REA: MCP Server for Reverse Engineering

1. Project Overview

REA (Reverse Engineer Anything) is an open-source MCP (Model Context Protocol) server and command-line tool that lets AI agents inspect software — from native binaries to Electron apps, websites, and Android packages — explain how it works, and back every conclusion with evidence, all running locally on your machine.

2. Background & Positioning

Why it was created

Reverse engineering usually means switching between many specialized tools (decompilers, disassemblers, packet analyzers, browser dev tools) and manually stitching findings together. REA gives AI coding agents a single, consistent interface to those tools, so an agent can examine a target without its source code, describe how a feature behaves, and help build a similar one.

How it differs from similar projects

One MCP for many targets: instead of a single-purpose plugin for one decompiler, REA covers binaries, applications, and runtime behavior in one server.
Evidence-first output: results carry the supporting pseudocode, assembly, symbols, references, and a note of known limitations.
Provider-agnostic: native analysis can use Hopper, Ghidra, or IDA, and offline inspection can use GNU objdump or Rizin.
Local and static-first: analysis runs locally; static JavaScript and .NET inspection reads files without executing them.
Dual interface: the same workflows are available to agents over MCP and to humans through the rea CLI.

3. Feature Categories

🧩 Native Binaries & Firmware

Coverage: native executables, ELF, Go/Rust, WASM, EVM bytecode, firmware images
Examples: pseudocode and assembly via Hopper/Ghidra/IDA; ELF sections, segments, and mitigation candidates (pwntools); Go/Rust compiler and crate/dependency info; WASM validation and WAT forms (WABT); EVM dispatch selectors and mutability; firmware unpacking (Binwalk/Unblob)
Purpose: understand compiled code when no source is available.

🌐 Web & JavaScript Applications

Coverage: websites, JavaScript, and Electron apps
Examples: modules, imports, routes, and IPC in Electron apps; native add-ons; page structure, scripts, network data, and screenshots for websites (Chrome-family browser)
Purpose: map how a web or desktop-web application is put together.

📱 Mobile & .NET

Coverage: Android APKs and devices, .NET assemblies, Flutter, Apple app bundles
Examples: APK manifests and decompiled methods (JADX + JDK); device logs and file transfers (adb); .NET metadata, CIL instructions, and build comparisons
Purpose: inspect mobile and managed-code software.

📡 Data, Network & Signals

Coverage: SQLite, packet captures, logic-analyzer recordings, process behavior
Examples: SQLite tables, indexes, views, triggers, and rows; pcap analysis via TShark; logic signal decoding via sigrok-cli; runtime process capture
Purpose: examine data stores and runtime behavior alongside the code.

🤖 Agent Integration

Coverage: Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and other agents that support local MCP servers
Examples: one-command setup, installed workflow instructions, a published agent skill, a full rea CLI
Purpose: make the tools usable from the agent you already work in.

4. Key Highlights

Broad target coverage: one server handles dozens of target types, from native code to websites.
Evidence-backed results: every answer comes with its supporting artifacts and stated limits, which makes findings easier to verify.
Guided setup: setup shows proposed configuration changes for approval and backs up existing configuration before applying them.
Bring your own tools: REA integrates with the decompilers and utilities you already have; it does not install or update them.
Documented showcases: case studies include a DX-Ball reconstruction that passes 3,205 original-x86 test cases, an Electron clipboard bridge study for Notion, and a DOS bullet-ring calculation for TH04.
Localized docs: the README is available in 20 languages.

5. Use Cases by Role

General developers: understand undocumented behavior, study how a library or app implements a feature, or work on interoperability.
DevOps/SRE: inspect third-party binaries and desktop apps, review dependencies in Go/Rust builds, and examine network captures.
Security engineers: triage binaries, review ELF mitigations, analyze APKs, firmware, and packet captures — only on software you are authorized to examine.
Data/research scientists: extract tables from SQLite files, document file formats, and support software-preservation work.
Project managers: get readable, evidence-backed summaries of how a competing or legacy product behaves, to inform planning.

