Last updated: October 12, 2026

Reverse Engineer Anything (REA): The Complete Guide

Reverse Engineer Anything (REA) is an open-source MCP server and command-line tool that lets AI coding agents such as Claude Code, Cursor and Codex inspect native binaries, Electron apps and websites without their source code. You ask a question in plain words, REA drives the analysis tools on your machine, and your agent gets back code, references and evidence it can explain or build on.

What Is Reverse Engineer Anything (REA)?

REA, short for Reverse Engineer Anything, is a project by morluto on GitHub. Its tagline is “One MCP for reverse engineering across binaries, applications, and runtime behavior”. In practice it gives your coding agent a set of reverse engineering tools, so you can point it at an app you see a feature in and ask how that feature works. The current npm release, rea-agents 6.4.0, is MIT licensed, and analysis runs locally on your machine.

• Inspect without source code. Native binaries come back as pseudocode, assembly, strings, symbols and call references. JavaScript and Electron apps come back as modules, imports, source maps, routes and IPC.
• Evidence with every answer. Each finding includes where it came from and what is still unknown, so the agent (and you) can check a claim before trusting it.
• One tool, many targets. Beyond binaries and Electron, REA reads websites, saved HAR network captures, .NET assemblies, Android APKs, Go binaries, WASM, firmware and more, through the same MCP and CLI.

Source: GitHub: morluto/rea (README)

Source: rea.tools: official site

How REA AI Works: Agents, MCP, Ghidra and Hopper

REA itself is not a disassembler. It is an MCP (Model Context Protocol) server that sits between your agent and the real analysis engines. When you ask Claude Code or Cursor about a binary, the agent calls REA’s tools; REA starts Hopper, Ghidra or IDA (or its own JavaScript analyzer, or a Chrome-family browser for websites), runs the analysis and returns structured results. The terminal command rea uses the same workflows.

1. You ask your agent (Claude Code, Cursor, Codex) a question about an app or file on your machine.
2. The agent calls REA’s tools through MCP.
3. REA runs the right engine locally: Hopper, Ghidra or IDA for native code, its JS analyzer for Electron, a browser for websites.
4. REA returns code, references, evidence and unknowns.
5. The agent explains the behavior, or writes and tests a version for your project.

Your agent’s model provider still sees the tool results it receives, under its own data policy. REA itself does not upload your target.

Source: GitHub: morluto/rea (README)

Source: REA docs: installation and setup

REA GitHub Install Guide: Requirements and Commands

• Node.js 22.x (22.19 or later), 24.x (24.11 or later) or 26+, plus npm.
• For native binaries: Hopper, Ghidra or IDA. Setup can install Hopper for you after you approve it; Ghidra and IDA must already be installed.
• For websites: a Chrome-family browser. For JavaScript, Electron and .NET: nothing extra.
• Native host baseline: macOS 12+ or a recent Linux (Ubuntu 24.04+, Fedora 41+, Arch and a few others). Windows support for Ghidra is experimental.

1. Run npx rea-agents setup.
2. Pick your agents in the list, review the exact config paths it will change, and approve. Existing configs are backed up first.
3. Restart your agent so it loads the new MCP server.
4. Optionally install the rea command globally for terminal use, and run rea update now and then: the project ships fixes often.

# 1) Register REA with your agents (Claude Code, Codex, Cursor, Gemini CLI ...)
npx rea-agents setup

# 2) Optional: install the rea command for regular terminal use
npm install --global rea-agents
rea --help

# 3) Keep it current (global install / npx setup)
rea update
npx rea-agents@latest setup

Commands copied from the README of github.com/morluto/rea. Use bunx rea-agents@latest in place of npx rea-agents@latest if you use Bun.

Source: GitHub: morluto/rea (README)

Source: REA docs: installation and setup

Source: npm: rea-agents

Using REA with Claude Code, Cursor and Codex

Setup registers the same MCP server in each agent and installs REA’s workflow instructions (the “reverse-engineer-anything” skill) alongside it. After a restart you just ask in plain language. The prompt below is the README’s own example; the others are ours, one per agent.

