REA: AI Agent Reverse Engineering Tool Gains 52K Stars in a Day, Clones Software Without Source Code

Explosive Growth and Core Concept

REA (Reverse Engineer Anything) exploded on GitHub in October 2024, gaining 52,186 stars in a single day and rising from under 3,000 to 162,000 stars in a month. Created on April 14, 2024, the TypeScript-based MIT-licensed project is maintained by three contributors. REA is an MCP (Model Context Protocol) server that connects AI coding agents (Cursor, Claude Code, Codex, Windsurf, etc.) to native reverse engineering engines, turning them into automated reverse engineers that can analyze binaries, extract logic, and produce equivalent implementations without access to source code.

Why Traditional Tools Fall Short for Most Developers

Classic reverse engineering tools — Ghidra (NSA), Hopper (macOS), IDA Pro (industry standard), dnSpy/ILSpy (.NET), JADX/apktool (Android), browser DevTools (JavaScript) — are powerful but require deep assembly knowledge and hours of manual cross-referencing. A skilled engineer might only decipher two or three functions per day. REA does not replace these tools; it orchestrates them. The AI agent handles understanding, explanation, and code generation, while REA feeds it structured evidence (pseudocode, assembly, strings, cross-references) from the underlying engines.

Architecture: MCP Server as the Bridge

REA runs as a local MCP server. MCP standardizes how agents call external tools. The workflow has three steps:

Setup: npx rea-agents setup registers REA with the chosen agent and installs workflow guides that tell the agent when and how to invoke each tool.

Analysis Request: The agent sends a query (e.g., "trace the call chain of this function"). REA dispatches the appropriate native engine (Hopper, Ghidra, or IDA) and collects raw results: pseudocode, assembly, strings, symbols, cross-references.

Structured Evidence Return: REA packages results into Evidence records containing conclusions, evidence IDs, and limitation statements. The agent then reasons over this evidence to explain, rebuild, or adapt the logic.

All analysis runs locally; target binaries never leave the machine. Only the LLM inference (handled by the user's chosen model provider) is remote. REA marks returned strings and decompiled code as untrusted_content to mitigate prompt-injection risks from malicious binaries.

Broad Target Coverage: 20+ Analysis Types

REA supports at least 20 target categories, each with dedicated tooling:

Native binaries: pseudocode, assembly, strings, symbols, call/reference graphs via Hopper/Ghidra/IDA.

Offline ELF layout: sections, segments, symbols, relocations.

Go binaries: embedded compiler version, modules, build settings (no Go runtime needed).

WASM: validation, sections, imports/exports in WAT form.

EVM bytecode: dispatch selectors, byte offsets, inferred parameters.

JavaScript/Electron: modules, imports, source maps, routes, IPC, native extensions — zero native engine required.

Websites & HAR captures: page structure, scripts, network observations, screenshots.

.NET assemblies: metadata, CIL instructions, native dependencies.

Android APK & devices: manifest, classes, decompiled methods (JADX/JDK); adb logcat, screenshots, APK transfer.

Flutter: Dart snapshot hashes, per-ABI library summaries.

Firmware: Binwalk/Unblob extraction.

Packet captures: TShark parsing.

Recorded logic signals: sigrok-cli decoding.

SQLite databases: tables, columns, indexes, triggers.

Linux crash dumps: register/signal analysis.

Process behavior: terminal output, interaction, filesystem observation.

Depth varies: native binary quality depends on the chosen engine (Hopper vs. IDA), website analysis is observational, firmware requires Linux. Each capability has a guide documenting limitations.

Installation and Configuration

Prerequisites: Node.js 22.x (≥22.19), 24.x (≥24.11), or 26+, plus npm. One command installs and configures: npx rea-agents setup The interactive wizard lets you pick the agent (Claude Code, Codex, Cursor, Gemini CLI, Grok Build, Windsurf), shows planned config changes, backs up existing settings, and writes MCP registration plus workflow guides. Restart the agent to activate.

For native binary analysis, configure an engine: Hopper can be auto-installed during setup (with approval); Ghidra and IDA use existing installations. Large binaries may need longer timeouts via environment variables:

REA_GHIDRA_STARTUP_TIMEOUT_MS=120000
REA_HOPPER_STARTUP_TIMEOUT_MS=60000

Static JavaScript/Electron analysis works out of the box. Quick test:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/target --json

Output includes module graphs, import relations, Electron IPC boundaries. For frequent use, install globally:

npm install --global rea-agents
rea --help
rea update

Enterprise or managed environments (e.g., Cursor Enterprise) may require manual MCP registration; see docs/installation.md.

Key Boundaries and Limitations

Platform constraints: REA runs cross-platform (TypeScript/Node.js), but native ELF analysis and offline crash analysis need Linux x64; firmware analysis needs Linux; process capture needs Linux/macOS; Hopper is macOS-only; Ghidra/IDA are cross-platform.

Data privacy: Target files stay local, but analysis results pass through MCP to the agent and thus to the model provider. Evaluate provider policies for commercially sensitive targets.

Rapid evolution: 35 releases, 2,600 commits, but only 3 contributors. Breaking changes are likely; README urges staying on the latest version.

Not a GUI replacement: For deep interactive debugging, instruction-level stepping, or manual decision-making during analysis, native GUIs (Ghidra, IDA, Hopper) remain superior. REA excels at automated exploration — offloading repetitive cross-reference chasing and evidence recording to the agent.

Team capacity: Three maintainers covering 20+ target types means some niches (JEB integration, sigrok signal capture) have evolving docs and stability. Test thoroughly locally before production use.

Verified Case Studies

Three official showcases demonstrate real-world results:

DX-Ball (classic arcade game): Traced sound calls to the position-to-panning calculation function, reconstructed C implementation from pseudocode, and validated against 3,205 raw x86 test cases — reproduced the exact 63-byte compiled function.

Notion desktop (Electron): Located the renderer-process clipboard API, followed preload scripts and IPC channels to the main process, and inspected the rich-text clipboard data structure.

TH04 (Touhou Project 4, PC-98 shooter): Analyzed 16-bit DOS instructions, recovered fixed-angle and aimed-angle ring bullet-pattern calculations, rebuilt C++ code matching historical compiler output.

These cover game reverse engineering, commercial application analysis, and legacy platform reconstruction, confirming REA is beyond a demo.

Getting Started

Distribution: npm package rea-agents, GitHub source ( https://github.com/morluto/rea), and skills.sh workflow guides.

Run npx rea-agents setup, then ask your agent in natural language:

Figure out how the percentage button works in Windows Calculator, show the evidence.

Or a constructive task:

Analyze the full clipboard call chain in Notion's Electron renderer process, from renderer to main process via preload and IPC, extract the evidence, then implement a similar clipboard bridge in my project.

Documentation and illustrated guides at https://rea.tools; active Discord community at https://discord.gg/GkcryMnJDM. Update with rea update or npx rea-agents@latest setup. Ensure a native engine (Hopper/Ghidra/IDA) is installed before first native analysis; pure frontend/Electron developers can start immediately with zero-setup JavaScript analysis.