REA: Reverse Engineer Anything with Agents

What does this agent do, and when should you use it?

REA is a reverse-engineering toolkit for coding agents, shipped as the npm package rea-agents with both a `rea` CLI and an MCP server that share one evidence contract and one investigation model. It wraps a deep-analysis provider — Hopper on macOS/Linux (demo mode supported) or a bring-your-own Ghidra 12.1.4 on Linux/macOS plus an experimental Windows x64 P0 — and exposes it through tools such as `open_binary`, `binary_overview`, `search_strings`, `find_xrefs_to_name`, `get_call_graph`, `procedure_pseudo_code`, and `batch_decompile`. Beyond native analysis it covers passive CDP website observation, attach-only Node/Electron V8 Inspector observation, JavaScript and source-map reconstruction, ASAR/package structure mapping, managed PE/CLI triage, and controlled process capture with comparison. Every successful call is recorded as deterministic Evidence with artifact and provider identity, confidence, authority, and limitations, exportable as bundles or reusable as snapshots. Analysis runs entirely on your local host — REA provides no hosted service and never uploads the target. It deliberately does not claim to recover original source code.

After setup, REA probes for local agents (Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin), writes MCP registrations additively and backup-first, and installs the matching routing skill. On each deep-analysis open it resolves a provider — request-level --provider/provider_id beats REA_ANALYSIS_PROVIDER, auto binds only a sole usable candidate and reports ambiguous otherwise, and runtime failure never triggers silent fallback. Commands like rea analyze, rea decompile, rea function, rea xrefs, and rea trace return the same Evidence envelopes as MCP; an MCP session can retain a live target and evidence ledger, and snapshot_path atomically imports a snapshot in open_binary or saves one in close_binary. Other surfaces include inspect-managed-artifact for PE/CLI metadata and CIL hashes, list-browser-targets/inspect-web-page for passive CDP capture, list-javascript-runtime-targets/observe-javascript-runtime for lifecycle metadata only, and capture-process/capture-browser-scenario for explicitly approved, per-call-granted behavioral capture.

1. A product team sees a search or offline-caching feature in a shipped app with no source access and wants the agent to explain it, show evidence, and rebuild it for their own stack.
2. A reverse engineer or security analyst needs to trace a suspicious string, symbol, or IPC channel all the way to the routine that implements it while keeping an auditable evidence chain.
3. A developer handed an Electron app wants to statically reconstruct its ASAR modules, entrypoints, preload, and IPC graph without executing bootstrap code.
4. Someone comparing two releases needs to find the first behavioral divergence across terminal output, filesystem, or protocol dimensions rather than eyeballing diffs.
5. A maintainer of legacy .NET/CLI assemblies wants read-only metadata and P/Invoke boundary triage without loading the assembly or resolving CLR dependencies.
6. A team that must reproduce analysis wants to freeze successful calls into snapshots or Evidence bundles and replay the same query without relaunching a provider.

How do you install or deploy this agent?

The recommended path is the reviewed setup wizard, which prints its full plan, exact paths, and external effects before a final confirmation that defaults to No:

npx --yes rea-agents@latest setup

To get a shell-visible rea command instead:

npm install --global rea-agents
rea setup
rea doctor

Setup configures Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, and Windsurf when detected; Devin is reported but left unchanged. Deep native analysis needs a provider: setup can install Hopper (official DMG to ~/Applications on macOS; pinned 6.4.2 package with checksum verification on Ubuntu 24.04+, Fedora 41+, Arch), while Ghidra is strictly bring-your-own:

export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
export JAVA_HOME=/absolute/path/to/jdk-21 # optional when java and javac resolve from PATH
rea doctor --json
rea providers --json

Requirements: macOS 12+, Ubuntu 24.04+/Fedora 41+/64-bit Arch Linux, with Windows x64 only for the experimental Ghidra P0; Node.js 22.19+ or 24.11+.

How do you use this agent?

After setup, restart any configured agent so it loads the aligned MCP registration and routing skill, then describe what you want investigated:

Reverse engineer the Notes app. Find how offline search works, explain it,
and build a version for my project using TypeScript and SQLite.

For a one-off terminal overview:

npx -y rea-agents@latest analyze /Applications/Notes.app
npx -y rea-agents@latest inspect /Applications/Notes.app
npx -y rea-agents@latest trace /Applications/Notes.app "offline"

Manual configuration for any client that supports local MCP servers:

{
  "mcpServers": {
    "rea": {
      "command": "npx",
      "args": ["-y", "[email protected]", "mcp"]
    }
  }
}

Reuse an approved result without relaunching a provider:

rea analyze /absolute/path/to/app --snapshot /absolute/path/to/analysis/app.json

Browser and runtime observation are off by default and need literal loopback endpoints plus approved origins:

export REA_BROWSER_OBSERVE_ENABLED=true
export REA_BROWSER_CDP_ENDPOINTS_JSON='["http://127.0.0.1:9222"]'
export REA_BROWSER_ALLOWED_ORIGINS_JSON='["http://127.0.0.1:3000"]'
rea inspect-web-page http://127.0.0.1:9222 TARGET_ID --approved --json

What are this agent's strengths and limitations?

How does this agent compare with similar options?

Key facts side by side with the most closely related agents.

How does FollowAgents rate this agent?

FAQ