These past two days, the timeline is full of REA, with a bunch of people exclaiming, "Closed-source commercial software is going to be stripped bare by AI, not even a pair of underwear left." I looked through its repo, MCP contract, and a few cases, and the underlying logic

About this case

These past two days, the timeline is full of REA, with a bunch of people exclaiming, "Closed-source commercial software is going to be stripped bare by AI, not even a pair of underwear left."

I looked through its repo, MCP contract, and a few cases. The underlying logic is actually very straightforward, even without any black magic. It hasn't invented any new decompilation model, and hasn't even parsed a single line of assembly itself.

But why can it make Claude Code quickly figure out Notion's cross-process communication within minutes, and even write a clean-room reproduction? The real contrast and value lie here.

1. Pain point: Why did feeding decompiled code directly to AI never work before?

Most people have tried stuffing reverse-engineered assembly or obfuscated JS into large models. The result is basically a disaster: thousands of lines of code with stripped symbol names and fragmented context thrown in, and the large model guesses and stumbles, with 80% of the logic explanation relying entirely on hallucinated imagination.

REA took a different approach: instead of letting the large model guess at the outermost layer, it built a locally running MCP Server, peeling the entire analysis chain layer by layer:

• Decision layer (Claude Code / Codex): understands the target, proposes hypotheses, sets direction, and writes reproduction code after obtaining evidence.
• Scheduling layer (REA MCP): unifies reverse-engineering interfaces across ends, outputting structured evidence packages with Evidence IDs.
• Execution engine (local toolchain): native programs call IDA / Ghidra / Hopper to extract assembly and cross-references; Electron / frontend directly performs AST static analysis and Source Map restoration; Android calls JADX.

2. Core mechanism: Using the Evidence Loop to crush the large model's hallucinations

What consumes the most effort in reverse engineering has never been failing to understand a piece of code, but constantly manually tracking cross-references (Xrefs), taking notes, and piecing together fragments in the decompilation window.

REA turned this process into an Agent's "verification loop": The Agent proposes a hypothesis, and the tool returns evidence slices containing precise byte offsets and call topology. More critically, if a static analysis call graph is incomplete, the tool explicitly marks it as "limited coverage."

This means the large model won't misjudge "no call found within the static scope" as "no call exists logically." It must use the conclusive Evidence ID from the previous round to trace the next layer, gradually converging the analysis scope.

3. Specific case: Notion clipboard cross-process call chain

Looking at the official case of tracing the Notion clipboard, the process is actually very clear: To figure out "how content is written to the system clipboard when clicking copy on the Notion web page":

1. Scan the APIs exposed by the frontend, locate the preload wrapper function;
2. Capture the unique IPC channel name notion:clipboard:write;
3. Follow the channel name to locate the listener and permission check in the main process code;
4. Finally string together the complete chain of calling Electron native APIs.

Four steps, and the AI didn't guess any code implementation, relying entirely on the factual anchor of the IPC channel name to seamlessly piece together the cross-process call endpoints.

4. Don't mythologize it: 3 insurmountable physical boundaries

To see its value clearly, you must also see its boundaries clearly:

1. Zero backend penetration: It can only analyze code within the local client. The core logic of SaaS products is entirely in cloud servers, and this tool cannot touch it at all.

2. Native analysis is highly dependent on the local environment: Reverse-engineering C/Rust/Go native programs requires you to have a commercial version of IDA or Hopper / Ghidra configured locally. It doesn't carry decompilation capabilities itself.

3. Strong hardening remains a dead end: When encountering VMP packing or high-strength control flow flattening obfuscation, traditional tools can't crack it, and REA is equally helpless.

4. The output is mechanism and pseudocode, and it cannot restore a 1:1 original engineering source code out of thin air.

5. Cognitive elevation from an engineer's perspective

The signal REA releases is very clear: When AST static analysis, symbol extraction, and cross-reference tracking are packaged into an Agent's basic tools, the threshold for analyzing clients has shrunk from "days of human effort" to "the Token cost of a few rounds of dialogue."

So-called "technical barriers" built purely on client code logic, frontend packaging, and simple obfuscation are seeing their defensive returns approach zero.

Client code is becoming a fully transparent white box. The real moat of software has completely shifted to cloud private data flywheels, real-time business Context, and the depth of understanding of users' real scenarios.