---
title: "Reverse Engineering Reverse Anything (REA)"
url: "https://reamcp.dev/en/cases/reverse-engineering-reverse-anything-rea-7ddac5"
source: "https://www.youtube.com/watch?v=s9HMWYxwnOw"
source_type: "resource"
author: "Code Bear"
author_handle: "thecodebear"
stars: 0
category: "CTF & learning"
categories: ["ctf-learning"]
tags: ["ai-agents", "cli", "ghidra", "mcp", "reverse-engineering"]
added: "2026-10-20T02:12:03.072Z"
updated: "2026-10-19T19:39:39.000Z"
locale: "en"
content_locale: "en"
---

# Reverse Engineering Reverse Anything (REA)

A YouTube deep-dive on REA (Reverse Engineer Anything), the open-source MCP server and CLI by morluto that lets AI coding agents drive tools like Hopper, Ghidra, IDA and JADX. Covers its origin, what a session looks like, tested showcases (DX-Ball, Touhou 4, Notion), setup, and risks such as prompt injection and lack of sandboxing.

## Description

REA, short for Reverse Engineer Anything, is an open-source MCP server and CLI by GitHub user morluto. It lets AI coding agents like Claude Code, Codex and Cursor drive real reverse engineering tools (Hopper, Ghidra, IDA, JADX, Binwalk and more) on programs they have no source code for. The video covers where it came from, what it is and isn't, a session walkthrough, showcases checked with tests (DX-Ball, Touhou 4, Windows Calculator), setup, and risks including prompt injection, no sandbox, and provider data exposure.

## Original README

Reverse Engineering Reverse Anything (REA)

REA, short for Reverse Engineer Anything, is an open-source MCP server and CLI by GitHub user morluto. It lets AI coding agents like Claude Code, Codex and Cursor drive real reverse engineering tools (Hopper, Ghidra, IDA, JADX, Binwalk and more) on programs they have no source code for. In October 2026 it went from fewer than 10,000 GitHub stars to more than 300,000 in eleven days.

We go through where it came from, what it is (and isn't), what a session looks like, the showcases where the agent's rebuild was checked with tests (DX-Ball, Touhou 4, Windows Calculator), how to set it up, and the risks: prompt injection, no sandbox, and what gets sent to your AI provider.

Star and download numbers are as of October 19, 2026.

Sources:
- REA repo: https://github.com/morluto/rea
- REA website and showcases: https://rea.tools
- DX-Ball showcase: https://rea.tools/showcase/dx-ball/
- Touhou 4 showcase: https://rea.tools/showcase/th04/
- Notion showcase: https://rea.tools/showcase/notion/
- npm package: https://www.npmjs.com/package/rea-agents
- Security notes: https://github.com/morluto/rea/blob/main/SECURITY.md
- Disclaimer: https://github.com/morluto/rea/blob/main/DISCLAIMER.md
- Ghidra: https://github.com/NationalSecurityAgency/ghidra
- GhidraMCP: https://github.com/LaurieWired/GhidraMCP
- Star growth report: https://www.kucoin.com/news/flash/ai-tool-rea-sparks-software-reverse-engineering-boom-on-github
- Matthew Berman post: https://runtimewire.com/article/matthew-berman-rea-ai-reverse-engineering
- ArtCraft mix-up: https://www.developersdigest.tech/blog/reverse-engineer-anything-rea-mcp-agents-guide-2026

Meme GIFs via GIPHY.

Thumbnail photos (Wikimedia Commons, background removed): Keanu Reeves by Governo do Estado de São Paulo (CC BY 2.0); Steve Carell by Eva Rinaldi (CC BY-SA 2.0).

## Chapters
0:00 63 bytes from 1996
1:01 From Hopper add-on to 300k stars
2:06 Why reverse engineering is hard
3:08 What REA actually is
4:20 What a session looks like
5:42 The proof: tests
7:04 Setting it up
7:51 The risks
9:04 Try it small