REA · Reverse Engineer Anything
Reverse Engineer Anything
What is REA?
- MCP: connecting AI agents to reverse-engineering tools
- Analyze apps, web, APKs, and firmware without source code
- What a tool can do is separate from what the law allows
REA isn’t a new analysis technique. It’s a connector. The reverse engineering field has used specialist tools like Ghidra, IDA, and Hopper for decades, but their complex screens and menus made them hard to use for anyone but security experts. REA wraps these tools in the MCP protocol so AI coding agents such as Claude Code, Codex, and Cursor can call them directly. Users simply ask in plain language, for example, “Explain how this app’s search feature works, with evidence,” and the agent runs the tools and summarizes the results.
Its range of analysis targets is broad. It handles ordinary executables, desktop apps built with JavaScript or Electron, websites, .NET programs, Android apps (APK), firmware, and even SQLite databases. Analysis runs on the user’s own PC, and each result comes with evidence and limits for every conclusion. This design keeps the agent from making up plausible-sounding explanations without evidence. After its release under the MIT license in April 2026, it became one of the most closely watched repositories on GitHub within six months.
In practice, there are three main uses. The first is a security review that checks where outsourced deliverables or solutions under evaluation send data. The second is preparing for migration by recovering the rules of undocumented in-house legacy programs. The third is helping the development team confirm how a program they will integrate with behaves, so they can design the connection. In every case, the narrower the question, the faster and more accurate the agent’s answer.
Set your expectations accurately. What REA returns is not the original source code but analysis results such as pseudocode, assembly, and module relationships. Interpreting them and building a similar feature from scratch is up to the agent and the people involved. Sometimes you can get a similar answer just by observing the screen and reasoning from it, so not every analysis needs REA. More important is where the boundaries of use lie. Since the official description promotes the idea of “see a feature you like, then understand how it works,” you should check the limits that terms of service and copyright law allow before analyzing someone else’s product. Fake repositories with similar names are also circulating, so install only from the official source.
John KimInstructor John Kim, author of B2B Marketing Design and CEO of Nanum Consulting
Seolyeong ParkGenerative AI and AX training specialist with 17 years of hands-on experience and 200+ lectures, helping non-technical staff put AI to work right away| Category | Existing tools (Ghidra, IDA, etc.) | REA |
|---|---|---|
| Type | The analysis engine itself | The connector that links analysis engines to AI |
| How it’s used | An expert operates it directly through screens and menus | Ask in plain language; the agent runs the tools |
| Output | Pseudocode · assembly | Analysis results, with evidence and limits for each conclusion |
An open-source project released under the MIT license in April 2026 by the GitHub account morluto. Its motto is “when you see a feature you like, understand how it works down to the binary level,” and a single install command for its npm package (rea-agents) registers it with multiple AI agents.
Consider a hypothetical case. Company A, an industrial equipment distributor with 270 employees, received a desktop quoting program from an outside developer. The contract said 'customer data is stored only on internal servers,' but no one in-house had the development expertise to verify it.
- Manager Han on the Information Strategy Team checked with legal that the contract gave the company the right to inspect and analyze deliverables, then installed REA on an internal analysis PC following the official repository’s instructions.
- When they asked the AI coding agent to “list, with evidence, the addresses this program sends data to,” it returned the company’s internal server plus one external error-reporting service.
- Following the evidence the agent attached, they found the program was built to send the entire contents of the quote screen being edited to an external service whenever an error occurred.
- Manager Han sent the analysis results to the vendor along with the supporting screens. The vendor said the feature had been on by default and delivered a corrected build within a week.
- Company A later added an “external transmission address list check” item to its checklist for inspecting outsourced deliverables. The check now takes about half a day per delivery.