Developer Tools · morluto/rea

REA: Reverse Engineer Anything with Agents

Complete guide to REA (morluto/rea), an MCP server and CLI tool for reverse engineering native binaries, JavaScript/Electron applications, and managed code using AI agents.

Information checked on 2026-10-25

ReposNews Editorial · Published 2026-10-25 · Updated 2026-10-25

morluto/rea · ReposNews editorial illustration

ReposNews · ilustración editorial propia / original editorial illustration

Repo: morluto/rea
Autor / Owner: morluto
Licencia / License: MIT
Lenguaje / Language: TypeScript
Categoría / Category: Developer Tools
Nivel / Level: Getting started

View on GitHub ↗Official documentation ↗

Leer en español

Purpose

REA (Reverse Engineer Anything) is a Model Context Protocol (MCP) server and command-line tool designed to connect artificial intelligence agents with reverse engineering workflows. It allows users to investigate application behavior without source code, trace calls down to the native binary level, inspect metadata, analyze packaged applications (such as Electron, Unity IL2CPP, Godot, etc.), and generate reinforcement learning environments from network captures.

Documented Requirements

To run and use REA, the official source material specifies the following environment requirements:

- Node.js 22.x (>=22.23.4), 24.x (>=24.22.1), or 26.12.1+ (Node 23 and 25 are unsupported).

- npm package manager.

- On Linux systems, a procps-compatible `ps` utility on the `PATH` is required for process ownership checks.

- For deep native analysis, an external engine such as Hopper, Ghidra, or IDA Pro is optionally required.

Installation and Setup

The official documented method to configure REA with your supported AI agent is to run the setup assistant via:

npx rea-agents setup

To install the CLI globally for regular terminal usage, execute:

npm install --global rea-agents
rea --help

To update an existing global CLI installation to the latest version:

rea update

Usage

Once the MCP server is registered with your agent (supporting Claude Code, Cursor, Gemini CLI, and others), you can prompt investigations directly in natural language:

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

From the command line, you can analyze extracted JavaScript or Electron application directories using:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Advantages

- Enables local and private analysis, returning findings backed by concrete evidence and technical limitations.

- Supports a vast array of target formats including native binaries, model artifacts (GGUF/safetensors), IL2CPP metadata, Android APK packages, and WebAssembly code.

- Automates the creation of agent-ready evaluation environments from web traffic captures (HAR).

Limitations

- Advanced native analysis workflows rely on third-party commercial software (such as IDA Pro or Hopper), requiring separate user-procured licenses.

- REA grants no tool license, activation key, or entitlement for commercial software packages.

- Runtime inspection operations execute under user permissions, necessitating strict adherence to responsible and lawful research guidelines.

Alternatives

As an editorial comparison, traditional reverse engineering and disassembly frameworks such as standalone Ghidra, Radare2, or Frida serve as manual alternatives, though REA uniquely unifies access through the MCP interface for AI agents.

License and Pricing

REA-authored code is licensed under the MIT license. Regarding official pricing, the REA repository and package are open-source and free to use; however, verified pricing for commercial tools integrated within native workflows (such as IDA Pro) is determined strictly by their respective external vendors and is not covered by REA.