REA: Reverse Engineer Anything with an AI Agent

REA links an AI agent to the reverse-engineering tools already on your machine — Ghidra, Hopper, IDA, and more — so it can trace code and explain what a binary or app actually does.

Open source Node.js MCP GitHub: morluto/rea

Repository: github.com/morluto/rea

What REA does

REA (short for Reverse Engineer Anything) hands your AI agent a set of local inspection tools. Instead of pasting decompiled code back and forth by hand, the agent drives the analysis itself. It points a decompiler at a target, reads the output, follows the relevant code paths, and comes back with findings plus the evidence behind them.

Analysis stays on your machine. The tool doesn't upload your target anywhere — what leaves your computer depends on the model provider you pick and its data policy.

How it works

The flow is straightforward:

  1. You pick a target — a native binary, a JavaScript or Electron app, a .NET assembly, an Android APK, a WASM file, or a website.
  2. The agent calls REA through MCP (Model Context Protocol). REA runs the right decompiler or analyzer for the target type.
  3. REA returns code, references, and unknowns. The agent reads that, then explains the behavior, implements a fix, or writes a test — whatever you asked for.

Under the hood, REA picks the engine that fits. Deep native work uses Hopper, Ghidra, or IDA. Android goes through JADX or JEB. Other targets may pull in GNU objdump, Rizin, pwntools, WABT, or TShark depending on what you're analyzing. JavaScript and .NET static analysis needs no native engine at all.

REA is the glue and the toolchain. The LLM that reasons over the output is whatever model provider you configure, and you supply its API key.

Installing REA

REA ships as an npm package, so you need Node.js first. Supported versions are 22.x (22.19 or newer), 24.x (24.11 or newer), and 26+, plus npm.

Install it globally:

npm install --global rea-agents

Or run the setup without a permanent install:

npx rea-agents setup

After installing, you can pull updates with:

rea update

Quick start

Once installed, point REA at a target. Here's a JavaScript application analysis, which runs with no extra native engine:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

For native binaries, install one of the supported engines (Ghidra, Hopper, or IDA) first, then run the matching native-analysis command. Android APK analysis expects JADX and a full JDK. Check the README for the exact per-target commands — they follow the same analyze-<target> shape.

What people use it for

Understanding legacy code

You have a compiled program and no source, or the source drifted from the build. REA walks the binary and explains what each piece does, so you can document or refactor it.

Authorized security audits

When you're allowed to test software, REA speeds up finding the interesting code paths — where input is parsed, where data is stored, where trust boundaries sit.

Malware analysis for defense

Defenders use REA to unpack and understand samples so they can write detections and clean up infected systems.

CTF practice

Capture-the-flag challenges are mostly "here's a binary, find the flag." REA shortens the grind from reading disassembly to reasoning about behavior.

Interoperability

Figuring out a file format or protocol so your own tool can read it, without any source or docs.

Only reverse engineer software you own or are authorized to analyze. REA is a research and defense tool — use it within the law and the target's license terms.

FAQ

Is REA free?

Yes, the tool is open source. You pay only for the LLM provider you configure.

Do I need to install Ghidra or IDA?

Only for native binaries. JavaScript, .NET, and website analysis runs without a native engine. Android needs JADX and a JDK.

How does REA connect to my AI agent?

Through MCP (Model Context Protocol). Your agent calls REA as a tool, and REA returns code, references, and unknowns.

Which model providers work with REA?

REA is provider-agnostic — you bring the model and its API key. Each provider's data policy differs, so review it before analyzing anything sensitive.

Can I use it on production software?

Technically yes, if you have the right to. Practically, REA shines on targets you already own or have authorization for.