tomitaku.net

REA

Reverse Engineer Anything / rea-agents / morluto/rea
add · 963 words

An MIT-licensed open-source project for letting AI agents use the tools of reverse engineering. It runs both as an MCP server and as a CLI, and an agent (Claude Code, Codex, Cursor and others) goes through REA to examine binaries and applications that have no source code, explain their behavior, and carry on as one continuous piece of work to implementing an equivalent feature on its own side. It is not itself a decompiler but a layer that seats the agent at the driving position of existing analysis engines such as Hopper, Ghidra, IDA and Kuna. The results it returns are designed to carry the evidence behind each conclusion and the limits of what that evidence supports. It drew attention rapidly after being released in 2026※1.

What it does

The flow of use takes this form: the agent asks about a target, REA examines the target through MCP and returns the facts it found with their evidence, and the agent uses them to ask further questions, to write an explanation, or to implement and test something. The example instruction given in the official README is "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project." The same operations can be called from the CLI.

What matters is that it does not bundle an analysis engine. Deep analysis of native binaries requires one of Hopper, Ghidra, IDA or Kuna separately, and apart from setup being able to install Hopper with approval, it uses existing installations. Only static inspection of JavaScript and .NET works without an engine. Analysis runs locally and the results stay local.

The range of targets

The list of supported targets is fairly long. It includes native binaries (pseudocode, assembly, strings, symbols, call relationships), JavaScript and Electron applications (modules, imports, source maps, IPC, relationships with native add-ons), .NET assemblies, Android APKs (decompiled via JADX), websites, saved network captures, SQLite databases, WASM, EVM bytecode, build information embedded in Go and Rust binaries, Unity IL2CPP metadata, Godot PCK, Flutter applications, firmware, PyInstaller executables, model files such as GGUF and safetensors, and recorded packets and crash dumps.

Many are static inspections needing no external tool, and some presuppose tools the user supplies separately (pwntools, tshark, adb, Apktool, Binwalk and others). That is, the substance behind a name saying "anything" lies in the range of having gathered capabilities that individual analysis tools already had under a single calling convention that an agent can invoke.

The sudden attention, and how to read it

Not long after release its GitHub star count rose explosively, and this in itself became a topic. The figures reported differ greatly between sources, however, ranging from the hundred-thousands into the four-hundred-thousands※2. There is an observation that a surge of this kind includes a great many people who saw the topic and added a star without ever installing the tool.

Exaggerated cases also circulated. A story spread that a major company's product line had been cloned wholesale using REA, but according to people who looked into it the artifact was built from descriptions and videos of the software and had nothing to do with analysis by REA. The project's own README likewise separates the agent examining a target and "showing the evidence" from the agent using that evidence to write an implementation, and does not state that the original source code is recovered※3. While the name makes a large claim with "anything", the official description leans toward setting out what can be returned (pseudocode, module structure, runtime observations) together with its limits.

Licensing and the handling of law

REA's own code is MIT, and third-party material retains its respective licenses. What needs care is the side of the commercial tools used for deep analysis. The README states explicitly that it is the user's responsibility to obtain legally and to be authorized to use commercial tools such as IDA Pro / Hex-Rays, Hopper and JEB, and that REA grants no tool license, key or activation entitlement. It also places a statement that cracked copies, unauthorized key sharing and bypassing license restrictions are not authorized.

The project's stated position is that it is for lawful research, education, interoperability and software preservation, and for analysis of software one owns or is authorized to examine. Whether reverse engineering itself is permitted differs by country and by contract, and a target's terms of use may prohibit it explicitly, so that a tool can be used and that it may be used remain separate questions.

To verify

  • The actual GitHub star count and its course over time. This entry writes no specific figure and records only the fact that sources disagree
  • The author's identity. There is reporting that they work under the anonymous handle morluto and that their real name has not been made public, but this could not be confirmed at first hand
  • When the repository was made public. Several secondary sources state creation in April 2026, but this could not be confirmed against the repository's metadata (the GitHub API was unreachable from this session)
  • A review article quotes from the README wording to the effect that it "does not claim to recover original source code or automatically clone an application", but that sentence was not found in the README as consulted. Whether it was in an earlier version, or in another document such as DISCLAIMER.md, could not be confirmed
  • Details of how the case of a major product line being cloned came to be denied. The person or article said to have verified it could not be identified
  • The relation to the terms of use of AI services. There are reports of accounts being restricted for touching clauses prohibiting reverse engineering, but no corroboration could be obtained

References

Mentioned in
none
Similar