English · 简体中文 · 日本語 · 한국어 · العربية

REA: Reverse Engineer Anything

Reverse engineer anything with agents, from app behavior down to native binaries.

See a feature you like. Understand how it works, down to the binary level.

Quick start · Current status · Investigation model · Tool catalog · Roadmap · How it works

npm install --global rea-agents && rea setup

See a feature in an app that you want in your own product? Give the app to your agent—even without its source code. With REA, the agent can investigate the feature, explain how it works, show its evidence, and build a version adapted to your stack and requirements.

REA gives agents one consistent way to investigate software. Today that includes deep native analysis and function dossiers through Hopper or bring-your-own Ghidra on Linux, plus an experimental Windows x64 Ghidra P0 for approved native PE applications; execution-free managed PE/CLI triage; reproducible Evidence v2 records; controlled process capture; passive website, Electron page, and Node/Electron V8 Inspector observation; bounded JavaScript/source-map reconstruction; and a versioned domain graph for connecting JavaScript application layers without confusing static inference with runtime observation. The longer-term toolkit extends the same agent workflow to APIs, protocols, mobile artifacts, firmware, richer runtime behavior, and differences between versions.

Reverse engineering normally makes the operator choose a tool, learn its API, move evidence between programs, and decide what to inspect next. REA gives that work to the agent through commands, skills, structured results, and repeatable investigation workflows.

Just ask your agent

Run setup once. Agent integration installs an aligned MCP registration and the bundled routing skill together:

npx rea-agents setup

Then ask:

Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.

Notes is only an example. Name any app you want to understand, or ask the agent to start with an overview.

The investigation model

REA shows how it reached its conclusions. It does not claim to recover original source code or automatically clone an application.

Why REA

Quick start

Run setup — recommended

npx --yes rea-agents@latest setup

The npm package-runner prompt, when shown, approves downloading REA for this invocation; it does not approve any setup changes. The REA wizard separately shows its complete plan and asks before applying it. Setup does not update Homebrew, Node.js, or npm. The setup command opens with the work it enables: investigate local apps from an agent, recover evidence through a deep-analysis provider, and reuse REA's guided workflow. It summarizes the detected agents, then asks which capabilities to set up: agent integration (MCP plus the matching guided workflow) and—when needed—the Hopper provider. Nothing is preselected. Choosing agent integration opens a second empty checklist for the specific detected agents that should receive a registration.

@latest makes the requested release explicit and asks npm for the release currently published under that tag. REA does not silently replace the package version npm selected. Intentional rollbacks therefore remain available through an exact package request.

REA keeps the journey inline so its history remains in the terminal. Selecting a capability does not select every detected target or authorize a change. Before anything changes, REA validates existing configuration, prints exact paths and external effects, and asks for final approval with No as the default. The screen keeps the available keys visible while you choose; Ctrl-C and declining leave the system unchanged.

REA detects Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, and Devin. It configures the first six when detected; Devin is reported but left unchanged because it has no documented local MCP configuration boundary. Registrations are additive, backup-first, and read back after writing. You can safely rerun setup.

Use rea setup --dry-run to inspect the plan, repeat --client to select exact agents, and --accessible for sequential vertical prompts. Machine output remains available through --json; prompt UI and progress go to stderr.

After a successful setup, REA reports the capabilities now ready to use and a concrete next step, such as restarting a configured agent before asking it to investigate an application. It does not claim an integration or provider is ready unless setup and its final diagnostic check verified it.

An optional curl wrapper installs the same CLI package and starts setup only when a terminal is available:

curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash

Pass installer options after bash -s --, for example --dry-run, --no-setup, or --version 1.0.0. The curl wrapper never installs prerequisites or configures integrations itself. See Installation and setup for its exact mutation boundary.

With an agent — recommended

npx --yes rea-agents@latest setup

Choose Agent Integration in the reviewed setup plan. REA installs the pinned MCP registration and its matching routing skill as one transaction. After setup, restart the configured agent so it loads the aligned integration.

Review the setup plan, approve it if appropriate, then describe the app or feature you want to understand. Hopper can run in its free demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.

From Terminal — no installation

npx --yes rea-agents@latest setup
npx -y rea-agents@latest doctor
npx -y rea-agents@latest analyze /Applications/Notes.app

Review the setup plan before confirming it. Restart a configured agent so it loads REA.

From Terminal — install the rea command

npm install --global rea-agents
rea setup
rea doctor
rea analyze /Applications/Notes.app

Update that global installation in place:

rea upgrade

REA checks npm for the latest release and verifies that the running package is the global installation it will replace. Source, local, and npx copies report the manual npm install --global rea-agents@latest command instead of updating an unrelated global package.

Choose either the no-install commands or the global installation. You do not need both.

npm install rea-agents without --global installs rea only into the current project's node_modules/.bin; it does not add rea to your shell PATH. Use the npx commands above for one-off runs or --global when you want a shell-visible rea command.

Requirements

• macOS 12 or newer
• Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
• Windows x64 for the experimental, Ghidra-only native PE P0 boundary
• Node.js 22.19+ or 24.11+ (including newer releases)
• npm; REA does not require or install a particular npm version

Deep binary operations use Hopper, a separate desktop application with its own license, or a caller-selected Ghidra provider. Ghidra supplies read-only inventory, function metadata, decompilation, assembly, resolved calls,