REA Setup Guide: Reverse Engineer Any App With Your AI Coding Agent

REA reverse engineering puts tools like Ghidra, Hopper and IDA in the hands of the coding agent you already use. REA ("Reverse Engineer Anything") is an open-source, MIT-licensed MCP server and CLI. You install it with one npx command, connect it to Claude Code, Codex, Cursor or another agent, and then ask plain-English questions about software you don't have source code for. Setup takes about ten minutes. This guide walks through it, plus the parts the docs only hint at.

For most of my career, reverse engineering meant one thing: block out an afternoon, open a disassembler, and click through functions until a picture forms. I've done it to debug closed-source SDKs, to figure out why a vendor's Electron app was hammering our API, and to check what a "harmless" binary actually did on disk. It works, but it's slow, and the knowledge lives in your head, not in a reproducible trail.

REA changes the workflow. The agent picks the tool, runs it, moves evidence between steps and comes back with file and line references. You still need judgment. You just spend it on questions instead of plumbing.

What is REA and how does it work?

REA sits between your coding agent and a set of local analysis tools, which it calls providers. It connects through MCP (Model Context Protocol), the standard that lets agents call external tools. Setup also installs an investigation skill, a set of workflow instructions that tells the agent how to approach a reverse-engineering task step by step.

So there are three layers:

• Your agent (Claude Code, Codex, Cursor and so on) does the reasoning and talks to you.

• REA exposes a consistent set of inspection tools over MCP, and the same capabilities through a CLI.

• Providers do the heavy lifting: Hopper, Ghidra or IDA for native binaries, JADX for Android, a browser for websites, and so on.

The package is rea-agents on npm, the source lives at github.com/morluto/rea, and the official site is rea.tools. Install it only from those three places. Popular security tools attract lookalike packages, and a fake copy of a tool that runs with your agent's permissions is about the worst thing you could install.

What do you need before installing REA?

Run REA on the machine where your target files live, because the agent needs to read them locally. You'll need Node.js 22.19+, 24.11+ or 26+. Check what you have:

node -v
npm -v

If you're on an older version, install Node.js 24 LTS:

# Windows (PowerShell)
winget install --exact --id OpenJS.NodeJS.LTS

# macOS (Homebrew)
brew install node

# Linux (via fnm)
curl -fsSL https://fnm.vercel.app/install | bash
fnm install 24 && fnm use 24 && fnm default 24

One Linux gotcha: your distro's own nodejs package is often older than 22.19, so check node -v even if Node is already "installed."

Then make a working folder and stay in it:

mkdir rea-work
cd rea-work

Which coding agent should you use with REA?

REA supports a long list of clients. The npm 6.4.0 release covers Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, VS Code and several others. Each has a setup ID, such as claude_code, codex or cursor, which you'll use with the --client flag.

My practical advice: use the agent you already trust with your codebase. Terminal agents like Claude Code and Codex fit REA naturally, because reverse engineering is mostly a loop of run a tool, read the output, decide the next step. Editor agents work too. In Cursor, Windsurf or VS Code, switch the chat to Agent mode, and in VS Code set up GitHub Copilot first.

How do you connect REA to your agent?

The easiest path is to let your agent install it. Paste this into the agent's chat:

Install REA and connect it to this coding agent using
npx rea-agents@latest setup. Show me the setup plan for approval,
then verify the installation.

Or run setup yourself:

npx rea-agents@latest setup

# or target one client explicitly
npx rea-agents@latest setup --client codex

# Windows PowerShell, if script execution is blocked
npx.cmd rea-agents@latest setup

Setup shows you a plan before it changes anything. It adds the MCP connection and the investigation skill, and it backs up your existing configuration first. That's exactly the behavior I want from a tool that edits agent config. Read the plan rather than mashing Enter.

You can skip the optional Hopper install for your first run. When setup finishes, fully restart your client. For desktop apps, closing the window isn't enough. Quit the app (⌘Q on macOS, and the tray icon on Windows). For terminal agents, exit the session and start a new one.

Verify the connection

npx -y rea-agents@latest doctor --client codex --json

Swap codex for your setup ID. You're looking for "healthy": true. Then ask your agent to confirm REA is connected and list the REA tools it can see. If the tools don't show up in an editor client, enable REA in its MCP settings and allow its tools in the agent chat.

What does a first REA investigation look like?

The REA team provides a small practice target: a six-file Electron notes app with an Export notes button. The agent inspects the code statically, without installing or launching Electron. Give your agent this prompt:

Download https://rea.tools/examples/notes-example.zip into a new
example folder and unpack it. Use REA to find what happens when I
click Export notes. Show where notes.csv is written, which fields it
contains, and the relevant files and lines.

