What REA can analyse
Where this list comes from
Everything here is from the REA project's public README ("What you can analyze") and its installation guide, as checked on 13 October 2026. REA changes quickly: when the README and this page disagree, the README wins. Nothing is listed here that the project does not state.
REA itself needs Node.js 22.x (22.19 or later), 24.x (24.11 or later) or 26+, plus npm. Extra tools and host support depend on the target.
Targets
| Target | What REA returns | What it needs |
|---|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls and references | Hopper, Ghidra or IDA |
| Offline ELF layout | Sections, segments, original symbols and relocations, static mitigation candidates | Caller-supplied pwntools on Linux x64 |
| Go binaries | Embedded compiler version, modules, replacements and build settings | Built in (static ELF, PE and thin Mach-O); no Go installation |
| WASM artifacts | Validation, sections, import and export WAT forms, decoded WAT | Caller-supplied WABT 1.0.42 |
| EVM bytecode | Dispatch selectors, byte offsets, inferred arguments and mutability | Local raw or hex input on Linux x64 |
| SQLite databases | Tables, columns, indexes, views, triggers and selected rows | Local database or WAL snapshot; Node.js 24.15+ or 26+ |
| Recorded Linux crashes | Raw notes, each recorded thread's registers and signals, optional mapping candidates | Caller-supplied pwntools on Linux x64; optional GDB or pwndbg |
| JavaScript / Electron | Modules, imports, source maps, routes, IPC and native add-on relationships | Node.js and npm |
| Websites | Page structure, scripts, network observations and requested screenshots | A Chrome-family browser |
| Saved network captures | Requests, responses, exposed payloads and source locations | HAR; mitmdump on Linux for native mitmproxy captures |
| .NET assemblies | Metadata, CIL instructions, declared native dependencies and build comparisons | Nothing extra (static only) |
| Android APKs | Manifest declarations, classes, decompiled methods and references | Headless JADX and a full JDK on Linux, macOS or Windows x64 |
| Android devices | Devices, packages, processes, logs, dumps, screen captures, APK and file transfers | Caller-supplied adb (emulator or hardware) |
| JEB projects | Project units, artifact digests, type and method pseudo-code | A JEB client you start yourself, serving MCP |
| Android resources | Decoded manifest, string tables, locales and version facts | Caller-supplied Apktool |
| Flutter apps | Dart snapshot hash, per-ABI library digests, engine build provenance | Nothing extra (static APK parsing) |
| Firmware | Regions, extraction results and hand-offs to native analysis | Binwalk or Unblob on Linux |
| Recorded packets | Selected fields, repeated values, filters and decode-as rules | Linux with TShark 4.x and prlimit |
| Recorded logic signals | Decoder annotations, sample ranges and diagnostics | Linux with sigrok-cli 0.7.2 and prlimit |
| Packages and resources | File inventories, digests, plists, Apple bundle anatomy and extracted resources | See the project's artifact and Apple application guides |
| Process behaviour | Terminal output, interactions, exit and filesystem observations, run comparisons | Linux or macOS with a native PTY |
Static JavaScript and .NET inspection read the supplied files without running the application. Runtime capture runs or interacts with the selected target using your user permissions; each runtime guide in the project describes its effects.
Native analysis engines
- Hopper: setup can install it after a separate, explicit approval. REA starts Hopper when an operation needs it.
- Ghidra: setup can save the paths of an existing installation. The project documents 16-bit DOS analysis and marks Windows support as experimental.
- IDA: REA connects through an existing IDA MCP server that you install and license yourself; see the project's IDA guide.
Native formats and host support vary by engine. Commercial tools such as IDA, Hopper and JEB must be legally obtained and licensed; REA grants no licence or key.
Agents
Guided setup (npx rea-agents setup) can register REA with these clients: Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, Qwen Code, VS Code, Grok Build, OMP, Pi, Hermes, Qoder, Trae, ZCode and DeepSeek Harness. The documentation notes that DeepSeek Harness is on the main branch only until a release after 6.4.0. Any other agent that supports local MCP servers can use manual registration; see the install guide.
The target guide gives a short version of this page. Analyse only software you own or are authorised to examine: see safe and legal use.