What is this?
REA lets AI coding agents reverse engineer apps, binaries, websites, and other software through a single MCP server and CLI, returning findings with the evidence behind them so an agent can explain a feature or rebuild it.
REA lets AI coding agents reverse engineer apps, binaries, websites, and other software through a single MCP server and CLI, returning findings with the evidence behind them so an agent can explain a feature or rebuild it.Is this a library I import, or a tool I run?It's an MCP server plus a CLI: setup registers REA's MCP server with your coding agent and installs matching workflow instructions, and you can also run the same analyses directly from the terminal.
It's an MCP server plus a CLI: setup registers REA's MCP server with your coding agent and installs matching workflow instructions, and you can also run the same analyses directly from the terminal.How do I get it running?Run 'npx rea-agents setup' with Node.js and npm installed, then review and approve the proposed agent changes and restart your agent.
Run 'npx rea-agents setup' with Node.js and npm installed, then review and approve the proposed agent changes and restart your agent.Which coding agents are supported?Setup supports Claude Code, Codex, Cursor, Gemini CLI, and other agents that can use local MCP servers; it also requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ plus npm.
Setup supports Claude Code, Codex, Cursor, Gemini CLI, and other agents that can use local MCP servers; it also requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ plus npm.Do I need Hopper, Ghidra, or IDA for everything?Only for deep native-binary analysis; static JavaScript and .NET inspection work without any analysis engine, and setup can optionally install Hopper after your approval.
Only for deep native-binary analysis; static JavaScript and .NET inspection work without any analysis engine, and setup can optionally install Hopper after your approval.Does every analysis type work on any OS?No - Android APK analysis needs headless JADX and a full JDK on Linux/macOS, live process capture needs a native PTY on Linux/macOS, and firmware extraction needs Binwalk/Unblob on Linux, while core setup and JS/.NET analysis are cross-platform.
No - Android APK analysis needs headless JADX and a full JDK on Linux/macOS, live process capture needs a native PTY on Linux/macOS, and firmware extraction needs Binwalk/Unblob on Linux, while core setup and JS/.NET analysis are cross-platform.Does REA upload my app anywhere?No, analysis runs locally and only the tool results are passed to your agent, whose model provider has its own separate data policy.
No, analysis runs locally and only the tool results are passed to your agent, whose model provider has its own separate data policy.What kinds of targets can REA analyze?Native binaries, JavaScript/Electron apps, websites, saved network captures, .NET assemblies, Android APKs, firmware, packages/resources, and live process behavior, each with its own requirements and guide.
Native binaries, JavaScript/Electron apps, websites, saved network captures, .NET assemblies, Android APKs, firmware, packages/resources, and live process behavior, each with its own requirements and guide.What makes REA's output trustworthy?Every finding ships with the evidence and stated limitations behind it, so an agent can show pseudocode, strings, or call traces instead of just asserting a conclusion.
Every finding ships with the evidence and stated limitations behind it, so an agent can show pseudocode, strings, or call traces instead of just asserting a conclusion.Can I use REA without an AI agent?Yes, the same workflows are exposed as terminal CLI commands, for example inspecting an extracted Electron app directory or ASAR archive directly.
Yes, the same workflows are exposed as terminal CLI commands, for example inspecting an extracted Electron app directory or ASAR archive directly.Is REA itself free to use?REA is MIT-licensed and free; some native binary analysis providers like Hopper or IDA may still require their own license.
REA is MIT-licensed and free; some native binary analysis providers like Hopper or IDA may still require their own license.What are similar projects?eleven, awesome-reverse-engineering, Reverse-Engineer-anything, Seep-Reverse-Lab, rea, dsh-crew, reticle, reverify
eleven, awesome-reverse-engineering, Reverse-Engineer-anything, Seep-Reverse-Lab, rea, dsh-crew, reticle, reverifyWhich topics is it in?rea, ai-agent-tools, disassembler, cordis, decompiler, ctf, binary-analysis, static-analysis, agent-skill, dsh, coding-agents, dsh-plugin
rea, ai-agent-tools, disassembler, cordis, decompiler, ctf, binary-analysis, static-analysis, agent-skill, dsh, coding-agents, dsh-plugin