6. Getting Started

🔍 Find what you need

Browse the guides and showcases at rea.tools/guides and rea.tools/showcase, or see the docs in the repository (docs/cli.md, docs/mcp-contracts.md).

⚙️ Install and integrate

Requires Node.js 22.19+, 24.11+, or 26+ and npm.

# Register REA with your agent(s) and install instructions
npx rea-agents setup

# Or install the global CLI
npm install --global rea-agents
rea --help

# Analyze an extracted JavaScript/Electron app from the terminal
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

# Update a global install
rea update

Restart your agent after setup or updates.

🤝 Contribute

Open an issue or pull request. See CONTRIBUTING.md for development setup and checks, and SECURITY.md for reporting vulnerabilities.

7. Project Structure

rea/
├── src/                 # Core source code (TypeScript)
├── bridge/              # Bridge components
├── native/windows/      # Windows native support
├── website/             # Source for rea.tools
├── docs/                # Documentation, translated READMEs, assets
├── tests/               # Test suites
├── scripts/             # Maintenance scripts
├── licenses/            # License texts
├── third_party/         # Third-party material
├── CONTRIBUTING.md
├── DISCLAIMER.md
├── SECURITY.md
└── THIRD_PARTY_NOTICES.md

docs/ holds installation, CLI, MCP contracts, provider guides, roadmap, and an architecture map.
docs/readme/ contains the translated READMEs.
THIRD_PARTY_NOTICES.md lists the licenses of bundled or referenced components.

8. Related Ecosystem

Analysis providers: Hopper, Ghidra, IDA, GNU objdump, Rizin
Supporting tools: JADX, Apktool, adb, JEB, WABT, pwntools, Binwalk, Unblob, TShark, sigrok-cli
Distribution: the rea-agents npm package
Agent skill: reverse-engineer-anything on skills.sh
Showcase repositories: N0zoM1z0/dx-ball and N0zoM1z0/th04
Agents: Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and other MCP-capable clients

9. License

✅ REA-authored code is released under the MIT License: use, modify, and redistribute it.
✅ Intended for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.
❌ REA does not grant licenses or keys for commercial tools such as IDA Pro, Hopper, or JEB; you must obtain them legally yourself.
❌ Not intended for analyzing software you are not authorized to examine.
ℹ️ Third-party components keep their own licenses (see THIRD_PARTY_NOTICES.md).
ℹ️ Review DISCLAIMER.md before use, and install only from the official repository, rea.tools, or the rea-agents npm package.

10. FAQ

Q: Which AI agents does REA work with?
A: Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and other agents that support local MCP servers. Run npx rea-agents setup to register it.

Q: Do I need a decompiler installed?
A: For native binary pseudocode, yes — Hopper, Ghidra, or IDA. Many other targets (JavaScript, .NET, Go/Rust, SQLite) use built-in or lightweight inspection. REA does not install providers for you.

Q: Does my data leave my machine?
A: Analysis runs locally. Static inspection reads files without executing them; runtime capture runs the target under your own permissions.

Q: How do I update REA?
A: Run rea update for a global install, or npx rea-agents@latest setup to refresh agent registrations after an npx update.

Q: Where can I see it in action?
A: See rea.tools/showcase for case studies such as DX-Ball and Notion.

11. Quick Links

Repository: https://github.com/morluto/rea
Website and guides: https://rea.tools
npm package: https://www.npmjs.com/package/rea-agents
Installation docs: https://github.com/morluto/rea/blob/main/docs/installation.md
Contributing guide: https://github.com/morluto/rea/blob/main/CONTRIBUTING.md
Community: Discord server and GitHub issues/pull requests (linked from the README)

12. Summary

REA gives AI agents a single, evidence-focused interface for reverse engineering binaries, applications, websites, and runtime behavior, all running locally. It suits developers, security engineers, and researchers who want to understand software they are authorized to examine without juggling a separate tool for each target.