REA MCP
☰
All casesCommunity submissionsPromptsToolsFree toolsGuidesSponsors3 feed slots leftApp feature recreation7Patches & fixes1File formats & protocols6Security & malware analysis (defensive)1Lost source recovery6Game mods & interoperability4CTF & learning12Tools & integrations41
EN
● — online · Views — times
SponsorsSubmit a case
Tutorial resources · by SoftsWeb

I Tested REA, the Viral GitHub Repo That Reverse Engineers Any App

A hands-on review of REA (morluto/rea, rea-agents on npm), an open-source MCP tool that lets AI coding agents reverse engineer apps. The author points REA and Claude Code at the shipped files of Bruno, an open-source MIT API client, and produces a behavioural report in 22 minutes for $0.81, then verifies the main claims against the source and a short live network capture. The video covers what REA is and is not, which servers the app contacts, why a telemetry opt-out may not stop everything, HTTPS certificate checking, a hidden feature, the report's limits, and three warnings (fake copies, no sandbox, legal).

Translated

About this case

Video walkthrough testing REA on Bruno, an open-source API client. Chapters cover the test setup, what REA is and is not, the app choice, mapping the app, contacted servers, the opt-out switch, HTTPS certificate checking, a hidden feature, report limits, implications and warnings. Links: REA on GitHub (morluto/rea), REA on npm (rea-agents) and Bruno. Notes state the analysis was static, with main claims checked against source and a short live network check, that Bruno is MIT with a telemetry opt-out, that only software you are allowed to test should be analysed, and that the video is not sponsored.

Setup

See the original source for installation instructions.

Original text / README

I Tested REA, the Viral GitHub Repo That Reverse Engineers Any App

A new open source tool called REA lets AI coding agents like Claude Code, Codex and Cursor take apart an app they have never seen the source of. It already has 150,000+ stars on GitHub, so I tested it on a real app and checked the answers myself.

I installed Bruno (an open source API client), gave Claude Code and REA only the files that ship with the app, and asked what it does behind the scenes. 22 minutes and $0.81 later it had a full report, and I checked the main claims against the source and a live network capture.

0:00 The repo everyone is talking about 0:25 The test: one app, one question 1:02 What REA really is (and is not) 2:28 The app I picked and why 3:10 REA draws the map 3:42 Which servers the app contacts 4:35 Why the opt-out switch doesn't stop everything 5:05 HTTPS certificate checking 5:30 The hidden feature 6:02 The honest part: limits of the report 7:04 What this means for you 7:35 Three warnings (fake copies, not a sandbox, legal) 8:43 Your turn

Links REA on GitHub: https://github.com/morluto/rea REA on npm: https://www.npmjs.com/package/rea-agents Bruno (the app I tested): https://github.com/usebruno/bruno

Notes and honesty

  • Bruno is open source (MIT) and has a telemetry opt-out in Preferences. This video is not an accusation, it shows what REA can find and how I verified it.
  • The analysis was static (reading the code). I confirmed the main claims in the source and with a short live network check, and I say in the video what was not tested.
  • Only analyze software you are allowed to test. I am not a lawyer and this is not legal advice.
  • This video is not sponsored.

#REA #ClaudeCode #ReverseEngineering #OpenSource

Similar projects