---
title: "I hid a network call inside an app and told no one. The 400K-star REA found it i"
url: "https://reamcp.dev/en/cases/i-hid-a-network-call-inside-an-app-and-told-no-one-the-400k--d5c251"
source: "https://x.com/i/status/2116207500542239018"
source_type: "x"
author: "rvaniaaa"
author_handle: "rvaniaaaa"
stars: 0
category: "Security & malware analysis (defensive)"
categories: ["security-defense"]
tags: ["claude-code", "electron", "ipc-channels", "mcp-server", "static-analysis"]
added: "2026-11-02T02:09:52.587Z"
updated: "2026-10-30T16:36:00.000Z"
locale: "en"
content_locale: "en"
---

# I hid a network call inside an app and told no one. The 400K-star REA found it i

The author built a small Electron app with one window, one preload script, three bridge functions, three private channels and a deliberately hidden network call, then let REA analyse it without any hints. According to the post, REA recovered every one of those elements within about 30 seconds and cited the exact file, function and call behind each finding. The post presents REA as an open-source MCP server for Claude Code that inspects Electron apps, websites, Android APKs and (with Ghidra) native binaries, running the analysis locally, and walks through setup with `npx rea-agents setup` plus a first prompt for mapping windows, the preload bridge and IPC channels on an app you own.

## Description

X post by @rvaniaaaa describing a hands-on REA demo. The author intentionally planted a hidden network call inside a one-window Electron app (1 preload script, 3 bridge functions, 3 private channels) and gave REA no information about it; the reported result was that REA identified all of it in roughly 30 seconds with file- and function-level evidence. The post explains that REA is an open-source MCP server for Claude Code covering Electron apps, websites, Android APKs and native binaries with Ghidra, with all analysis performed locally, and gives a five-minute setup path: `npx rea-agents setup`, choose Claude Code, approve the plan, restart, then ask Claude which REA tools are available. It suggests a first prompt on an app you own — 'Map the windows, the preload bridge and every IPC channel. Cite the file and function for each. List what you could not resolve.' — and notes that manually checking a couple of the claims is a good way to calibrate trust. A longer guide (install, prompts, a two-session method, limitations, model choice) is mentioned but not linked in the post text.

## Original README

I hid a network call inside an app and told no one. The 400K-star REA found it in 30 seconds, with the file that proves it.

Here's the app: 1 window, 1 preload script, 3 bridge functions, 3 private channels, 1 hidden network call. I told REA none of it. Every number matched.

That's when it clicked. Your agent can now open software it has never seen and come back with receipts.

REA is an open source MCP server for Claude Code. It reads Electron apps, websites, Android APKs, and native binaries once you add Ghidra. Every answer points at the exact function, file and call behind it. The analysis runs on your machine.

Setup takes 5 minutes:

→ npx rea-agents setup
→ pick Claude Code, approve the plan, restart
→ ask Claude which REA tools it has

First prompt to try on an app you own:

"Map the windows, the preload bridge and every IPC channel. Cite the file and function for each. List what you could not resolve."

That last line keeps it honest. Check a couple of its claims by hand and you'll know how far to trust the rest.

The full guide has the install, the prompts, the two-session method for building your own version, where it breaks, and which Claude model to use for what.