REA Reverse Engineering Workbench
Help an AI coding agent inspect software, trace how a feature works, and rebuild that feature from evidence.
- Source repo
- ringozzt/rea-research
- Stars
- ★ 65
- Last updated
- today
- Primary language
- HTML
- FA score
- 52/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A developer needs to understand one feature in a closed-source desktop application and recreate it in their own stack.
- Not a fit if
- Teams that need a complete recovery of the original source code
- Teams that cannot send analysis results to a model provider
- Source review
- 52/100 · Major gaps
What does this agent do, and when should you use it?
REA is an MCP server and CLI for AI coding agents investigating software without its source code. It connects existing analysis engines such as Hopper, Ghidra, and IDA, along with other providers, into a shared workflow; users supply the engines and any required licences. An agent inspects a binary or application, follows relevant code paths, and receives results with evidence IDs, limitations, and unknowns. Analysis runs locally, but results may pass through the agent to its model provider. REA fits developers and security researchers who need to understand or reproduce specific behavior; it does not recover original source code or clone a complete application.
Through MCP tools and its CLI, REA inspects targets including native binaries, JavaScript/Electron applications, websites, .NET assemblies, Android APKs and devices, firmware, and archive packages. For native programs it calls the user's existing Hopper, Ghidra, or IDA installation; other providers cover tasks such as APK and firmware analysis, browser inspection, and runtime observation. An agent can follow code from a decompiler view through call relationships and across application layers, such as from an Electron renderer through IPC to the main process and a native addon. Tool results include result, evidence_id, limitations, and unknowns; Evidence can be imported or exported as a session bundle and used by compare_functions and compare_artifacts. The agent uses that evidence to explain behavior and can write a feature recreation in the user's own project.
- A developer needs to understand one feature in a closed-source desktop application and recreate it in their own stack.
- A security researcher needs to inspect a local suspicious binary and retain findings with provenance and caveats.
- An Electron developer needs to trace behavior from a renderer through IPC to the main process or a native addon.
- An Android researcher needs to investigate an app using APK analysis or ADB device inspection.
- A firmware analyst needs to inspect firmware contents using providers such as Binwalk or Unblob.
How do you install or deploy this agent?
Install a supported Node.js version, then use the documented setup command. REA does not include a decompiler; native analysis also requires a separately installed Hopper, Ghidra, or IDA and any applicable licence. The README does not provide the exact configuration file contents for each MCP client or complete installation instructions for every provider.
How do you use this agent?
Run the setup wizard:
npx rea-agents setupOr install the CLI globally and run its diagnostic command:
npm install --global rea-agents
rea doctorAfter registering REA with an MCP client and installing the needed analysis provider, use its MCP tools from a supported agent. The CLI follows the same workflow. The README does not provide a general-purpose target-analysis CLI command or an MCP call example.
What are this agent's strengths and limitations?
- Unifies Hopper, Ghidra, IDA, and specialized providers behind a shared MCP tool and evidence workflow.
- Results include evidence IDs, limitations, and unknowns; Evidence can be exported, referenced, and used for function or artifact comparisons.
- Can trace application paths across layers such as Electron renderer, IPC, main process, and native addon.
- Supports the same analysis workflow through a CLI or an MCP client.
- REA does not decompile by itself; native analysis depends on a user-installed Hopper, Ghidra, or IDA, and some engines require commercial licences.
- It does not recover original source code or clone a whole application; obfuscation, packing, and dynamic behavior make reconstruction harder.
- Local analysis does not guarantee end-to-end privacy: tool results may be sent to the model provider through the agent.
- The README documents Node.js version constraints, large analysis outputs, and potentially slow first Ghidra queries.
How does this agent compare with similar options?
Unlike a traditional decompiler, REA adds MCP/CLI orchestration, workflows across providers, and an exportable evidence model on top of existing engines; decompilation still comes from the user's installed engine. The README also names bethington/ghidra-mcp as a single-engine MCP alternative and reports that it has more tools, while REA covers multiple engines and providers.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| REA Reverse Engineering Workbench This agent | 52 · Major gaps | CLIFree | ★ 65 | today | HTML | Codex · Claude Code |
| REA: Reverse Engineer Anything with Agents | 72 · Some gaps | CLIFree | ★ 327k | today | TypeScript | Codex · Claude Code · Claude.ai |
| Auto RE Agent | 61 · Some gaps | CLIFree + model costs | ★ 2.1k | 1mo ago | Python | Codex · Claude Code · OpenAI API · Claude API |
| Eleven Reverse Engineering Workbench | 58 · Major gaps | Desktop appFree | ★ 772 | 1d ago | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The README describes local analysis, results passing through the agent to the model provider, and explicitly says the system is not a sandbox, which makes the stated data flow reasonably clear. The supplied material does not show a concrete permission inventory, sensitive-data controls, execution-time confirmation, or rollback process, so those scores remain low. It distinguishes primary from secondary sources and assigns authorization responsibility to the user, but this does not verify actual tool behavior.
The report describes an evidence_id result contract with limitations and unknowns, fail-closed file-integrity checks, examples, and known timeout and output-size problems. This supports some internal consistency. The supplied material does not show dependency pinning, supply-chain review, or detailed error handling; the reported Ghidra timeout also indicates a practical availability constraint.
The material covers binaries, Electron, websites, .NET, Android, firmware, and other targets, and clearly states that REA does not restore original source code, static analysis is not runtime proof, and obfuscation or packing limits reconstruction. Multiple agent and platform entry points support environment fit, but operational rules for when to invoke the tools or avoid them are not adequately shown.
The README has a clear section structure, installation paths, examples, FAQ, limitations, and a version timeline. However, MIT licensing is only reported in the supplied README; the license file itself is absent. Naming and version evolution are incomplete, and the maintainer is described as pseudonymous without a clear maintenance responsibility or update commitment, limiting those scores.
The evidence contract, cross-layer tracing, and multi-backend integration offer identifiable value for agent-assisted reverse engineering, and the examples show how findings can support reconstruction. Scores are limited by the reported very large JSON output and long queries, and by reliance on external engines that users must provide and license. The material does not establish cost-benefit for ordinary use.
The report attributes claims to README, official documentation, the project site, or secondary sources; it separates source categories and lists unverified figures, snapshot caveats, and example boundaries. That supports traceability and fact-inference separation. However, corroboration and case details are the report author's account; this review has only the README text and cannot independently inspect the cited code, tests, or other files.
- Analysis results pass through the agent to the model provider; check the selected model's data policy before processing proprietary targets.
- REA explicitly is not a sandbox. The material recommends an isolated VM for untrusted targets and reports large outputs and Ghidra timeouts.
- This assessment uses only the supplied README text; the license, implementation details, and cited examples or tests were not independently verified from the provided material.