Open-Source Tool Guide · Updated October 2026
Reverse Engineer Anything with AI Agents
REA (Reverse Engineer Anything) is a free, open-source MCP server that lets AI coding agents like Claude and Cursor inspect any software — native binaries, Electron apps, websites — without the source code, explain how it works with evidence, and rebuild the feature for your own project.
What Is REA (Reverse Engineer Anything)?
REA (Reverse Engineer Anything) is a free, open-source MCP server that connects AI coding agents like Claude Code, Cursor and Codex to professional reverse-engineering tools. Point your agent at a binary, app or website and it explains how any feature works, shows the evidence, and builds a working version for your own project.
REA went viral on Hacker News in October 2026 and has collected more than 110,000 GitHub stars. It works as a bridge: your agent calls REA through the Model Context Protocol, REA inspects the target locally using the right analysis tool for the job, and the agent gets back code, references and unknowns it can reason over. Every finding includes the evidence and limitations behind it, so conclusions stay checkable instead of hallucinated.
Your agent asks
You describe the feature you want to understand — in plain English, inside the coding agent you already use.
REA inspects locally
REA picks the right tool for the target, runs the analysis on your machine, and returns code, references and evidence.
Your agent answers
The agent explains how the feature works, asks follow-up questions, and writes a tested implementation for your project.
How to Set Up REA in 3 Steps
Setting up REA takes about ten minutes. Setup registers the MCP server with your agent, installs matching workflow instructions, and keeps backups of your existing configuration before changing anything.
- 1
Install Node.js 22 or newer
REA requires Node.js 22.19 or later (24.11+ or 26+ also work) with npm. Check your version by running node --version in a terminal.
node --version - 2
Run the REA setup command
Run npx rea-agents@latest setup, choose the agents you use — Claude Code, Codex, Cursor, Gemini CLI or Grok Build — review the proposed configuration changes, and approve them. Restart your agent afterward.
npx rea-agents@latest setup - 3
Ask your agent to investigate
Describe what you want to understand in plain English, for example: Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project. REA inspects the target locally and returns findings with evidence.
Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.
Prefer the terminal? Install the CLI for regular use: npm install --global rea-agents
How to Reverse Engineer Anything: Prompts That Work
You do not script REA — you talk to your agent. Describe the app and the behavior you want to understand, and let the agent drive the investigation. These patterns come straight from the project's documentation:
“Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.”
“Use REA to inspect Windows Calculator. Why does 200 + 10% give 220?”
“Use REA to inspect this dinosaur game. Why does it get faster? Show the speed rule, then build a small version with an adjustable speed.”
Reverse engineer an Electron app from the terminal
You can also run the same workflows without an agent. Point the CLI at an extracted JavaScript/Electron app directory or ASAR archive and get structured JSON back — modules, imports, Electron boundaries and the evidence for each:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --jsonStatic JavaScript and .NET inspection read the supplied files without running the application. Runtime capture runs the target with your user permissions, and each runtime guide documents exactly what it does.
What Can You Reverse Engineer with REA?
REA covers 16 target types, from x64 executables to smart-contract bytecode. Deep native analysis uses Hopper, Ghidra or IDA; JavaScript, Electron and .NET targets need no native engine at all. Everything runs locally, and results always include the evidence behind each conclusion.
Native binaries
Pseudocode, assembly, strings, symbols, calls and references from executables and libraries — powered by Hopper, Ghidra or IDA.
JavaScript & Electron apps
Module maps, imports, source maps, routes, IPC channels and native add-on relationships from an app folder or ASAR archive.
Websites
Page structure, scripts, network observations and requested screenshots through a Chrome-family browser.
Android APKs & devices
Manifest declarations, classes, decompiled methods — plus device logs, screen captures and APK transfers via adb.
.NET assemblies
Metadata, CIL instructions, declared native dependencies and build comparisons — with no extra tools required.
Go binaries
Embedded compiler version, modules, replacements and build settings, with no Go installation required.
WASM & EVM bytecode
WebAssembly validation, sections and decoded WAT — plus EVM dispatch selectors, byte offsets and inferred arguments.
Network captures
Requests, responses, exposed payloads and source locations from saved HAR files or mitmdump captures.
Firmware & packages
Regions, extraction results and file inventories, digests and Apple bundle anatomy from installed artifacts.
Process behavior & crashes
Terminal output, interactions, filesystem effects, run comparisons — and every recorded thread's registers and signals from Linux crashes.
Also supported: offline ELF layout, recorded Linux crashes, JEB projects and Android resources. Full per-target requirements are in the tool catalog on GitHub.
Real REA Case Studies
The REA team documents full investigations, including the recovered code and how each answer was verified. You can try the interactive versions — including a playable reconstruction of the Chrome dinosaur game — on the official REA website.
Why does Windows Calculator give 220 for 200 + 10%?
REA inspected the installed Calculator DLL and recovered the percentage handler. After +, the % button takes a percentage of the first number: 10% of 200 = 20, so 200 + 20 = 220. After ×, it instead turns 10% into 0.1. The agent then rebuilt both rules in a small working calculator.
Chrome's dinosaur game: the exact speed rule
REA returned the script actually running in the page. The dino starts at speed 6 and adds 0.001 per update until it reaches 13. The team verified the rule in a controlled browser check: speed was 10.0 after 4,000 updates and 13.0 after 10,000 — then rebuilt the game with an adjustable speed slider.
DX-Ball: reconstruct a sound-pan calculation
Following a sound call into its position-to-pan helper, REA turned incomplete pseudocode into C. The reconstruction passes 3,205 original-x86 test cases and reproduces all 63 compiled function bytes of the original routine.
Notion: trace the Electron clipboard bridge
REA found the renderer's clipboard API, followed it through the preload script and IPC into the main process, and inspected the rich clipboard format — a complete map of how a production Electron app moves data across its boundaries.
Is REA Free, Safe and Legal to Use?
Yes. REA is free and open source under the MIT license, with 110,000+ GitHub stars as of October 2026. All analysis runs locally on your machine — REA does not upload your app — and every finding ships with its evidence and stated limitations. It is intended for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.
If you hit a bug, update first — REA changes quickly and new releases include frequent fixes. Then check the project's readiness and troubleshooting guides on GitHub.
Frequently Asked Questions
Start Reverse Engineering Today
One command, one prompt — and your agent explains any app. For more tool guides, browse the AIXList resources hub or explore the full AI tools directory.