leanrea README

The project's README from github.com/aicodeking/leanrea. As one markdown file: README.md.

leanrea

One 8 KB skill file that does what REA does: no MCP server, no 207 tools, no setup.

REA (Reverse Engineer Anything) puts an MCP layer between your agent and tools it can already use: asar, otool, nm, go version -m, jadx, apktool, Ghidra, tshark, binwalk, sqlite3. leanrea drops that layer. It tells the agent which command is fastest for each kind of target, gives it ready-to-paste recon commands, and lists the traps that REA's code handles for you. The agent then runs the real tools itself.

REA 6.5.0 leanrea
What gets installed 25 MB npm package + MCP server one SKILL.md
Instructions 23.5 KB skill + 48.8 KB references 8 KB
Tools added to the agent 207 (3.35 MB of definitions) 0 (uses Bash)
Context for "Reply OK", all tools loaded 400.7k tokens, $1.60 34.5k tokens, $0.09

Benchmark

Claude Code headless (claude -p), Sonnet 5.5, macOS arm64. 4 reverse-engineering tasks × 3 reps × 3 arms, with the arms run side by side. Answers are graded against hand-made keys.

arm total wall time cost turns tokens score
leanrea 388 s $2.17 55 2.40 M 74/75
no skill 479 s $2.21 81 3.11 M 67/75 (one refusal)
REA (MCP + its skill) 627 s $3.36 124 5.93 M 75/75

Against REA, leanrea had 38% less wall time, 35% lower cost, 56% fewer turns and 60% fewer tokens, at the same accuracy. Its one partial miss named an older IPC channel instead of the v2 one (both channels exist).

The tasks:

The same operation run through REA's CLI vs the raw command:

operation REA raw
Go build info 0.56 s go version -m: 0.06 s
Mach-O overview 3.32 s otool + dyld_info + nm: 0.04 s
Electron app analysis (real desktop app) fails on asar integrity until you pass a flag, then 47.9 s and 140 MB of JSON asar extract + rg -uu: 4.8 s, 24 KB

Full tables, the context-overhead runs and caveats: bench/BENCHMARK.md. Raw per-run metrics: bench/results/final.jsonl.

Caveats:

Install

npx skills add aicodeking/leanrea

This uses the skills CLI. It finds the leanrea skill and asks which agents to install it for: Claude Code, Codex, Cursor, Gemini CLI, OpenCode and the others it supports.

Common variants:

npx skills add aicodeking/leanrea -g                    # install for your user, in every project
npx skills add aicodeking/leanrea -a claude-code -y     # Claude Code only, no prompts
npx skills add aicodeking/leanrea -g -a '*' -y          # every supported agent, user level
npx skills update leanrea                               # pull the latest version later

Manual install, if you prefer:

git clone https://github.com/aicodeking/leanrea
mkdir -p ~/.claude/skills && cp -R leanrea/leanrea ~/.claude/skills/

If an agent has no skills support, paste leanrea/SKILL.md into its rules or system prompt; it is plain text.

Use it:

/leanrea How does the search feature in Foo.app work? Show the evidence.

What's in the skill

Reproduce the benchmark

Needs macOS with the target Electron app installed (see bench/setup.sh), gh from Homebrew, Node, and Claude Code logged in.

cd bench
./setup.sh        # installs [email protected], copies the targets into bench/work (gitignored)
./run_all.sh      # 36 runs, about $8 on Sonnet
./ctx.sh          # context-overhead probe
python3 mcp_list.py node work/rea-install/node_modules/rea-agents/scripts/rea.mjs --mcp   # REA tool count + size

The answer keys in tasks.json match the app versions used here and a gh built with go1.27.1. Other versions need new keys.

Credit

REA is an impressive, well-documented project by the morluto team. Most of the gotchas in this skill came from reading their code and docs. leanrea isn't affiliated with REA. It is just a test of whether a model with plain tools and a short note can do the same work faster.

MIT licensed.

leanrea (aicodeking/leanrea)

command-line-tool
Searching Database…

638 ·GitHub
Leanrea
What is this?leanrea is a single 8 KB skill file (SKILL.md) that teaches a coding agent to reverse-engineer apps and binaries using plain CLI tools like otool, nm, jadx and apktool directly, instead of routing through the REA MCP server and its 207 bundled tools.
Is this an MCP server like REA, or something else?It is not an MCP server at all. It is one plain-text SKILL.md file that gets loaded into the agent's instructions; it adds zero tools and the agent just runs the real CLI tools itself via Bash.
Do I need REA or an MCP server installed first?No. leanrea deliberately drops the MCP layer and the 25 MB npm package REA requires, and instead relies on command-line tools the agent can already call through Bash, such as asar, otool, nm, go version -m, jadx, apktool, Ghidra, tshark, binwalk and sqlite3.
How solid are the speed and cost numbers?The benchmark only ran 3 reps per cell on one model (Sonnet 5.5) and one machine, and Ghidra/Hopper/jadx weren't installed so native tasks fell back to Xcode tools for both arms. leanrea's single wrong answer named an older IPC channel instead of the current v2 one.
Which coding agents does it actually work with?Anything with skill support, confirmed for Claude Code, Codex, Cursor, Gemini CLI and OpenCode via the skills CLI installer; agents without skills support can still use it by pasting the plain-text SKILL.md into their system prompt.
Why would I pick this over just using REA?Against REA, leanrea had 38% less wall time, 35% lower cost, 56% fewer turns and 60% fewer tokens for the same accuracy, because it skips loading 207 MCP tool definitions (about 400k tokens) and just tells the agent which raw command to run.
What kinds of targets can the skill handle?Its router covers Electron/asar apps, Mach-O and native binaries, Go/Rust/.NET binaries, Android APKs, WASM, SQLite, plists, pcap/HAR files, firmware, and websites or runtime tracing, each with a ready first-move command.
How exactly was the benchmark run?Four reverse-engineering tasks were run 3 times each across 3 arms (leanrea, no skill, and REA) using Claude Code headless (claude -p) with Sonnet 5.5 on macOS arm64, with answers graded against hand-made keys.
Is leanrea an official REA product?No, leanrea is unaffiliated with REA; it was built by reading REA's code and docs to see if a model with plain tools and a short note could match its results faster and cheaper.
What are similar projects?Reverse-Engineer-anything, pstack-claude, im-not-ai, answer-me-with-html, pstack, SwiftUI-Agent-Skill, open-steps, superpowers-zh
Which topics is it in?decompiler, security-research, binary-analysis, agentic-coding, token-usage, codex-skill, gemini-cli, claude-code-skill, context-engineering, static-analysis, opencode, claude-skills
Creator
aicodeking
Size
<0.1 MB
Stars
638
Updated
CommitOct 17
Age
2d
Commits · 90 Days