Setup guide · updated 13 Nov 2026

REA: reverse engineer anything, the honest guide

REA is a free, MIT-licensed MCP server that lets an AI agent (Claude Code, Codex, Cursor, Gemini CLI and others) inspect apps without their source code and explain how a feature works, with evidence for every finding. It does not give you the right to copy anyone's app.

Official sources only REA's own README warns that copies with similar names exist. Get it only from github.com/morluto/rea, rea.tools or the npm package rea-agents.

01What it can inspect

Windows/macOS/Linux programs (native binaries, via Hopper, Ghidra, IDA or Kuna)
JavaScript and Electron apps (modules, IPC, source maps), no extra engine needed
Android APKs (via JADX), .NET assemblies, websites (with a Chrome-family browser)
Analysis runs locally on your computer, and results come with evidence and limitations.

02Setup (one command)

You need Node.js 22 or newer and npm. Then run:

npx rea-agents setup

Choose your agents, review the proposed changes, approve, and restart your agent. Setup adds REA's MCP server and workflow instructions, and backs up your existing config.

035 safe prompts to try

"Understand how search works in the Notes app, show me the evidence, and explain it." (an app on your own machine, for learning)
"Analyze my own Electron app in ./dist and list every API endpoint and secret it exposes."
"Check my app's release build for API keys, tokens or debug flags that should not ship."
"Explain how this open-source tool's binary loads its plugins, with evidence."
"After explaining the feature, help me design my own version from scratch for my project. Do not copy their code or assets."

04What is OK and what is not

OK	Not OK
Learning how a feature works	Copying someone's code, design or assets
Your own apps and software you are allowed to examine	Apps whose terms forbid reverse engineering
Security checks, interoperability, preservation	Cracking, bypassing licenses or paywalls
Building your own version from the idea	Re-publishing a cloned app as yours

REA's README says it is "for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine." I'm not a lawyer; rules differ by country and by each app's license.

05Audit your own app

The best everyday use: see what your shipped app gives away. REA's CLI includes a release-exposure audit for JavaScript/Electron apps:

npm install --global rea-agents
rea --help

Look for API keys, tokens and private URLs inside your bundle. Anything secret should live on your server, never in the app you ship.

Links GitHub: github.com/morluto/rea
Website and guides: rea.tools
npm: rea-agents