REA, short for Reverse Engineer Anything, is an open-source MCP server and CLI that lets coding agents such as Claude Code, Codex and Cursor inspect software without its source code. It passed 300,000 GitHub stars in October 2026 and showed about 362,000 by October 22. The truth behind the hype: REA is not a new decompiler and does not recover original source code. It is a well-built connector to existing tools such as Ghidra, Hopper and IDA, and it works best on narrow, verifiable questions. Teams exploring AI agent development should treat it as a specialist tool, not a magic rebuild button.
Key Takeaways
- REA connects AI coding agents to established reverse-engineering engines; the heavy analysis of native binaries is still done by Hopper, Ghidra or IDA.
- The repository went from under 10,000 stars on October 7 to about 234,000 on October 14, 2026. Whether every star reflects a real user cannot be verified from outside GitHub.
- REA returns pseudocode, assembly, module graphs and evidence, not the original source code. Its strongest results are single functions or data paths with a test to check against.
- REA is not a sandbox, ships breaking changes quickly, and has already been impersonated by a fake copy distributing a trojan.
- Legal responsibility stays with the user: REA is intended for software you own or are authorised to examine.
Talk to Our Team About Your Project ->
What Is REA (Reverse Engineer Anything)?
REA is an MIT-licensed tool by developer morluto that gives an AI agent a set of reverse-engineering tools through the Model Context Protocol (MCP). The README describes it as one MCP for reverse engineering across binaries, applications and runtime behaviour, with the pitch: see a feature you like and understand how it works, down to the binary level. The same tools are available from a terminal through the rea-agents npm package.
Two design choices define it. First, REA delegates. For native binaries it drives an existing installation of Hopper, Ghidra or IDA, which REA calls “providers”; one independent explainer puts it plainly: REA does not disassemble anything itself. Second, REA records evidence. A detailed DEV Community review notes that each result carries provenance such as file digests, byte ranges and an explicit list of facts the analysis could not establish.
What Can REA Analyse?
REA’s target list is broad, which is where “anything” comes from. The README lists more than 30 target types. The main categories are:
| Target | What REA returns | What it needs |
| Native binaries | Pseudocode, assembly, strings, symbols, calls, references | Hopper, Ghidra or IDA (your own licensed copy) |
| JavaScript and Electron apps | Modules, imports, source maps, routes, IPC | Node.js only |
| .NET assemblies | Metadata, CIL instructions, native dependencies | Nothing extra (static) |
| Android APKs | Manifest, classes, decompiled methods | JADX and a JDK |
| Websites | Page structure, scripts, network observations | A Chrome-family browser |
| Saved network captures | Requests, responses, payloads | HAR file, or mitmproxy on Linux |
| Go and Rust binaries | Compiler, modules, crate and dependency data | Nothing extra (static) |
| Firmware | Regions and extraction results | Binwalk or Unblob on Linux |
Static JavaScript and .NET inspection read files without running the application. Runtime capture does run or interact with the target using your user permissions, which matters for the security section below.
How Did REA Get 300K GitHub Stars So Fast?
REA’s growth was sudden rather than gradual. A GitHub-API fact-check dates the repository to April 14, 2026, and records 234,477 stars and 58,512 forks by October 14. A daily GitHub trending tracker logged 9,658 stars on October 7, when REA posted the day’s largest gain.
Trendshift data summarised on DEV Community shows daily gains climbing from about 1,400 on October 4 to more than 31,000 on October 11, with REA holding the top spot on GitHub Trending for five of seven days from October 6 to 12. The same review found no single launch post behind the surge; demo videos of agents rebuilding apps from binaries spread quickly, along with claims that software reconstruction was effectively solved.
There is real demand behind the number. The fact-check reports 231,579 npm installs of rea-agents in the week of October 6 to 12. It also notes that from outside GitHub, nobody can say how many stars come from genuine users, and it neither claims nor rules out inflation. Stars measure attention, not production adoption.
