REA Reverse Engineering Assistant
Analyze binaries and firmware with one local command and receive ready-to-read reports.
- Source repo
- mytechnotalent/rea
- Stars
- ★ 76
- Last updated
- 2d ago
- License
- MIT
- Primary language
- Rust
- FA score
- 47/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude Code
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A reverse engineer needs a quick triage of a PE, ELF, Mach-O, or raw firmware file, including hashes, imports, and mitigations.
- Not a fit if
- Teams that require every report to be authored by AI
- Users unwilling to run a local command-line tool
- Source review
- 47/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
REA is a Rust-based autonomous reverse engineering framework, primarily used locally with rea <file>. It detects formats from file contents and writes Markdown, PDF, and JSON reports; deterministic analysis also works offline without an AI API key. With an OpenRouter API key configured, REA can run a tool-calling analyst loop in which a model inspects the target and authors the report. It also provides an MCP server through rea serve for interactive use by MCP clients. Building from source requires the stable Rust toolchain, and the README documents build targets for Windows, macOS, and Linux.
Run rea <path-to-target> and REA inspects the file format, hashes, entropy, sections, imports and exports, mitigations, strings, and indicators, then applies target-specific disassembly, call-graph recovery, emulation, or format inspection. It writes Markdown, PDF, and JSON reports beside the target; focused commands include decompile, strings, decrypt, rules, audit, unpack, and emulate. With OPENROUTER_API_KEY set, the autonomous analyst can call tools to inspect the target and produce report sections; without it, REA uses the deterministic offline path. Running rea serve exposes analysis tools over JSON-RPC 2.0 on stdio for interactive use by an MCP client.
- A reverse engineer needs a quick triage of a PE, ELF, Mach-O, or raw firmware file, including hashes, imports, and mitigations.
- A malware analyst needs to extract indicators such as URLs, IPs, and file paths, then inspect call graphs or decrypt hidden strings.
- A firmware auditor needs to inspect U-Boot images, SquashFS filesystems, or ARM Cortex-M firmware for files and credential clues.
- A security team wants deterministic initial sample analysis without configuring an AI service.
- An analyst using Claude Code wants to invoke REA's disassembly, rules, audit, or emulation tools through MCP.
How do you install or deploy this agent?
Building from source requires the stable Rust toolchain. The repository documents this Linux x64 build:
git clone https://github.com/mytechnotalent/rea.git
cd rea
rustup target add x86_64-unknown-linux-gnu
cargo build --release -p rea --target x86_64-unknown-linux-gnuYou can also install a native build onto PATH:
cargo install --path crates/reaThe README says prebuilt macOS Apple Silicon binaries are in releases/; it documents source builds for Windows and Linux. Autonomous AI analysis requires an OpenRouter API key; the key is not required for offline analysis.
How do you use this agent?
Run the one-shot analysis command. REA writes three report files beside the target:
rea <path-to-target>For example:
rea ./sampleFor interactive analysis, start the MCP server:
rea serveClaude Code setup example:
claude mcp add rea rea serveTo enable AI analysis, set the key in the environment or in a .env file in the current or an ancestor directory:
OPENROUTER_API_KEY="sk-or-v1-..."OPENROUTER_MODEL is an optional model setting. Without a key, REA uses deterministic offline analysis.
What are this agent's strengths and limitations?
- Generates deterministic reports fully offline without an API key; the README says this path makes zero network requests.
- A single command produces Markdown, typeset PDF, and machine-readable JSON reports.
- Covers many executable, firmware, and artifact formats, with disassembly, emulation, indicator extraction, and rule checks.
- The MCP server supports clients including Claude Code, and
rea mcp --setupcan write configuration.
- Building from source requires the stable Rust toolchain; the README only identifies prebuilt binaries for macOS Apple Silicon.
- Autonomous AI analysis requires an OpenRouter API key; the README does not state API pricing.
- Offline mode is a deterministic technical-report path and does not include the model-authored analysis described for AI mode.
- The README does not document embedding REA as a library in another program.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| REA Reverse Engineering Assistant This agent | 47 · Major gaps | CLIFree + model costs | ★ 76 | 2d ago | Rust | Claude Code |
| LitterBox Payload Sandbox | 52 · Major gaps | CLIFree | ★ 1.6k | 5mo ago | YARA | — |
| Open Claude in Chrome | 40 · Major gaps | MCP serverFree + model costs | ★ 254 | 26d ago | HTML | Claude Code |
| Flow-Like | 55 · Major gaps | Desktop appFreemium | ★ 962 | today | Rust | — |
How does FollowAgents rate this agent?
