REA (Reverse Engineer Anything) is an open-source MCP toolkit for reverse engineering, with the goal of enabling AI agents to analyze everything from application behavior all the way down to the native binary level.
In terms of use, REA is suitable when you see a feature in an application, want to understand how it is implemented, and want to replicate similar functionality for your own product without source code. Your agent can use REA to inspect the target application, explain how the feature works, show evidence, and build an implementation based on that.
Main capabilities include: connecting agents to local inspection tools for native binaries, JavaScript and Electron applications, .NET assemblies, websites, and more; the same set of tools can also be used in the terminal. Native analysis can reuse existing Hopper, Ghidra, or IDA installations, and the setup process can optionally install Hopper after consent is obtained; static JavaScript analysis does not require a native analysis engine. Analysis runs locally, and conclusions come with evidence and limitations.
How to use: first install Node.js and npm, run npx rea-agents setup select the agent to configure, review and agree to the changes to be made, restart the agent, and it is ready to use. Setup will add REA's MCP server and the corresponding workflow instructions, and back up existing configuration. In terminal mode, you can inspect extracted JavaScript/Electron application directories or ASAR, and can install the rea command for regular use. Native analysis requires configuring a provider first (Hopper, Ghidra, IDA, etc.). For updates, you can update via a global npm or Bun install, refresh the agent registration and skills, then restart the agent; when using npx, you can use npx rea-agents@latest to run one-off commands.
Applicable scenarios include: analysis of targets such as native binaries, JavaScript/Electron applications, .NET assemblies, websites, Android APKs, firmware, and network packet captures. Several cases are provided in the text: reconstruction of sound panning calculations in DX-Ball, tracing of the Electron clipboard bridge in Notion, and recovery of DOS bullet ring calculations in TH04. These cases demonstrate the process from call tracing and instruction inspection to reconstruction and validation with tests.
Limitations and requirements: REA requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, as well as npm. Native format and host support vary by provider; for example, Ghidra supports 16-bit DOS analysis, and Ghidra support on Windows is experimental; for large binaries, an environment variable can be used to extend the startup timeout. On Linux, Ghidra, JADX, firmware tool startup, and static JavaScript/Electron analysis require a procps-compatible ps in REA's PATH for process ownership checks. Static JavaScript and .NET inspection only read the provided files and do not run the application; runtime capture will run or interact with the target with user privileges. REA does not install or update objdump and Rizin. Use of commercial tools (such as IDA Pro / Hex-Rays, Hopper, JEB) must be legally obtained and authorized, and REA does not grant any tool licenses, keys, or activation rights. The project code is released under the MIT License, and third-party materials retain their respective licenses. The project is positioned for legal research, education, interoperability, software preservation, and analysis of software you own or are authorized to inspect.
