REA: Reverse Engineer Anything with Autonomous Agents, from App Behavior to Native Binaries

Every developer knows the frustration of meeting a feature they admire and having no way to learn how it was built. The source is closed, the binary is stripped of symbols, and the Electron app ships as a single ASAR archive. The traditional answer was to hire a reverse engineer who would spend days or weeks reading a disassembler line by line. REA, short for Reverse Engineer Anything, is an open-source project on GitHub that tries to change that workflow. Its pitch is plain: one MCP server that gives your agent reverse-engineering tools across native binaries, applications, and runtime behavior. It uses the MIT license, ships as the npm package rea-agents, and according to its README has passed 60,000 GitHub stars, with documentation in nineteen languages. For a tool that sits between security research and everyday software engineering, that level of attention says a lot about real demand.

The way REA works is not mysterious. You run npx rea-agents setup, choose which agents you use, review the proposed changes, and approve them. Setup registers REA's MCP server, installs matching workflow instructions, and backs up existing configuration. The README names Claude Code, Codex, Cursor, Gemini CLI, and Grok Build, and says any agent that supports local MCP servers can use it. After a restart you ask in plain language: understand how search works in a given app, show the evidence, and build a similar feature for my project. The agent calls REA through MCP to inspect the target and trace the relevant code. REA returns findings together with their evidence, including code, references, and the unknowns that remain. The agent then asks follow-up questions, explains the behavior, or writes and tests an implementation. The same workflows are available from the terminal as ordinary commands, so a human can reproduce what the agent did.

What gives the project weight is the range of targets it covers. According to the README table, REA returns pseudocode, assembly, strings, symbols, calls, and references for native binaries, backed by Hopper, Ghidra, or IDA. For JavaScript and Electron applications it recovers modules, imports, source maps, routes, IPC, and native add-on relationships, and this part needs only Node.js, with no native analysis engine at all. It also inspects websites, saved HAR network captures, .NET assemblies down to metadata and CIL instructions, Android APKs and devices, firmware images, EVM bytecode, offline ELF layouts, and recorded Linux crashes. A process-behavior mode captures terminal output, interactions, exit status, and filesystem observations, then compares runs. In practice, one agent session can follow an Electron feature from the renderer to the main process and then down into the assembly of a native add-on. Work that once meant switching between five or six unconnected tools is now gathered into one tool catalog.

The three showcases in the README mark the boundary of what this looks like in practice. In the DX-Ball case, the investigation starts at a sound call, follows it into a position-to-pan helper, inspects the instructions, and turns incomplete pseudocode into C. The README states that the reconstruction passes 3,205 original-x86 cases and reproduces all 63 compiled function bytes. In the Notion case, the agent finds the renderer's clipboard API, follows it through preload and IPC into the main process, and inspects the rich clipboard format. In the TH04 case, it reads the 16-bit instructions of the original PC-98 game, recovers the fixed and aimed angle calculations, and compares the reconstructed C++ with the historical compiler output. The difficulty differs, but the pattern is the same: the conclusion does not come from the model's impression of what code probably does. It rests on instruction-level evidence that a person can recheck, and on tests that confirm the result. That is the principle the project repeats most often: every conclusion carries its evidence and its limitations.

From an industry view, REA is a clear example of a trend worth watching. Specialist tooling is wrapped in a protocol that agents can call. The language model handles planning and explanation, while deterministic analysis engines handle evidence gathering. The README is explicit about locality: analysis runs on your machine, your agent receives the tool results, and what the model provider does with those results follows that provider's own data policy. This division of labor reduces the risk of a model guessing at binary behavior, and it makes the whole process easier for a security team to audit. Some caution is still needed. Runtime capture runs or interacts with the chosen target using your user permissions, so read the relevant guide before you use it. The project also states that it is meant for lawful reverse-engineering research, that you are responsible for authorization and legal compliance, and that it has issued no cryptocurrency or token. For developers and security teams, a sensible next step is to try it once on software you own, check whether the evidence chain survives your own review, and only then decide whether it belongs in your daily workflow.