What is REA?

REA (Reverse Engineer Anything) is an open-source toolkit that connects a coding agent to reverse-engineering workflows. Instead of asking users to manually search a program for every relevant function, call or request, REA gives an agent structured tools for inspecting software and returning evidence it can explain. Its intended users include developers studying an application they own or are authorized to examine, maintainers reproducing behavior, and researchers documenting how a feature works.

A user supplies a question and a target such as an application directory, executable, browser page or saved network capture. REA gathers relevant structure and evidence; the agent follows the evidence, asks focused follow-up questions, and can use the findings to implement a similar behavior. Examples on the site include tracing an Electron export button into its CSV writer and reconstructing a calculator percentage rule from native instructions and calls. REA provides analysis tools and workflows; the coding agent supplies the explanation and any new implementation.

The toolkit spans several target types, but their requirements differ. Static JavaScript and .NET inspection do not need a native decompiler. Native binaries need a configured provider such as Ghidra, Hopper or IDA, while browser observation needs a Chrome-family browser and a local debugging connection. REA is therefore an evidence-gathering layer around analysis engines and coding agents, rather than a single universal decompiler.

Key Features

JavaScript and Electron application maps

Point the CLI at an application folder or ASAR archive. REA maps modules, imports, routes and Electron boundaries, then helps trace a feature across files. The published Electron example follows an export action from a renderer API through preload and IPC to the main-process handler and CSV writer. Source locations help a developer continue the investigation. Computed channel names and ambiguous handlers may remain unresolved, so findings still need inspection.

Native binary investigation

With a supported analysis provider configured, an agent can inspect functions, instructions, pseudocode, strings, references and callers. REA's DX-Ball guide combines an integer input, a caller-provided screen coordinate and referenced constants to recover a sound-panning calculation. The guide reports a separate comparison over 3,205 original inputs and byte-for-byte reproduction of the compiled function. These are results for that case study, not a guarantee for every binary or provider.

Browser and runtime observation

For a browser workflow, REA can connect a user action with its network request and the code that handles the response. The Notes example records the request and response shape after an export click, then follows the request to the JavaScript that creates a CSV download. This adds runtime context when static source inspection leaves uncertainty. The documented workflow requires a Chrome-family browser and local debugging access.

Agent and CLI workflows

The setup command registers REA with supported MCP clients and installs matching investigation instructions. Users can ask a coding agent a plain-English question or call REA's analysis commands directly from a terminal. The setup process presents a plan for review before changing agent configuration; it also supports backups of existing configuration.

How to Use REA

Install a supported Node.js version (22.19+, 24.11+, or 26+) with npm, then run npx rea-agents@latest setup.
Choose the coding agent, inspect the proposed setup changes, approve them, and restart the client. Connect a native provider or browser debugging session only if the target type needs one.
Give the agent an authorized target and a narrow question, such as where an Electron export is written or which function handles a particular native action. For a direct CLI analysis, use the command documented for the target type.
Read the returned source locations, instructions, call relationships or runtime observations. Ask follow-up questions where a result is unresolved, then independently check the reconstructed behavior before reusing it.

Use Cases & Who It's For

Application developers: Trace a feature in an Electron project across renderer, preload, IPC and main-process files before reproducing or changing it.
Compatibility and preservation researchers: Recover behavior from software they are authorized to examine, then document the relevant instructions, calls and constants.
Web developers: Observe a browser interaction and connect its network response to the JavaScript that processes it.
Security and debugging teams: Use source locations and structured observations to narrow an investigation; REA does not replace a full security review or prove that a target is safe.

Pricing & Free Plan

REA is an open-source project, and its repository licenses REA-authored code under MIT. The official website publishes an npm-based setup flow and links to that license, but the pages reviewed do not list subscription plans or a separate REA price. This listing classifies the REA software itself as free; that does not include third-party software or model-provider charges.

Provider costs are separate. The official guide describes Ghidra as free, while Hopper offers a demo or licensed use and IDA is an external tool with its own licensing. REA does not provide a license, key or activation entitlement for commercial analysis tools. Check each provider's current terms and price before installing or automating it. Pricing checked on 2026-10-12.

Strengths & Limitations

Strengths

Connects agent questions to concrete code and evidence such as source locations, instructions, calls and observed requests.
Covers static application analysis, native binaries and browser activity through one agent-oriented workflow, with CLI commands for terminal use.
The setup guide asks users to review configuration changes before applying them.

Limitations

Requires a supported Node.js/npm environment and a coding agent that supports local MCP servers for the agent workflow.
Native analysis depends on an available provider and its host, format and license requirements. Browser analysis has separate browser/debugging prerequisites.
Official materials describe evidence and unresolved findings, not guaranteed coverage; computed or ambiguous relationships may need manual follow-up.
REA says targets are analyzed locally, but tool results go to the connected agent and the model provider has its own data policy. Review that provider's terms before using sensitive code.
Use REA only for software you own or are authorized to analyze; the project does not grant rights to third-party targets or commercial tools.

Alternatives & When to Choose It

REA is most useful when you want an agent to follow a question through an application's code or runtime evidence. If you want to inspect a native program directly in a traditional analysis interface, use an analysis engine such as Ghidra or a licensed product such as Hopper or IDA; REA can connect to some of these as providers, so they are components rather than exact substitutes. Choose a standalone tool when you prefer to drive the investigation manually, and choose REA when you want MCP tools and workflow instructions to help an agent collect and explain evidence. Provider compatibility and licensing vary by platform.

Frequently Asked Questions

Does REA upload the application being analyzed?

The project documentation says REA analyzes targets locally. Results are returned to the connected agent, and the model provider follows its own data policy, so check that provider before sending sensitive material.

Do I need Ghidra, Hopper or IDA?

Only deep native analysis needs one of these providers. The setup guide says static JavaScript and .NET inspection do not need a native analysis engine. Browser observation has its own Chrome-family browser requirement.

Does REA work with any coding agent?

The documented setup supports a list of MCP clients, including Claude Code, Codex, Cursor, Gemini CLI and others. Other clients can be configured manually if they support local MCP servers.

Is Hopper included with REA?

No. REA does not grant a Hopper license or activation key. The native guide explains that Hopper has its own demo/license choice; verify Hopper's current vendor terms for your intended use.

What should I do when an analysis result is incomplete?

Follow the unresolved call, value or source location with a narrower question. The official guides note that ambiguous handlers and unresolved relationships can remain, so inspect the underlying evidence before relying on a reconstruction.

Sources & Verification

Official website: https://rea.tools/
Setup and requirements: https://rea.tools/get-started/
JavaScript and Electron analysis: https://rea.tools/guides/javascript/
Native analysis: https://rea.tools/guides/native/
Browser and runtime analysis: https://rea.tools/guides/browser/
FAQ: https://rea.tools/faq/
Repository and MIT license: https://github.com/morluto/rea
Last checked: 2026-10-12
Verification: Official pages and the linked project repository were reviewed. The pages' setup instructions, examples, requirements, provider boundaries, license notes and published outputs were checked. REA was not installed or run on a separate target during this review.

REA

Overview