What is REA? An unofficial overview of Reverse Engineer Anything

Last updated: · By the RepoRead editorial team · Unofficial guide
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine. This page is not the official REA documentation.
Quick answer

REA 6.5.0 (released October 14, 2026) is the current version of REA: Reverse Engineer Anything, an open-source MCP server plus CLI at morluto/rea that connects AI coding agents to local reverse-engineering tools. You ask your agent about a local binary, Electron app, Android APK or similar target you are allowed to analyze; REA inspects it with engines such as Ghidra, Hopper, IDA or JADX, or with its own static analyzers, and returns findings with the evidence and limitations behind them.

  • License: MIT for REA-authored code; third-party parts keep their own licenses.
  • Install: npx rea-agents setup (Node.js 22.19+, 24.11+ or 26+).
  • Official channels: github.com/morluto/rea, rea.tools and the rea-agents npm package.
On this page

Project facts

ProjectREA: Reverse Engineer Anything
Upstreammorluto/rea
LicenseMIT
npm packagerea-agents (commands rea, rea-agents)
Latest release6.5.0, October 14, 2026
VerifiedOctober 17, 2026 (UTC)

What REA does

The project describes itself as "one MCP for reverse engineering across binaries, applications, and runtime behavior." In practice:

  1. You register REA with an agent that supports local MCP servers (npx rea-agents setup).
  2. You point the agent, or the rea CLI, at a local target you are allowed to analyze.
  3. REA calls an analysis backend and returns structured results: pseudocode, modules, strings, references and evidence views.
  4. Your agent uses those results to explain the behavior or to help you build something similar in your own project.

Static JavaScript and .NET inspection read the files you supply without running the app. Runtime capture (browser, process or device) interacts with the selected target under your user permissions, and each upstream guide describes the effects.

How it works: agent, MCP, tools

Your agent  --MCP-->  REA (local)  --adapters-->  Ghidra / Hopper / IDA / JADX / built-in static tools
            <-- findings + evidence + unknowns --
  • MCP (Model Context Protocol) is the standard way agents call local tools. Your agent calls REA's tools the same way it calls any other local MCP server.
  • The same workflows run as CLI commands, such as rea analyze, rea decompile and rea xrefs. See the CLI cheat sheet.
  • Deep native analysis needs a configured provider (Hopper, Ghidra or IDA). Setup can optionally install Hopper after you approve; Ghidra and IDA use installations you already have.

What you can analyze

The README's capability table lists more than twenty target types. The most common:

TargetWhat comes backExtra requirements
Native binariesPseudocode, assembly, strings, symbols, calls, referencesHopper, Ghidra or IDA
JavaScript / ElectronModules, imports, source maps, routes, IPCNode.js; on Linux a procps-compatible ps
.NET assembliesMetadata, CIL instructions, declared native dependenciesNone (static only)
Android APKsManifest, classes, decompiled methods, referencesHeadless JADX and a full JDK
WebsitesPage structure, scripts, network observationsA Chrome-family browser
Firmware, packet capturesExtraction results, protocol summariesBinwalk/Unblob, TShark, as documented

For exact contracts and limits, open the matching guide under docs/.

Requirements

  • Node.js 22.x (22.19 or later), 24.x (24.11 or later) or 26+, with npm. Node.js 23, 25 and prereleases are unsupported.
  • Linux only: Ghidra, JADX, firmware tools and static JavaScript/Electron analysis need a procps-compatible ps on REA's PATH (install your distribution's procps or procps-ng package).
  • Native analysis: one provider. For Ghidra 12.1 you need a 64-bit full JDK 21 or later; see REA Ghidra setup.
npx rea-agents setup

The full walkthrough is in How to install REA.

Is it official? Where to download

The README warns that a similar repository name or a copied README does not make a download official. Use only:

SourceLink
Source repositorygithub.com/morluto/rea
Website and guidesrea.tools
npm packagerea-agents

RepoRead does not host installers or any other files.

What REA is not

  • Not a license. You must legally obtain IDA Pro, Hopper, JEB and other commercial engines. The README states that cracked copies, stolen keys, unauthorized key sharing and bypassing license restrictions are not authorized.
  • Not a protection-bypass tool. The project's disclaimer says it does not support circumventing DRM, license checks or anti-cheat systems, and such requests are closed without response.
  • Not infallible. Decompilation and AI-assisted analysis can be incomplete or wrong. Review the evidence before you rely on a conclusion.

FAQ

Is REA free?

Yes. REA-authored code is MIT-licensed. Some engines it can drive, such as IDA Pro, Hopper and JEB, are commercial and need their own licenses; REA grants none.

Which agents can use REA?

Any agent that supports local MCP servers. Setup configures Claude Code, Codex, Cursor, Gemini CLI, VS Code, GitHub Copilot CLI, Windsurf and others; some newer client IDs need rea-agents 6.5.0 or later.

Do I need Hopper, Ghidra or IDA?

Only for deep native-binary analysis. Static JavaScript/Electron and .NET inspection work without a native engine.

Does REA upload my app?

The upstream FAQ says REA analyzes targets locally. Your agent receives the tool results, and the agent's model provider applies its own data policy.

Is rea-github.com the official REA site?

No. RepoRead (rea-github.com) is an unofficial guide. The official channels are github.com/morluto/rea, rea.tools and the rea-agents npm package.

Sources