REA morluto/rea: Reverse Engineer Anything With an Agent

What is REA (morluto/rea)?

REA is a TypeScript project by morluto that turns the slow, manual parts of reverse engineering into tool calls an agent can make. Instead of one decompiler window it exposes a catalogue of inspections: native analysis through Hopper, Ghidra or IDA, WASM validation, EVM bytecode dispatch, .NET metadata, APK decompilation, firmware extraction, HAR captures and live process capture.

The repository passed 105.8k stars in October 2026 and ships on npm as rea-agents (6.4.0) under the MIT licence. What separates it from a script library is provenance: every result returns the code it found, the references it followed and the unknowns it could not resolve, so the agent can show its work instead of guessing. The model is not asked to recognise a binary — it is asked to ask the next question.

How REA works with your agent

Your agent talks to REA over MCP, the same local-server protocol it already uses for shells, browsers and editors. The loop is short: the agent asks REA to inspect or trace a target, REA answers with findings and their evidence, and the agent uses them to explain the behaviour, ask a follow-up question, or write and test a replacement implementation.

The CLI runs the same workflows, so anything you can do inside an agent session you can also script: npx -y rea-agents@latest analyze-javascript-application /path --json prints structured results that drop straight into a pipeline.

What you can reverse engineer with REA

• Native binaries — pseudocode, assembly, strings, symbols and call references through Hopper, Ghidra or IDA, including 16-bit DOS targets.
• JavaScript and Electron apps — modules, imports, source maps, routes, IPC channels and native add-on relationships.
• Websites — page structure, scripts, network observations and screenshots from a Chrome-family browser.
• Saved network captures — the requests, responses and exposed payloads in a HAR file, with the source locations that produced them.
• .NET assemblies — metadata, CIL instructions and declared native dependencies, read statically.
• Android — APK manifests and decompiled methods, device packages, logs and screen captures, JEB projects and resource tables.
• WASM artifacts, EVM bytecode, offline ELF layout and recorded Linux crashes — validation, WAT forms, dispatch selectors, registers and signals.
• Firmware and packages — regions, extraction results, file inventories and digests, down to plist and Apple bundle anatomy.
• Process behaviour — terminal output, interactions, exit and filesystem observations, plus before-and-after run comparisons.

Static JavaScript and .NET inspection reads files without running anything. Runtime capture does execute or interact with the target, using your own user permissions; each guide spells out the effects first.

Install and first run

REA needs Node.js 22.x (>= 22.19), 24.x (>= 24.11) or 26+, plus npm. Registering the MCP server with your agent is one command:

• npx rea-agents@latest setup — installs REA and registers the MCP server with your agent.
• npx -y rea-agents@latest analyze-javascript-application /path --json — run one analysis without installing anything.
• npm install --global rea-agents, then rea update — keep a global copy current.

Deep native analysis needs Hopper, Ghidra or IDA; REA drives whichever you already have and can start Hopper itself when an operation asks for it. Static JavaScript and .NET inspection needs no native engine at all. On very large binaries you can raise the provider startup deadline with REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.

Three things people have already taken apart

• DX-Ball's sound pan — a reconstruction that passes 3,205 original x86 cases and reproduces all 63 compiled function bytes.
• Notion's clipboard bridge — the Electron IPC path behind copy and paste, traced through the packaged application.
• TH04's bullet ring — a PC-98 DOS shooting-game effect, reconstructed and then compared with the historical compiler output.

The longer write-ups for each showcase live at rea.tools, and the guides there cover each supported target type end to end.

FAQ

Which agents can use REA? Any agent that supports local MCP servers. Setup configures the ones it knows about — Claude Code, Codex, Cursor, Gemini CLI and Grok Build — and other clients can register the server manually.

Do I need Hopper, Ghidra or IDA? Only for deep native analysis. JavaScript, .NET and several other targets are inspected statically, with no native engine installed.

Does REA upload my application? No. Analysis runs on your machine and the results stay there. Whether the agent shares its findings with a model provider is a separate policy you control.

What can it do that a plain decompiler cannot? It answers questions across file types and returns the evidence for each answer, which is what lets an agent explain a behaviour, reproduce it, and then implement and test a replacement.

Where to go next

If this is the kind of tooling you follow, the other boards here track it: AI agent skills trending on GitHub, today's trending board and the trending history archive. The repository itself is at github.com/morluto/rea, the package is rea-agents on npm, and the project site with the guides is rea.tools.