What is REA? Install and safe use
What is REA?
REA (Reverse Engineer Anything) is an open-source MCP server for reverse engineering, published under the MIT licence at github.com/morluto/rea. It connects your AI agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, websites and more, so the agent can explain how a feature works and show the evidence behind each conclusion. The project sums it up as: “See a feature you like. Understand how it works, down to the binary level.”
You can use the same tools from your terminal. According to the project, analysis runs locally, and results include the evidence and the limitations behind each conclusion.
How it works
Your agent calls REA through MCP to inspect a target and trace the relevant code. REA returns findings with their evidence. The agent then uses them to ask follow-up questions, explain the behaviour, or write and test an implementation for your own project. The command-line tools run the same workflows.
What it can analyse
The README lists more than twenty kinds of target. A few of the common ones:
| Target | What REA returns | What it needs |
|---|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls and references | Hopper, Ghidra or IDA |
| JavaScript / Electron | Modules, imports, source maps, routes, IPC and native add-on relationships | Node.js and npm |
| Websites | Page structure, scripts, network observations and requested screenshots | A Chrome-family browser |
| .NET assemblies | Metadata, CIL instructions, declared native dependencies and build comparisons | Nothing extra (static only) |
| Android APKs | Manifest declarations, classes, decompiled methods and references | Headless JADX and a full JDK |
| Go binaries | Embedded compiler version, modules, replacements and build settings | Nothing extra (built in) |
Others include WebAssembly, EVM bytecode, SQLite databases, firmware, recorded network and packet captures, and process behaviour; each has its own requirements. REA itself needs Node.js 22.x (22.19 or later), 24.x (24.11 or later) or 26+, plus npm. The target guide summarises them.
Set it up in one command
With Node.js and npm installed, run:
npx rea-agents setup
Choose your agents, review the proposed changes and approve them. Setup adds REA's MCP server and matching workflow instructions, with backups of your existing configuration. Restart your agent afterwards. Setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents; the install guide covers each step, manual registration and updates.
Ask your agent
The README's example prompt shows the intended use:
Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.
Replace the app and the feature with your own target, one you are allowed to examine.
What REA is for, and what it is not for
The project states that REA is for lawful research, education, interoperability, software preservation and analysis of software you own or are authorised to examine. Its disclaimer lists security research, malware and incident analysis, vulnerability research with coordinated disclosure, CTFs and debugging your own software among the intended uses.
The project does not support, and will not help with:
- circumventing DRM, licence checks, anti-cheat systems or other technical protection measures;
- developing game cheats or tampering with online services;
- bypassing authentication or access controls on systems you are not authorised to test;
- copying proprietary software or reproducing its protected code and assets.
You are responsible for any authorisation you need and for following the law and the licences involved. Commercial tools such as IDA, Hopper and JEB must be legally obtained; REA grants no licence for them. This directory follows the same line: see the content rules.
About this site
REA MCP is an independent, community-run directory of what people did with REA. It is not affiliated with, endorsed by or sponsored by the REA project or its maintainers. The official sources are the GitHub repository and the project site, rea.tools.
Popular REA use cases
Published cases ranked by community votes, then GitHub stars. Updated automatically.
- REA on Fedora-based Linux: setup notes and gotchas★ 156,486
- My local model setup for REA on Linux (one 12 GB GPU)★ 156,486
- Reducing token waste in REA workflows★ 156,486
- Outside-in leak check of a production Next.js and Stripe app★ 156,484
- REA (Reverse Engineer Anything)★ 156,483
- A stripped bzip2 build: what REA returned, checked against the source★ 156,483
- Benchmarks: REA on Linux across Node versions and five local models★ 156,482
- OpenBattlefield2: a clean-room engine reimplementation★ 41
- Reconstructing DX-Ball 1.07★ 40
- TH04 source reconstruction★ 29
FAQ
What is REA?
REA (Reverse Engineer Anything) is an open-source, MIT-licensed MCP server at github.com/morluto/rea. It connects your AI agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, websites and more, so the agent can explain how a feature works and show the evidence behind each conclusion.
How do I install REA?
With Node.js and npm installed, run npx rea-agents setup, choose your agents, review the proposed changes and approve them, then restart your agent. Setup adds REA's MCP server and matching workflow instructions, and backs up the existing configuration.
Which agents can use REA?
Any agent that supports local MCP servers. Setup configures the supported agents, including Claude Code, Codex, Cursor, Gemini CLI and Grok Build; other clients can register the server manually as described in the project's installation guide.
Do I need Hopper, Ghidra or IDA?
Only for deep native analysis. Static JavaScript and .NET inspection work without a native analysis engine. Setup can install Hopper after your approval; Ghidra and IDA use your existing installations, and commercial tools must be legally obtained and licensed.
Is REA MCP the official REA site?
No. REA MCP is an independent community directory of REA use cases. It is not affiliated with, endorsed by or sponsored by the REA project or its maintainers; the official sources are github.com/morluto/rea and rea.tools.
Does REA upload my app?
According to the project, REA analyses targets locally. Your agent receives the tool results, and the agent's model provider has its own data policy, so check it before you analyse anything sensitive.
What is REA for, and what is it not for?
The project describes REA as being for lawful research, education, interoperability, software preservation and analysis of software you own or are authorised to examine. It does not support cracking, DRM or licence circumvention, game cheats or attacks on systems you may not test, and REA MCP lists only legitimate uses.
How do I keep REA up to date?
If you set REA up with npx, run npx rea-agents@latest setup, review the changes and restart your agent. If you installed the CLI globally with npm or Bun, run rea update, then the setup command it prints to refresh your agent registrations.