Reverse Engineer Any App With the 39k-Star REA MCP

You found a feature in an app and want to know how it actually works — but there is no source code. REA hands the investigation to your coding agent: it inspects the target, explains the mechanism, shows the evidence, and can build a version of the feature for your own project.

Why This Skill Matters

Reverse engineering used to mean solo hours in Hopper or Ghidra. REA is one MCP server that connects your agent to inspection tools for native binaries, JavaScript and Electron apps, .NET assemblies, websites, and more — the README counts a dozen target types, from EVM bytecode to Android APKs to firmware. Analysis runs locally, and results include the evidence and limitations behind each conclusion, so your agent works from findings rather than guesses.

Installation

With Node.js and npm installed, run:

npx rea-agents setup

REA requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+. Setup asks which agents to configure — the README lists Claude Code, Codex, Cursor, Gemini CLI, and Grok Build, among others — adds the MCP server with backups of your existing configuration, and asks you to restart the agent afterward. Native analysis can use an existing Hopper or Ghidra installation, and setup can install Hopper after your approval; static JavaScript analysis needs neither engine.

Real Workflow: Understand a Feature Without Source Code

1. Open your agent in any project and describe the target. The README's own example asks the agent to understand how search works in the Notes app, show the evidence, and build a similar feature for your project.
2. REA inspects the target through MCP. For an Electron app that means modules, imports, source maps, routes, IPC, and native add-on relationships; for a native binary, pseudocode, assembly, strings, symbols, and calls.
3. Ask for the implementation. Your agent writes code from the returned findings and tests it.

The same tools work without an agent. To inspect an extracted JavaScript or Electron app from the terminal:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

The result includes modules, imports, Electron boundaries, and their evidence. For regular terminal use, npm install --global rea-agents gives you the rea command, and rea update keeps it current — the README recommends updating often because REA changes quickly.

Tips

• Start with static targets. JavaScript and .NET inspection reads the supplied files without running anything; runtime capture runs the target with your user permissions, and each runtime guide describes its effects.
• The what-you-can-analyze table is broad but not uniform: the offline ELF layout and recorded Linux crashes rows need caller-supplied pwntools, Android APKs need headless JADX plus a full JDK, and firmware analysis needs Binwalk or Unblob on Linux. Check the row for your target before planning a session.
• Hit a bug? Update first — rea update or npx rea-agents@latest setup — then retry; the README says recent releases include frequent fixes.
• Local means local: REA analyzes targets on your machine. Your agent's model provider has its own data policy.
• The showcases are worked examples of the full loop — a DX-Ball sound-pan reconstruction that passes 3,205 original-x86 cases, and a trace of Notion's Electron clipboard bridge.

When Not to Use This

Deep native analysis requires Hopper, Ghidra, or IDA — separate tools with their own learning curves — so REA does not remove the reverse-engineering skill, it amplifies it. And the README's disclaimer puts the legal weight on you: the tools are for lawful reverse-engineering research, and you are responsible for authorization and compliance with applicable laws. For web tasks where you only need automation, not analysis, a plain browser agent is the lighter tool.

See the leaderboard for more skills.