What Is True and What Is Hype?
| Claim | Verdict | What the evidence shows |
| “Reverse engineer anything” | Marketing | REA supports many formats, but depth depends on the provider and platform; several paths are Linux-only. |
| REA recovers original source code | False | It returns pseudocode, assembly, modules and relationships; the agent writes its own implementation. |
| REA is a new decompiler | False | Native analysis is done by Hopper, Ghidra or IDA; REA orchestrates them and records evidence. |
| Agents can rebuild whole apps from binaries | Overstated | Whole-app demos can resemble a target without matching its behaviour. |
| REA is clearly better than a plain agent | Unproven | One early comparison on a simple Mac app found the gap narrow and REA slower. |
| REA analyses locally | Partly true | Analysis runs on your machine, but results are sent to your agent’s model provider. |
Sources: REA README, DEV Community review and GitHub-API fact-check.
The project’s own showcases point to where REA is genuinely strong. In the DX-Ball case study, an agent followed a sound call into a helper function, turned incomplete pseudocode into C, passed 3,205 test cases against the original x86 code and reproduced all 63 compiled function bytes. In the Notion case, it traced a clipboard feature through an Electron app’s preload and IPC layers. Each success is a single function or data path with a way to verify the answer, which is a far narrower promise than “anything”.
What Are the Real Risks of Using REA?
REA is not a sandbox
According to the project’s security policy, as summarised on DEV Community, REA’s local bridge is not a sandbox: opening an untrusted binary runs its parsing with your user permissions. Analyse anything untrusted inside a virtual machine or container.
Fake copies are already circulating
The fact-check documents a lookalike repository under an organisation called rea-tools that copied the README and added a “Windows Standalone .exe” section. According to the issue report, Microsoft Defender flagged it as a Wacatac-family trojan. The official README now tells users to install only from github.com/morluto/rea, rea.tools or the rea-agents npm package. The project has also said it has issued no token, so coins using its name are unaffiliated.
Releases move faster than integrations
The DEV Community review counted seven minor versions in nine days, and a minor release changed the structure of every MCP result. Anyone scripting against REA’s JSON output should pin a version and test before upgrading.
Your data still reaches a model provider
The REA FAQ says targets are analysed locally, but your agent receives the tool results and its model provider has its own data policy. For proprietary or client binaries, that is a data-handling decision, not a technical footnote.
Is Using REA Legal?
REA itself is legal, MIT-licensed software, but what you point it at determines the legal position. The README states that REA is for lawful research, education, interoperability, software preservation and analysis of software you own or are authorised to examine. It also requires users to hold valid licences for commercial engines such as IDA Pro, Hopper and JEB, and says cracked copies or bypassed licence restrictions are not authorised.
Reverse-engineering law varies by country and by licence agreement, and copying a competitor’s feature raises the same intellectual-property questions it did before AI agents existed. Startup Fortune’s coverage highlights piracy and IP-theft concerns as part of the debate. Before using REA on third-party software, get legal advice.
What Have People Actually Done With REA?
REA’s surge coincided with a wider wave of AI-built software reconstructions, and the two are often confused. Some of the most famous examples did not use REA at all. The projects below show what has been achieved, what was claimed, and where REA genuinely played a part.
| Project | Who | What was done | Used REA? | Status |
| ArtCraft (PhotoCraft, VectorCraft, FilmCraft and others) | Brandon Thomas | Open-source alternatives to seven Adobe apps plus Word, Excel and PowerPoint, written in Rust with Claude Opus 5.5 | No, by the project’s own account | Early alpha, many open bugs |
| Snowball War (Ski or Die) | Tuomo Tuunanen | Playable rebuild of one minigame from the 1990 DOS game, in Rust and SDL2 | Yes, via REA’s Ghidra workflow | Working; needs your own game files |
| DX-Ball sound routine | REA project | One helper function rewritten in C and checked against the original x86 code | Yes (official showcase) | Verified with 3,205 test cases |
| PC-98 game maths | REA project | Recovered fixed and aimed angle calculations from 16-bit code and rebuilt them in C++ | Yes (official showcase) | Compared against historical compiler output |
| Notion clipboard | REA project | Traced how formatted content moves through an Electron app’s preload and IPC layers | Yes (official showcase) | Single feature explained |
| Glide (Screen Studio alternative) | LearnAIWithMe author | Screen-recording app built with a Claude pipeline that includes REA | Author says yes | Self-reported; not independently checked |
Sources: innfactory analysis of ArtCraft, BigGo Finance case summary, Snowball War repository, REA README and LearnAIWithMe, checked October 22, 2026.
