REA

morluto/reaReviewed by AI

What it does

REA is a command-line tool and MCP server that connects an AI agent (Claude Code, Codex, Cursor, Gemini CLI and others) to reverse-engineering tools. You point it at a program on your own computer and ask how a feature works; it inspects native binaries, JavaScript and Electron apps, .NET assemblies, Android apps, firmware and saved network captures, and returns findings with the evidence behind them. The inspection runs on your machine. You need Node.js 22 or newer and npm; deep work on native binaries also needs Hopper, Ghidra or IDA installed.

How easy it is to install

D · terminal, several tools or a specific graphics card · Windows

Windows D
macOS D
Linux D

On Mac and Linux the one-line install.sh plus `npx rea-agents setup` configure it, but you first need Node.js 22.x, 24.x or 26.12+ and npm, then a separate decompiler (Hopper, Ghidra or IDA) for native binaries, and extra command-line tools per target (a procps `ps` and pwntools on Linux, a full JDK and JADX for Android, tshark for packet files). On Windows the shell installer refuses to run, so you install the npm package by hand and the README calls Ghidra support there experimental.

Coming soon: install in 1 click with the RepoPicks app.

Numbers on GitHub

Stars: 415,556on Oct 31, 2026
Downloads: —all releases
Growth: +30,423stars in 6 days

Stars over time

Facts

Runs on: Windows, macOS, Linux
You need to install: Node.js, Other tools
To build from source: Node.js
Disk space: 100 MB–500 MB · estimate
Accounts or keys: None
Cost: Free · The tool itself is free (MIT). Deep analysis of native binaries needs a separate decompiler: Ghidra is free, Hopper, IDA Pro and JEB are paid and you must have your own licence. The AI agent you drive it with may also be paid.
License: MIT (Permissive)
Can replace: Hopper, IDA Pro
Last update: Oct 31, 2026

Risk signals (5)

Attentionunusual star rate
397502 stars in 197 days (~2018 per day)
automatic check
Attentionreverse engineering may be restricted
The README's Disclaimer says REA 'is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine', and points to DISCLAIMER.md for responsible use. Taking apart software you do not own can break its licence terms and is restricted in some countries.
AI review
Attentionruns and interacts with target apps
README.md: 'Runtime capture runs or interacts with the selected target using your user permissions; each runtime guide describes its effects.' It can also drive connected Android devices (processes, logs, screen captures and APK/file transfers through adb).
AI review
Infosecurity testing tools bundled
package.json ships bridges for pwntools (bridge/pwntools/), pwndbg (bridge/pwndbg/launch.py) and mitmproxy traffic capture (bridge/mitmproxy/capture.py); the README documents crash and memory-mitigation inspection and reading saved network captures. These are standard security-research tools; the heavy ones are supplied by you, not installed by REA.
AI review
Inforeadme warns about copycat repositories
README.md opens with an IMPORTANT box: 'A similar repository name or copied README does not establish that a download is official', listing morluto/rea, rea.tools and the rea-agents npm package as the only official sources. Worth reading alongside the unusual star rate the checks flagged.
AI review

Evidence is shown in its original language.

What Radar could not check

Whether the findings and recovered pseudocode are correct for a given program
Which features really work on Windows, where the installer is not supported and native analysis is marked experimental
What the AI agent you connect sends to its own model provider while it analyses your files
How much disk and time an analysis session takes on a large binary
What `rea update` and `npx rea-agents@latest` fetch and change on your machine at each run

REA