What is REA (Reverse Engineer Anything)?
REA is an MCP server and CLI that connects a coding agent to reverse-engineering tools. Ask it how a feature in an app works and the agent can inspect the app without its source, trace the relevant code and return pseudocode, references and the gaps in what it found.
The README lists 36 target types. Native binaries go through an existing Hopper, Ghidra or IDA installation; JavaScript and Electron apps, .NET assemblies, Go and Rust binaries, PE and ELF metadata, Godot and Unity IL2CPP archives and model files (GGUF, safetensors) are parsed with built-in code; Android APKs use JADX; websites and HAR captures use a Chrome-family browser. It can also turn a recorded web session into a runnable environment for agent RL training.
It is MIT-licensed, published on npm as rea-agents, and released very often: version 6.8.0 shipped on 25 October 2026, one of 15 releases that month.
How to install REA (Reverse Engineer Anything)
npx rea-agents setupIs REA (Reverse Engineer Anything) worth it?
REA is the broadest reverse-engineering MCP server available, and its breadth is the reason to choose it over a single-tool bridge. Where GhidraMCP exposes one decompiler, REA routes the same agent session across Hopper, Ghidra or IDA for native code, its own parsers for Electron, .NET and dozens of file formats, JADX for Android and a browser for websites, and it returns findings with the evidence and unknowns attached.
The showcases are concrete rather than promotional. In the DX-Ball case study the reconstructed sound-pan function passes 3,205 test cases against the original x86 code and reproduces all 63 compiled bytes. That is the right kind of claim for this field, because it can be checked.
The security line needs care. Static inspection of JavaScript and .NET reads files without running them, but runtime capture runs the target with your user permissions, and the opt-in HTTP transport is plain HTTP with no TLS or authentication that serves one client at a time. Analysis stays local, yet everything REA returns, including strings from a hostile binary, goes to your model provider and is untrusted input to the agent.
The practical limits are churn and prerequisites. Fifteen releases in October alone mean setup instructions and tool schemas move quickly, Node.js 22.23.4 or later is required, and the deepest results depend on a native engine you install and license yourself. The project is explicit that commercial decompilers must be legally licensed and that REA is for software you own or are authorised to examine.
Where it earns its place
A malware analyst at a 20-person security consultancy
Triage an unfamiliar Windows sample before writing a report
REA reads PE imports, certificates and strings with built-in parsers, then hands functions to Ghidra for pseudocode. Run it inside an isolated VM, since runtime capture executes the sample; the software is free and Ghidra is free.
A product engineer at a note-taking startup
Understand how a rival Electron app implements rich clipboard handling
Point REA at the extracted app; it maps renderer, preload and IPC boundaries without running the app, as in the project's Notion case study. Legal review of what you may reuse still applies.
An ML engineer building agent benchmarks
Turn a recorded web app session into a training environment
rea environment-build converts a HAR file into tools an agent can call, runnable with AgentEnv and Docker, so RL tasks run without the live app.
Before you commit
- Setup
- npx rea-agents setup lets you pick agents (Claude Code, Codex, Cursor, Gemini CLI, Grok Build and others), previews config changes and backs them up; restart the agent afterwards. Needs Node.js 22.23.4+, 24.22.1+ or 26.12.1+.
- Integrations
- Hopper, Ghidra and IDA for native code; JADX, Apktool and adb for Android; Binwalk and Unblob for firmware; TShark for packet captures; a Chrome-family browser for websites; JEB through its own MCP client.
- Data and privacy
- Analysis runs locally and the project says it does not upload targets; tool results go to your agent's model provider. stdio is the default; the opt-in HTTP mode has no TLS or client authentication.
- Cost at scale
- Free under MIT; the costs are model tokens for long investigations and licences for commercial engines such as IDA Pro, Hopper or JEB.
- Limits
- 571 open issues; Linux needs a procps-compatible ps for several providers; large binaries may need raised provider startup timeouts; the HTTP server serves one client at a time.
What's good
- 36 target types behind one MCP registration
- Uses Hopper, Ghidra or IDA for native code
- Results carry evidence and stated unknowns
- Setup backs up agent config before editing it
What's not
- Runtime capture executes the target with your permissions
- HTTP transport has no TLS or authentication
- Very fast release cadence
- Deep native analysis needs a separately installed engine
Best for
Security researchers and engineers who want an agent to explain how a closed app or binary works, with evidence they can check.
REA (Reverse Engineer Anything) alternatives
REA (Reverse Engineer Anything): common questions
- Is REA (Reverse Engineer Anything) worth it?
- REA gives an agent a whole reverse-engineering bench behind one install, and it is only as safe as the targets you let it run. We rate it 4.0 out of 5.
- How much does REA (Reverse Engineer Anything) cost?
- Free under the MIT licence. Commercial back ends such as IDA Pro, Hopper and JEB need their own licences.
- What are the downsides of REA (Reverse Engineer Anything)?
- Runtime capture executes the target with your permissions; hTTP transport has no TLS or authentication; very fast release cadence; deep native analysis needs a separately installed engine.
- Who is REA (Reverse Engineer Anything) best for?
- Security researchers and engineers who want an agent to explain how a closed app or binary works, with evidence they can check.
- How much does REA (Reverse Engineer Anything) cost for a team or in production?
- Free under MIT; the costs are model tokens for long investigations and licences for commercial engines such as IDA Pro, Hopper or JEB.
- Is REA (Reverse Engineer Anything) safe for company data?
- Analysis runs locally and the project says it does not upload targets; tool results go to your agent's model provider. stdio is the default; the opt-in HTTP mode has no TLS or client authentication.
- What are the best REA (Reverse Engineer Anything) alternatives?
- The closest alternatives we have reviewed are GhidraMCP.
Answers checked Oct 26, 2026.
Make REA (Reverse Engineer Anything)? Show this rating on your site