• Claude Code. Select Claude Code in setup (client ID claude_code), restart, then ask in the terminal session. Claude Code is good at long multi-step traces, so ask it to show evidence at each hop.
• Cursor. Select Cursor (cursor). REA appears among Cursor’s MCP tools; use Agent mode so it can call them and then edit your project.
• Codex. Select Codex (codex). Codex works well for “find it, then reimplement it” tasks where the output is a patch to your own repo.

Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.

Use REA on /Applications/Example.app. Find how the “copy as Markdown” command works: start from the renderer, follow it through preload and IPC into the main process, and show the file and function at each step. List anything you could not confirm.

Use REA to inspect ./vendor/libexample.dylib. Find the function that parses the config file, give me its pseudocode and the strings it references, then write an equivalent TypeScript parser in src/config/ with unit tests.

I lost the source for ./legacy/report.exe (my own app, 2014). Use REA with Ghidra to find where it formats dates in the CSV export and explain why it writes 2-digit years.

Source: GitHub: morluto/rea (README)

Source: REA docs: installation and setup

Try REA from the terminal first

You can test REA without any agent. This command inspects an extracted JavaScript/Electron app directory or ASAR and prints the modules, imports and Electron boundaries it found, with their evidence. No native engine is needed.

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Replace the path with your target, for example "D:/apps/example" on Windows.

Source: GitHub: morluto/rea (README)

REA Use Cases: Reverse Engineering Anything from Electron Apps to Malware

• Reverse engineer Electron apps. Electron apps ship their JavaScript inside an ASAR archive. REA recovers modules, routes and IPC channels, which is how its Notion case study traces the clipboard bridge from the renderer to the main process.
• Analyze closed-source APIs (“API anything”). Load a saved HAR capture or let REA watch a website in a browser, and it lists requests, responses and payloads with the scripts that send them. That is the fastest way to document an undocumented API you are allowed to use and write a client for it.
• Malware and incident analysis. REA’s responsible-use policy lists malware and incident analysis and security research as intended uses. Work in an isolated VM: static inspection reads files without running them, but runtime capture does run the target.
• Debug your own old programs. Lost the source for something you wrote, or need to know why an old build behaves differently? The DX-Ball case study rebuilds a function in C that reproduces all 63 compiled bytes of the original.

Source: REA showcases (DX-Ball, Notion, TH04)

Source: REA: responsible-use disclaimer

REA Video Tutorials

Two Reverse Engineer Anything walkthroughs from YouTube creators (not made by the REA project or by us). Videos load from YouTube only when you click play.

▶

▶

REA vs Ghidra vs Hopper

These are not really competitors. Ghidra and Hopper are the engines that disassemble and decompile. Reverse Engineer Anything is the agent layer on top that drives them and turns the output into evidence your agent can use.

IDA is a third supported engine. Commercial engines need your own valid license; REA does not provide one.

Source: GitHub: morluto/rea (README)

Source: GitHub: NationalSecurityAgency/ghidra

Source: Hopper Disassembler

Is Reverse Engineering Legal?

Often yes, but it depends on where you are, what you analyze and the license you agreed to. Many places allow it for interoperability, security research, education and fixing software you own; the US DMCA has an interoperability exemption and the EU Software Directive permits decompilation for interoperability under conditions. A software license or terms of service can still forbid it.

REA’s own disclaimer says it is for lawful research, education, interoperability, software preservation and analysis of software you own or are authorized to examine. The project will not help with bypassing DRM, license checks or anti-cheat, building game cheats, bypassing authentication on systems you are not authorized to test, or copying proprietary code and assets.

This is general information, not legal advice. If you plan to publish findings or ship code based on someone else’s software, talk to a lawyer first.

Source: REA: responsible-use disclaimer

Independent guide, not affiliated with the REA project, morluto, Anthropic, Cursor, OpenAI, the NSA or Hopper. Facts are from the morluto/rea README, installation docs and disclaimer (version 6.4.0), checked on October 12, 2026. REA changes quickly; check the README before you install.