A good answer traces the full path: the button sends a notes:export IPC message, the main process formats the notes as CSV, and it writes notes.csv to the user's Downloads folder with id and title columns. Each claim should come with a file and line reference.

That last part is what makes REA worth using. An agent that just says "it exports to CSV" is guessing. An agent that points you to main.js, line 42, is giving you evidence you can check. Always open the referenced lines yourself, at least until you've built trust in your setup.

Can REA analyze native binaries, Android apps and websites?

Yes. This is where REA goes well beyond the Electron demo. For native executables and libraries, install one provider:

• Hopper on macOS 12+ or supported Linux distros. Setup can detect or install it. It's commercial software, but it has a demo mode with vendor-defined limits.

• Ghidra, free and from the NSA, on macOS and Linux (x64 and arm64), with experimental read-only support on Windows x64. It needs a 64-bit JDK 21+, plus the GHIDRA_INSTALL_DIR and JAVA_HOME environment variables.

• IDA, using an existing installation through its upstream MCP server, with verified profiles on Windows and macOS arm64.

A typical Ghidra hookup on macOS or Linux looks like this:

export GHIDRA_INSTALL_DIR="/absolute/path/to/ghidra_12.1.4_PUBLIC"
export JAVA_HOME="/absolute/path/to/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

Run these in the same terminal session so the variables stick, rerun setup, then restart your agent. On a fresh arm64 machine you may need to build Ghidra's native decompiler first. The REA docs link to step-by-step guides for that.

Beyond native code, REA has guides for websites (via Chrome, Chromium or Edge), .NET and Flutter, Android APKs (JADX), live Android devices (adb), firmware (Binwalk or Unblob), WASM, SQLite databases, EVM bytecode, packet captures, HAR files and more. Each guide lists the extra tools that target needs.

Can you use REA without an AI agent?

Yes, and I'd encourage it. The CLI is great for scripting and CI. To analyze a JavaScript or Electron app folder, or an .asar archive, without running it:

npx -y rea-agents@latest analyze-javascript-application "/absolute/path/to/app" --json

The JSON output identifies the app, maps connections between modules with source locations, and flags anything it couldn't resolve. Electron apps usually keep their app.asar in a resources folder, under /Applications/<App>.app/Contents/Resources/ on macOS.

For a native function with Ghidra configured:

npx -y rea-agents@latest function "/absolute/path/to/program" main --provider ghidra --json

If you want a permanent rea command, install it globally with npm install --global rea-agents, then update it later with rea update.

What should you watch out for?

A tool this capable deserves a few ground rules. These are the ones I'd set for my own team.

• Stay legal. Reverse engineering can be restricted by law or by the software's license. Stick to software you own, are authorized to examine, or are studying for legitimate interoperability or security work. If you're unsure, ask your legal team before you start, not after.

• Remember where the evidence goes. The analysis tools run locally, but the snippets your agent reads are sent to whatever model it uses. Don't point a cloud-hosted agent at a confidential binary unless your data policy allows it.

• Keep approvals on. REA works through your MCP client, so your client's tool-approval settings are your safety net. This is the same "agents as insiders" problem I wrote about in AI agents as insider threats: give the agent only the folders and permissions the task needs.

• Verify, don't trust. Treat the agent's findings as leads, and check the file and line references before acting on them.

There's a bigger point here, too. This week, AI-assisted research surfaced two critical PHP flaws that had been hidden for over a decade. Tools like REA make that kind of analysis available to far more people, defenders and attackers alike. If you ship software, assume your distributed code will be read, and design it accordingly.

How do you troubleshoot, update or remove REA?

• Agent doesn't see REA: fully restart the client, then run doctor with your setup ID.

• Provider issues: run npx -y rea-agents@latest doctor --provider ghidra --json, swapping in your provider. The report names the failed check and suggests a fix.

• Windows and WSL: use PowerShell for Windows clients. If your agent runs inside WSL, install Node and REA inside WSL and use Linux paths. Quote any path that contains spaces.

• Update: rerun npx rea-agents@latest setup, review the plan, and restart the client.

• Remove: npx rea-agents@latest uninstall removes REA's client configuration and skill.

Reverse engineering used to be a niche skill gated by tooling. REA doesn't remove the need for judgment, but it does remove most of the grind. Set it up on the demo app this afternoon, then point it at a dependency you've always treated as a black box. You'll learn more in an hour than you expect.

Sources

• REA: Get started

• REA on GitHub (morluto/rea)

• REA FAQ