The Adobe “clone wave” and why REA was not behind it
The most viral claim of October 2026 was that AI had “open-sourced Adobe”. On October 3, developer Brandon Thomas announced ArtCraft, a set of free, MIT and Apache-licensed apps including PhotoCraft (Photoshop), VectorCraft (Illustrator), FilmCraft (Premiere Pro), LightCraft (Lightroom), EffectCraft (After Effects), DesignCraft (InDesign) and a PDF editor standing in for Acrobat Pro. They run on Windows, macOS and Linux, and PhotoCraft alone has drawn tens of thousands of GitHub stars.
ArtCraft was not reverse engineered from Adobe’s binaries. innfactory’s review reports that the apps were built with Claude Code from menus, keyboard shortcuts, observed behaviour, screenshots and public format specifications such as Adobe’s PSD specification and ECMA-376, and that the project’s agent instructions forbid the AI from reading or disassembling the original program packages. Reviews by Decrypt and Kingy.ai found no evidence that REA was used. This is classic clean-room development, done faster with an AI agent.
The episode still had real-world effects. BigGo Finance reports that an HSBC analyst cited ArtCraft when cutting Adobe’s price target from $310 to $267. A widely shared critique points out that the apps are alphas with hundreds of open bugs, and that REA’s own website guidelines tell writers never to imply that REA automatically clones a program.
Games: bounded reconstructions, not full clones
Games are where REA has produced its most convincing community results, because a game’s behaviour is easy to observe and compare. The Snowball War project used REA’s Ghidra workflow on the DOS executable of Ski or Die to document the rules of a single minigame, then rebuilt it from scratch in Rust and SDL2. Its notes separate mechanics and tables recovered from the binary from parts that are approximations, which is the kind of honesty the rest of the field often lacks.
REA’s own showcases follow the same pattern: DX-Ball’s sound routine, angle maths from a PC-98 shooter and guided exercises on Chrome’s offline dinosaur game. Community “awesome-REA” lists now track game decompilations, native ports and recompilations, though many of those projects predate REA or use other tools.
Game files and internal data formats
A large share of practical REA work is not about code at all but about the files software reads and writes. The Snowball War project ships a tool that locates the game’s files, reverses the EXEPACK compression on the executable and extracts graphics and audio from the original data files, so players supply assets from their own copy rather than the project redistributing them. The same approach applies to save files, level formats and proprietary document formats.
Beyond games, REA’s README lists inspectors for desktop installations, firmware images and AI model files such as GGUF and safetensors headers. For businesses, the most valuable everyday use is often this kind of internal file and protocol discovery: understanding an old export format, a legacy database file or the traffic between an internal client and server so that new software can interoperate with it.
App features and agent platforms
In the official Notion case, REA traced a single clipboard feature through an Electron app’s layers. Independent creators report building their own apps with REA in the loop, such as the Glide screen-recording tool, though these are self-reported. Perplexity has also added REA as a skill in its Computer agent, with free use until October 31, 2026, which brings it to users who have never installed an MCP server.
Who Should Use REA, and How?
REA is most useful for teams that already understand what to ask a binary and want an agent to handle the dispatch and record-keeping. Realistic, lawful uses include:
Understanding your own legacy software when source code or documentation has been lost.
Interoperability work, such as understanding a file format or protocol your product must support, where the law permits it.
Security review of software you are authorised to test, using REA’s evidence trail to document findings.
API discovery from your own traffic captures, turning a HAR file into an inferred endpoint inventory.
