REA: MCP reverse engineering tool for AI agents
/rea
REA is the tool I'd actually reach for when I need an AI agent to investigate an app without its source. It runs analysis locally, returns evidence-backed conclusions, and integrates with Hopper, Ghidra, or IDA Pro for deep binary work. Worth using if you want explainable, reproducible reverse engineering from an agent instead of a manual hex editor session.
What is REA?
REA is an MCP server and CLI that lets AI agents reverse engineer binaries, JavaScript apps, .NET assemblies, and websites. It connects to Hopper, Ghidra, or IDA Pro for native binary analysis, and ships a static JavaScript analyzer that needs only Node.js. Every investigation returns an Evidence bundle with conclusions and acknowledged limitations, so you know what the tool did and resolve.
Analysis capabilities and supported targets
- โMCP server connecting AI agents to reverse engineering tools and a standalone CLI
- โStatic JavaScript and Electron analysis with no execution, no emulator, and only Node.js required
- โNative binary analysis via Hopper (macOS/Linux), Ghidra (Linux/macOS, experimental Windows), or IDA Pro
- โEvidence bundles that record findings, limitations, and unknowns for every investigation
- โImport older source trees as historical reference and compare Evidence bundles across runs
- โCLI supports targeted commands: open, analyze, decompile, capture-process, and snapshot reuse
- โFirmware region inspection and APK static analysis with separate tooling
- โWorks from the terminal without an agent or as an integrated MCP service to supported agents
Installing REA and connecting your agent
Node.js 22.x or newer and npm are prerequisites. Run `npx rea-agents setup` for guided agent registration and engine detection. The command installs the REA skill, registers the MCP server with selected agents, and can install Hopper with your approval. Ghidra and IDA Pro require separate installation before setup; the README has the version requirements. On Linux, add `~/.local/bin` to your PATH if the installer placed `rea` there. After setup, verify readiness with `rea doctor --json` before running analysis.
Investigating an app with your agent
After setup, restart your agent and describe the app or feature you want to understand. For JavaScript or Electron targets, run `rea analyze /path/to/app.asar --json` directly from the terminal without any additional engine. For native binaries, ensure Hopper, Ghidra, or IDA Pro is installed and selected with `--provider`, then use `rea analyze /path/to/binary`. Pass `--snapshot /path/to/analysis.json` to cache a successful result and reuse it on matching runs. The agent collects Evidence throughout the session and reports conclusions with their limitations when you ask.
What you can do with REA
- โขAsk your agent to explain how search works in a competitor's app, show the evidence, and build a similar feature in your own project
- โขInspect a macOS .app bundle for XPC services, login items, and privileged helpers without executing it
- โขDecompile a native binary with Ghidra and get pseudocode, function names, and observed memory ranges back with documented gaps
- โขMap a JavaScript/Electron application directory or ASAR archive to its call graph and recovered structure without running it
- โขCompare Evidence bundles from two versions of an app to find what changed in the implementation
- โขImport an older source release as a reference baseline and investigate how architecture evolved
Key advantages of using REA
- โTurns reverse engineering into an agent task rather than a manual one
- โAnalysis runs locally. No binaries or data are uploaded to a hosted service
- โEvidence bundles record what was found and what could not be resolved, so findings are auditable
- โCLI-first design lets you use it standalone without an agent, then connect the same tools to your agent later
- โConnects to multiple analysis engines. You pick Hopper, Ghidra, or IDA Pro depending on what you already own
Requirements, constraints, and gaps
- โณNative binary analysis depends on a separate Hopper, Ghidra, or IDA Pro installation. Hopper costs money; Ghidra requires manual install and a JDK; IDA Pro is commercial
- โณWindows native binary support is experimental. The README describes x86-64 PE analysis on local NTFS as a P0 effort with its own guide and release boundary
- โณStatic JavaScript analysis does not execute code. It extracts structure and strings from ASAR archives and directories
- โณSetup does not install Ghidra, Java, IDA Pro, or the JADX JAR for APK analysis. Those are bring-your-own
- โณThe tool is MIT-licensed and free, but the analysis engines underneath have their own licensing costs
How REA compares to standalone reverse engineering tools
Who should use REA?
Developers using Claude Code, Cursor, Windsurf, or Codex who want an agent to investigate a closed app or understand how a competitor implements a feature. Security researchers who want a reproducible Evidence-based workflow for binary analysis. Teams that need to document how a legacy binary works without rebuilding it from scratch. Skip it if you want a pure manual disassembler without agent integration, or if you only work with open-source code.
Frequently asked questions
The README lists Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, and VS Code as supported. Setup detects and registers with those automatically. Other agents can connect via manual MCP configuration.
Static JavaScript and Electron analysis need only Node.js and no engine. Native binary analysis requires one of the three. Hopper needs a separate license; Ghidra is free but you must install it yourself along with JDK 21; IDA Pro is commercial and uses an existing ida-pro-mcp registration.
Experimental Windows x64 Ghidra support is available on local NTFS for native x86 and x86-64 PE applications. The README labels it P0 and mentions a release boundary for x86-64. Native binary support on mainstream Windows remains limited compared to macOS and Linux.
REA itself is MIT-licensed and free. However, Hopper has its own commercial license, and IDA Pro is a paid product. Ghidra is free but requires a separate JDK installation. REA does not bundle any of these engines.
JavaScript and Electron apps, .NET assemblies, websites, native binaries in PE, ELF, and Mach-O formats, APKs via JADX, and macOS .app bundles. Coverage varies by platform. Static analysis works without execution; deep native analysis needs an engine.
All analysis runs on your local machine. REA does not upload binaries or results to any hosted service. When using Ghidra, REA analyzes a temporary copy and removes the temporary project when the session closes.
The problem it solves
Reverse engineering is slow and manual. You spend hours in a disassembler, take notes on what you find, and start over for every new target. When you work with an AI coding agent on your project, you cannot ask it to look at a competitor's app and explain how a feature works. The agent has no way to inspect binaries, decompile code, or recover structural information from a closed application.
Related repositories
Is rea worth your time?
ChatGPT, Claude and Perplexity can all read this page. Ask one of them what it makes of rea.