Why each dimension lost points
The README says REA reads a target and writes Markdown, PDF, and JSON reports beside it, with an optional 90-turn OpenRouter tool-calling analyst. This makes the main data flow visible (data_flow_transparency 2). It does not describe overwrite confirmation, output permissions, or rollback (user_confirmation 1, rollback 0), and gives no handling guidance for API keys or secrets and credentials that may appear in reports (sensitive_data_handling 1). The CLI and MCP capabilities are broad, with no fine-grained permission controls described (least_privilege 1). Network use is optional, but the scope of data sent and other external effects are only lightly described (external_effects 1). The workspace and MIT license are identified, but the supplied files show no dependency audit or security maintenance evidence (dependency_security 1). Cargo.toml names an author and repository, providing limited attribution (source_attribution 2); publisher identity remains unknown as specified.
The README distinguishes offline operation without an API key from optional AI operation and describes a pure-Rust implementation. However, absolute claims such as support for “any file” and that malformed or hostile inputs “can never compromise the host” are not substantiated by the supplied code or tests, and exceed what the provided documentation and few fixtures can establish (self_consistency 1). Rust toolchain and cross-platform build steps are provided, and the README says external reverse-engineering tools are unnecessary (dependency_availability 2). The supplied material does not explain dependency locking, failure messages, or error handling (failure_messages 0).
The README identifies reverse engineering as the audience, lists many formats, CLI subcommands, and MCP use, and gives clear invocation examples (audience_and_scenarios 2, trigger_precision 2). It lists extensive capabilities but does not adequately state unsupported cases or the boundaries of model tool permissions (capability_boundaries 1). Windows, macOS, and Linux build/use instructions and an offline path are provided (environment_fit 2).
The README is organized into feature, format, usage, MCP, configuration, and build sections, with practical command examples (information_architecture 2, examples_and_faq 2). It provides Rust installation and platform build/install instructions (install_notes 2); project, command, and version naming are consistent across the supplied files (naming_stability 2). The supplied material has little explicit limitation guidance and does not bound broad safety and support claims (known_limitations 1). The LICENSE contains complete MIT terms and copyright information (license 3). The README identifies v5.6.1 and summarizes changes, but the supplied material does not show a fuller release history (versioning_changelog 2). Cargo.toml names an author, but the supplied files do not identify maintenance responsibility or an update path (maintenance_responsibility 1).
The README describes Markdown, PDF, and machine-readable JSON outputs and lists analysis commands, making results usable for people and downstream processing (output_usability 2). Multi-format reverse engineering, rule matching, and an MCP interface indicate potential value beyond manual, one-off analysis (marginal_value 2). The supplied evidence does not establish report accuracy, coverage, or actual operating cost, so cost-benefit is only partly supported (cost_benefit 1).
Some README details, including commands, filenames, version, and Rust workspace, correspond to Cargo.toml or LICENSE, but most capability and safety claims have no supporting implementation or test evidence in the supplied files (claim_traceability 1). README, Cargo.toml, and LICENSE corroborate the project name, version, Rust, and MIT information; the three shell fixtures show HTTP requests aimed at router vulnerabilities but do not verify the core analysis features (cross_source_corroboration 1). The README sometimes presents capabilities and safety outcomes as certain without distinguishing claims from results established by the supplied evidence (fact_inference_separation 1).
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Configuring an API key enables networked analysis; do not submit samples containing sensitive information or secrets unless you have confirmed how the data is handled.
- The README's absolute claim that hostile inputs cannot compromise the host is not established by the source material supplied for this review.
- The test fixtures include requests for router command injection, path traversal, and authentication bypass, and may read device configuration or shadow files; use them only in an explicitly authorized, isolated environment.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
REA v7.0.0 — Understand & Trust: read the binary like an analyst and attribute where it came from. Pure Rust, offline, every claim tied to the addressable evidence bundle. Decompiler quality - Conditions render from the controlling cmp/test operands: if (rbx < r8). - Pre-tested loops hoist into real while (cond) instead of while (true). - cbz/cbnz render as explicit zero tests: if (r3 != 0). - Widening loads cast to their true integer type: eax = (uint16_t)*(r14). Behavioral & cross-format …View on GitHub ↗ -
Release notes excerpt
REA v6.0.2 makes the CI gate pass on clippy 1.99. - Empty-collection assertions. Test assertions now use assert_eq!(… .len(), 0) / assert_ne!(… .len(), 0) instead of assert!(… .is_empty()), which the newer clippy::assert_is_empty pedantic lint rejects. No behavior change. Fixes the red CI introduced by adding the workflow in v6.0.0.View on GitHub ↗ -
Release notes excerpt
REA v6.0.0 makes every finding addressable, reproducible, and re-verifiable — offline, with nothing installed. Highlights - Evidence bundle. Every one-shot writes re-<name>.evidence.json: a versioned, canonical bundle with target identity, coverage, explicit unknowns, and one item per finding — each with a content-addressed ID (ev_<hex>, SHA-256 of kind|subject|detail|address) and a confidence level. - rea evidence <file> writes the bundle on demand. …View on GitHub ↗
FAQ
Can REA analyze files without an API key?
Where are reports saved, and what formats are produced?
Which operating systems are documented?
Can I use REA from Claude Code?
rea serve, then add it with the documented command claude mcp add rea rea serve.