse-engineering"]
added: "2026-10-13T04:19:29.036Z"
updated: "2026-10-13T04:19:29.036Z"
locale: "en"
content_locale: "en"
---

# AI Reads Inside Programs: Agent Tool Design That 'Returns Evidence' with REA (Reverse Engineer Anything) and the Lines That Must Not Be Crossed

Introducing the REA (Reverse Engineer Anything) MCP server, and explaining the Evidence record that separates and returns 'what was seen, what was inferred, what is unknown', and the MCP contract design that prevents agents from overstepping. Along with showcases like the Chrome dinosaur game, calculator % button, and DX-Ball, it covers the lines of permission, assets, and distribution to observe when reverse engineering, and the defensive perspective (secrets belong on the server).

## Description

This week's #1 GitHub trending, REA (Reverse Engineer Anything), received 25,000 stars in a single day. It is an MCP server that lets coding agents read executables, Electron apps, .NET, Android apps, and websites without source code and explain their behavior. This video looks at three things, not usage. The Evidence record that separates and returns 'what was seen, what was inferred, what is unknown' for each result, and the MCP contract design that prevents agents from overstepping. AI decompilation and vibe-coding game clones that poured out the same week and publishers' responses. And now that the cost of reading inside programs has dropped, how we should view code handed over to user devices.

Topics covered
- REA: #1 GitHub trending (★25,784 in a day), 647 points on Hacker News
- Reverse engineering MCP server: connects to Claude Code and Codex, Ghidra/IDA/Hopper engines, analysis is local
- Observation is the tool, interpretation is the model
- Showcases: Chrome dinosaur game speed rule (6 → +0.001 → 13), Windows calculator % button, DX-Ball 3,205 cases
- Design ①: Evidence record — separates and records observations, inferences, and unresolved questions
- Design ②: Availability contract — configured ≠ supported, in progress ≠ ready, timed out ≠ stopped
- Other faces of the same week: Fallout-like browser game shutdown, Modern Warfare 2 decompilation video copyright strike
- Three questions before writing: permission · original assets · distribution
- Defensive perspective: API keys in apps, production source maps, client-side checks — checks and secrets belong on the server
- Three things our team will take away

Chapters
00:00 #1 GitHub trending REA
00:34 Reverse engineering MCP server for agents
01:19 Observation is the tool, interpretation is the model
01:48 Showcase: Chrome dinosaur game
02:11 Showcase: calculator % button
02:49 Design ①: Don't just return conclusions
03:26 Design ②: Promises that prevent overstepping
04:05 AI-made game clones
04:43 The line of permission and legal compliance
05:19 Code handed over to user devices is not a secret
05:57 Three things our team will take away
06:31 Summary

References
- REA official site: https://rea.tools/
- REA repository: https://github.com/morluto/rea
- MCP contract docs: https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md
- CLI and Evidence: https://github.com/morluto/rea/blob/main/docs/cli.md
- Kotaku, Activision/Bethesda response: https://kotaku.com/activision-and-bethesda-crackdown-on-genai-mw2-and-fallout-projects-2000739580
- OWASP Secrets Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

Channel: AI-Native Software Engineer
https://www.youtube.com/channel/UCQBZdu2hpBHGY5rjBN4xk7Q

※ This video is summary content whose script, voice, and animation were created by AI based on public original sources (official site, repository docs, press). It is not an official video of the mentioned companies or projects; please check the originals for accurate content. The showcase numbers are REA's own demonstrations and not legal advice. Only reverse engineer targets whose permissions and licenses you have confirmed.

## Original README

AI가 프로그램 속을 읽는다: REA(Reverse Engineer Anything)로 보는 '증거를 돌려주는' 에이전트 도구 설계와 넘으면 안 되는 선