What Is Reverse Engineering? Exploring the REA Project on GitHub

Reverse Engineer Anything (REA) is an open-source project that gives AI coding agents the tools to reverse-engineer an app, game, or website without its source code and explain how a feature works. Its official repository, morluto/rea, had more than 380,000 GitHub stars when we checked on 26 October 2026. That popularity is why so many developers are now searching for it.

This guide focuses on REA: what it is, how it works, how to install it, where it falls short, and how to avoid fake copies and outdated forks. We start with a short primer on reverse engineering itself, because REA only makes sense once you know what the practice involves. REA changes quickly, so check the dates and version notes as you read.

Reverse Engineering

Reverse engineering means working out how something works by studying the finished product, without its original design. Wikipedia describes it as understanding how a device, process, system, or piece of software does its job “with very little (if any) insight into exactly how it does so.”

In software, the finished product is a compiled program, a bytecode file, or the JavaScript a website sends to your browser. Wikipedia splits the work into three steps: information extraction (gather code, strings, and behavior), modelling (turn the clues into a picture of how it works), and review (test that picture against the real program).

Developers do this for ordinary reasons:

• Debugging a program whose source you can’t read.
• Interoperability, such as reading another program’s file format.
• Maintenance of legacy systems with lost documentation, often alongside AI-assisted code refactoring.
• Security research, a core skill behind modern web security tools.
• Learning how a well-built feature was put together.

You can try it in a browser today. Right-click a button, choose “Inspect,” find the script attached to it, and follow the network request it sends. For compiled programs, developers use dedicated tools: Ghidra (free and open source, from the US National Security Agency), Hopper (a commercial disassembler and decompiler for macOS and Linux), and IDA (a long-standing commercial disassembler).

What Is Reverse Engineer Anything (REA)?

REA connects your AI coding agent to reverse engineering tools. The README sums up its aim: “See a feature you like. Understand how it works, down to the binary level.” You ask your agent about a feature, and REA lets it inspect the program and show the evidence behind its answer.

A quick note on names. GitHub is the platform that hosts the code. REA is the project hosted there. The official sources are the morluto/rea repository, the rea.tools website, and the rea-agents npm package. The project is MIT-licensed.

How it plugs into your agent

REA uses the Model Context Protocol (MCP), an open standard for connecting AI apps to outside tools. The MCP documentation compares it to “a USB-C port for AI applications.” Through MCP, your agent calls REA’s tools during a normal conversation. The same tools also work from the terminal as a command-line interface (CLI).

According to the project’s FAQ, REA works with any agent that supports local MCP servers. Its setup covers agents including Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, Grok Build, OMP, and VS Code. If you already work with an agent day to day, see our guide to AI pair programming.

What REA can Analyze

The README and FAQ list these targets:

• Native executables and libraries: functions, assembly, pseudocode and references, using a supported analysis provider. Kuna was added as a further provider in version 6.6.0 (18 October 2026). See the release hist ory.
• JavaScript and Electron apps: modules, imports, IPC and source locations. This needs no native engine.
• .NET assemblies: static inspection of the supplied files, with no native engine needed.
• Browser pages: scripts, requests, and runtime observations. Runtime capture runs or interacts with the page you select, so use it only on sites you’re allowed to test.
• Other workflows: Android APKs, firmware, and packaged resources.

Analysis runs locally on your machine, and results include the evidence and limitations behind each conclusion.

REA Is a Coordinator, Not a Decompiler

This is the point most people miss. REA does not replace Ghidra, Hopper, or IDA. For deep native analysis, it drives one of them. Its job is to give your agent structured access to those engines, plus its own built-in analysis for JavaScript and .NET, and to package the results with evidence.

	Using Ghidra, Hopper or IDA directly	Using REA with an agent
Who drives the analysis	You, by hand	Your agent, calling REA’s tools
Native decompiling	The engine itself	The same engine, called through REA
JavaScript, Electron, .NET	Not the focus of these engines	Built-in analysis, no native engine needed
How you ask questions	Navigate functions, xrefs and strings yourself	Ask in plain language about one feature
Output	Disassembly, pseudocode, your own notes	Code, references and observations, each with evidence and stated limits
Cost	Ghidra free; Hopper and IDA commercial	REA free (MIT); engine licences still apply
Skill needed	High	Lower to start, but you still need to check the results

How Does REA Work?