Learning, by working through the project’s guided examples such as Windows Calculator’s % button or Chrome’s dinosaur game.
Before any of these, run through the checklist below.
Ask specific questions, verify every finding against a test or the original behaviour, and treat whole-application rebuilds as experiments. The same verification discipline applies to any AI system that produces confident output, a theme AB Ark covers in its guide to why RAG systems fail in production.
How Does a Typical REA Investigation Work?
Successful projects share a similar shape. This is a conceptual outline, not a step-by-step guide for analysing third-party software.
- Frame a narrow, testable question: Start with one behaviour, such as “how is this checksum calculated?” or “what does this export file contain?”, rather than “rebuild this app”. Narrow questions give the agent a clear stopping point.
- Let REA route to the right engine: The agent asks REA to inspect the target; REA picks the right route, such as a static JavaScript or .NET parser, a network capture, or Ghidra, Hopper or IDA for native code.
- Collect evidence, including the gaps: REA returns pseudocode, structures and provenance, including what it could not establish. Keeping these records is what makes the result reviewable by a colleague or auditor.
- Reimplement in your own code: The agent writes new code that reproduces the behaviour. It is an independent implementation, not recovered source code.
- Verify against the original: Compare outputs against the original on recorded inputs, as the DX-Ball case did with 3,205 tests. Without this step, a reconstruction that looks right may behave differently.
Where Does REA Fit in a Team?
Security and incident response: Use REA to document behaviour of suspicious or authorised-test binaries, keeping its evidence trail as part of the report, always inside an isolated virtual machine.
Legacy modernisation: When source code, vendors or documentation are gone, REA can map what an old internal tool actually does before it is replaced, which reduces the risk of losing a hidden business rule in migration.
Interoperability and data migration: Product teams that must read or write another system’s files or protocols can use REA to build a specification, where local law and licence terms permit interoperability work.
Preservation and modding: Archivists and hobbyists can document and port games and software they own, following the Snowball War model of shipping code but not the original assets.
Product research: If the goal is a competing product, follow ArtCraft’s clean-room approach: build from public behaviour and specifications, keep anyone who studies the original separate from those who write the new code, and take legal advice before release.
Get a Custom Project Cost & Timeline Estimate ->
FAQs
What is REA (Reverse Engineer Anything)?
REA is a free, MIT-licensed MCP server and CLI that lets AI coding agents inspect native binaries, Electron apps, .NET assemblies, Android APKs, websites and network captures without source code. It returns evidence-backed findings that the agent uses to explain or reimplement behaviour.
Does REA give you the original source code?
No. REA returns pseudocode, assembly, module graphs and other evidence. Any code you end up with is a new implementation written by your agent, which should be tested against the original behaviour.
Do I need Ghidra or IDA to use REA?
Only for deep native-binary analysis, which needs Hopper, Ghidra or IDA. JavaScript, Electron, .NET, website and capture analysis work without an extra engine.
Are REA’s GitHub stars real?
The count is real on GitHub, but whether every star represents an active user cannot be verified externally. Over 231,000 npm installs in one week suggest substantial genuine interest.
Is REA safe to install?
The official package is open source and widely inspected, but it is not a sandbox, and fake copies have spread malware. Install only from github.com/morluto/rea, rea.tools or the rea-agents npm package, and analyse untrusted files in isolation.
Was the open-source Adobe suite built with REA?
No. ArtCraft’s Adobe-style apps were built with Claude Code from observed behaviour and public file-format specifications, and reviewers found no evidence that REA was used. The two went viral in the same week, which is why they are often linked.
What have people built with REA?
Documented examples include a playable rebuild of the Snowball War minigame from Ski or Die, verified single-function reconstructions from DX-Ball and a PC-98 game, and a trace of Notion’s clipboard feature. Most successful projects target one feature or file format at a time.
REA did not solve reverse engineering. It made existing reverse-engineering tools usable by AI agents, with an evidence trail. That is valuable, but only for people who ask precise questions and check the answers.
Schedule a Free Consultation Call ->
CTO & Co-founder At AB Ark Solutions