The REA homepage describes three steps:

Step (REA’s wording)	What happens
1. Ask about one feature.	Give your agent a program or page and a question
2. Inspect the program.	REA returns code, references, and runtime observations.
3. Explain it, then try a change.	Your agent uses the findings to explain or rebuild the feature.

The split of work matters. In the homepage’s words, REA supplies “the handler’s instructions, decompiled code, and calls,” and your agent explains “which branch applies, what it calculates, and how to rebuild it.” REA gathers the evidence. The agent writes any new code with the editing tools it already has.

The Calculator example

The homepage asks why Windows Calculator gives 220 for 200 + 10%. With REA, the agent inspects the calculator’s logic and finds the rule. After you press +, the % key takes a percentage of the first number. So 10% of 200 is 20, and 200 + 20 = 220. The agent can point to the instructions that prove it, rather than guessing.

The showcase has larger cases. In one, the sound-panning maths from the 1996 game DX-Ball was recovered as a small C function. It was checked against the original program’s behaviour and all 63 compiled bytes of the original function.

Key Features and Use Cases

Feature	What it means for you
Built for agents	Works with any agent that supports local MCP servers
CLI and MCP	Use it through your agent or straight from the terminal
Guided setup	Shows every change and asks for approval before writing anything
Local analysis	The target app is analysed on your machine. The tool results still go to your agent’s AI model provider, under that provider’s data policy
Evidence and limits	Each finding comes with its proof and what wasn’t covered

If you use Claude Code, our comparison of Claude Cowork and Claude Code explains how it fits a developer’s workflow.

The showcase points to realistic uses:

• Tracing an Electron feature, such as how Notion copies text and HTML to the clipboard.
• Checking an Android app’s logic, such as how the Aegis authenticator generates its six-digit codes.
• Capture-the-flag practice, such as solving a DownUnderCTF flag checker.
• Studying retro code, such as how a PC-98 game aims a ring of bullets.

Not every capability works on every operating system or with every provider. Your host and target decide which analysis engine can be used, according to the FAQ. For example, the changelog notes that Kuna’s recorded coverage is on Linux and that Windows, PE and universal Mach-O targets are unsupported for it. Windows x64 support is experimental and limited to a Ghidra-only, read-only workflow for approved native x86-64 PE applications. DLLs, managed PE files, and non-x86-64 images are outside this support boundary. See the official README for the current requirements and limitations.

How to Install and Get Started With REA

Follow the official installation guide. REA releases often, so we link to it rather than repeat version numbers that may change.

Prerequisites

• Node.js and npm. REA 6.8.0 requires Node.js 22.23.4 or later in the 22.x line, 24.22.1 or later in the 24.x line, or 26.12.1 or later. Node.js 23 and 25 are not supported, and the installer does not upgrade Node.js for you. Check the official README and release notes for the current requirements.
• A supported AI coding agent, if you want to use REA through MCP.
• An analysis engine for native binaries (optional). Install Ghidra or IDA yourself; setup can save verified paths for an existing Ghidra installation. Hopper can be installed during setup, with its own separate approval.
• On Linux, Ghidra, JADX, firmware tools and static JavaScript/Electron analysis need a procps-compatible ps command on REA’s PATH.

Run the guided setup

npx rea-agents@latest setup

Pick the agents to connect, then review the plan with its exact paths and changes. Nothing is written until you approve. Existing configuration is backed up, and declining or pressing Ctrl-C makes no changes. When setup finishes, restart the agents it names. Quit Claude Desktop fully before you approve, so it can’t overwrite the new settings.

Your first investigation

With an agent connected, ask in plain language. The README’s example:

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

From the terminal, you can analyse an extracted JavaScript or Electron app directly:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app –json

Updates and troubleshooting

If you installed the CLI globally with npm install –global rea-agents, run rea update. If you set up through npx, run setup again with @latest. If your agent can’t see REA’s tools, restart it, then check its registration. The FAQ gives this example for Codex:

npx -y rea-agents@latest doctor –client codex –json

Replace codex with your client ID, such as claude_code or cursor. To check the tools needed for one specific task, see the Scoped readiness checks section of the installation guide.

Official REA vs Copies and Forks

REA’s popularity has attracted copies and forks, and the project warns about them directly: “A similar repository name or copied README does not establish that a download is official.” Since the tool runs on your machine and touches your agent’s configuration, it pays to install from the source the maintainer controls.

Forks are a normal part of GitHub and usually harmless, but they can fall behind. In one case we found, an old fork’s README still pinned rea-agents@4.0.1, while the latest npm release of the official package was 6.8.0 when we checked on 26 October 2026. Anyone following that fork’s instructions would install a release several versions out of date.

Before you install, check:

• The repository owner is morluto, at github.com/morluto/rea.
• The package name is exactly rea-agents on npm.
• The website is rea.tools, and you followed install links from there or the official repository.
• The version matches the latest release in the official changelog.

Copy-Ready Prompts and How to Spot Wrong Answers

Prompts to try

The first prompt is adapted from the project’s README. The second follows the example provided in the official REA FAQ:

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

Use REA to analyze /absolute/path/to/app and explain how it exports data. Show the relevant code and source locations.

The pattern behind them is simple: one local target, one behaviour, and a request for evidence. You can adapt it, for example:

Use REA to inspect [app you own]. Explain how [one feature] works. Quote the functions or source locations you relied on, and list anything you could not inspect.

Checks for spotting wrong answers

• No addresses or file locations? Treat the answer as a guess. REA’s findings carry evidence, so a good answer should cite it.
• Read the stated limitations. If coverage was incomplete, the explanation may be too.
• Don’t trust one decompiler view. In the DX-Ball case study, the first pseudocode declared the function with no input. The instruction view showed a stack input, and that mismatch gave the agent a reason to keep investigating.
• Reproduce the behaviour. Run the original app with the same inputs and compare. The Calculator rule is easy to test this way.
• Watch for generic answers that describe how such features “usually” work rather than how this one does.

Benefits and Limitations of REA

Benefits

• Understand unfamiliar software without its source code.
• Investigate undocumented features and get explanations backed by evidence.
• Move from insight to code in one session with your agent.

Limitations

REA doesn’t promise to recover an app’s original source code or clone an application automatically, and you shouldn’t expect it to.

• Decompiled output is a reconstruction. It shows the logic in readable form, not the source. Names, comments and structure may be lost.
• Results can be incomplete. REA reports coverage gaps openly, and some targets or engines are only partly supported.
• Support varies. What works depends on your operating system, target and analysis provider.
• Your AI provider sees the findings. Analysis is local, but tool results go to the model your agent uses.
• AI still needs review. An agent’s explanation is only as good as the evidence it found. Check the findings before anything ships.

Security, Privacy, Copyright and Licensing

REA’s own disclaimer says the project is built for lawful analysis, such as security research, CTFs and education, interoperability, software preservation, and debugging or auditing software you own or are authorised to examine. It also says you are responsible for getting any required authorisation and complying with laws, licence agreements and terms of service.

REA’s official disclaimer specifically rejects using the project to circumvent DRM, licence checks, anti-cheat systems or other technical protections, bypass access controls without authorisation, or copy proprietary software and protected assets. You are responsible for obtaining any required authorisation and complying with applicable laws, licences and terms of service. The EFF’s reverse-engineering FAQ offers additional US-focused context, but it is not legal advice. Aim to understand and independently recreate behaviour rather than copying proprietary code. Hopper and IDA are commercial products with their own licences. Teams building security workflows can read our guide to security automation.

Reverse Engineering vs REA

Reverse engineering is the practice. REA is one tool for doing it with an AI agent.

	Reverse engineering	REA
What it is	A general technical practice	A specific open-source project (MIT licence)
Who does it	Engineers, researchers, analysts	AI coding agents, or you via the CLI
Tools	Any: disassemblers, debuggers, browser dev tools	Its own MCP and CLI tools, on top of Hopper, Ghidra, IDA, Kuna and built-in JS/.NET analysis
Scope	Hardware, software and processes	Supported software targets only
Output	Whatever the analyst produces	Findings with evidence and stated limits

Conclusion

Reverse engineering is about understanding before building. REA brings that discipline to AI-assisted development. It coordinates established engines and its own analysis, so your agent’s answers rest on evidence it can show, and it is open about where that evidence runs out.

The practical takeaway: install it from the official sources, start with an app you own or are allowed to analyse, ask about one feature, and check the evidence yourself before you build anything from it.

Acodez is a leading web development company in India offering all kinds of web development and design solutions at affordable prices. We are also an SEO and digital marketing agency in India, offering inbound marketing solutions to take your business to the next level. For further information, please contact us today.

Frequently Asked Questions