Getting started with REA (Reverse Engineer Anything)

Install REA, connect it to Claude Code or Codex, pick a native backend if you need one, and run a first analysis on an Electron app or your own binary.

REA (Reverse Engineer Anything) is an open-source MCP server and command-line tool that lets a coding agent inspect software without its source code. It covers native binaries (through Hopper, Ghidra or IDA), JavaScript and Electron apps, .NET assemblies, websites and more, and it returns evidence with each finding. This guide is for people who want to ask Claude Code or Codex "how does this feature work?" about an app they own, and get an answer they can check.

REA changes quickly. Its own README says "new releases include frequent bug fixes". Everything below matches the README and installation docs as of 14 October 2026, when the npm release was 6.4.0. If a command here fails, check those pages first.

Before you start#

• Node.js and npm. REA needs Node.js 22.x (22.19 or later), 24.x (24.11 or later), or 26+. The installation docs say Node 23, 25 and prereleases are unsupported.
• A coding agent with local MCP support. Setup supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI and many others; the full list is in the supported agents table.
• For native binaries only, one analysis engine:
  • Hopper (macOS or Linux). Commercial, with a free demo mode. REA's setup can install it after asking.
  • Ghidra 12.1.x (macOS or Linux; Windows is experimental) with a 64-bit JDK 21 or newer. Free. REA uses your existing install and never installs Ghidra or Java for you.
  • IDA through an existing IDA MCP server. You need your own IDA licence.
• Nothing extra for JavaScript, Electron or .NET. Per the README, static JavaScript and .NET inspection "work without a native analysis engine".
• A target you are allowed to examine. REA's licence notes say it is for lawful research, interoperability, preservation and "analysis of software you own or are authorized to examine".

Get REA only from github.com/morluto/rea, rea.tools or the rea-agents npm package. The README warns that look-alike repositories exist.

1. Run setup#

npx rea-agents@latest setup

Setup asks which agents to configure, shows the exact files and paths it will change, and waits for your approval. It adds REA's MCP server, installs a matching workflow skill for your agent, and keeps backups of your existing config. Hopper installation is a separate yes/no question. Restart the agents named in the completion message.

If you use Claude Desktop, quit it fully before approving. The installation docs say a running app can overwrite the new registration.

To configure one agent without the menu, or preview changes without writing anything, setup takes --client and --dry-run:

npx rea-agents@latest setup --client claude_code --dry-run
npx rea-agents@latest setup --client codex

The client IDs are claude_code, claude_desktop and codex for the three agents covered here. Setup pins your agent's registration to the exact REA version that ran it, and for Codex it adds startup_timeout_sec = 30.

Manual registration

If you would rather add the server yourself, the MCP Registry section of the docs gives this config, pinned to a version:

{
  "mcpServers": {
    "rea": {
      "command": "npx",
      "args": ["-y", "[email protected]", "mcp"]
    }
  }
}

The same command in Claude Code and Codex syntax (see the Claude Code and Codex MCP docs):

claude mcp add rea -- npx -y [email protected] mcp
codex mcp add rea -- npx -y [email protected] mcp

Manual registration skips the workflow skill, so the agent has the tools but not REA's instructions for using them. Setup is the route the README recommends.

2. Set up a native backend (only for binaries)#

Skip this step if you only want to look at Electron or .NET apps.

Ghidra. Extract Ghidra 12.1.x and install a JDK, then point REA at them and rerun setup so the paths are saved into your agent's registration:

export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
export JAVA_HOME=/absolute/path/to/jdk-21
npx rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

REA opens each binary in a temporary, read-only Ghidra project. It never opens your existing Ghidra projects, and any renames it makes in a session are discarded when the session closes.

Hopper. Let setup install it, or point REA at an existing install. On macOS, open Hopper once and choose demo mode or activate a licence before your first analysis, or the first-run dialog blocks REA.

IDA. REA does not include its own IDA server. It adapts an existing one, described in its IDA provider guide. Note the version detail there: REA's attached GUI mode works with mrexodia's ida-pro-mcp 1.4.0, and the guide says that project's newer 2.0.0 main branch "serves neither profile". Read that guide before you install anything for IDA.

When several engines are installed, pick one with --provider on the command line or provider_id when the agent opens a binary.

3. First run on an Electron app#

Electron apps ship their JavaScript in an app.asar file or an app folder inside the install directory. You can test REA from the terminal before involving an agent:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app.asar --json

The result lists modules, imports and Electron boundaries (renderer, preload and main process) with evidence for each. If that works, ask your agent a feature question. The JavaScript guide on rea.tools uses this pattern:

Use REA to find what happens when I export notes in this app.
Where is the CSV created? The app is at /absolute/path/to/app.asar.

REA matches a renderer's IPC call to the main-process handler that receives it, so the agent can follow a button click across processes. The rea.tools guide also points out that this path "is inferred from code"; a runtime capture is what confirms it executes.

4. First run on a native binary#

With a backend set up, give the agent a path and a narrow question. The native guide uses DX-Ball's sound panning:

Use REA to find how this program calculates <the behaviour you care about>.
Explain the calculation and show the code. The binary is at /absolute/path/to/program.

Use a small program you own or wrote. REA returns pseudocode, assembly, strings, calls and references; the agent stitches them together.

Check it works#

npx rea-agents@latest doctor --client claude_code --json

doctor is read-only. Scope it to one agent (--client codex) or one engine (--provider ghidra); without a scope it audits everything, and its overall healthy value can be false even when your chosen workflow is fine. Then, inside the agent, check that the REA tools are listed (/mcp in Claude Code). Note that doctor checks files and prerequisites, not whether the running agent session actually connected; restart the agent if the tools are missing.

To update later, run npx rea-agents@latest setup again and restart the agent, or rea update if you installed it globally with npm install --global rea-agents.

Where AI goes wrong#

• Inferred links presented as traced ones. In the Notion clipboard trace, the connection between the exposed method and the main-process handler came from reading wrapper code, not a fully automated trace, and probes ran extracted modules rather than a live session. Ask the agent to label which steps are evidence and which are inference.
• Quietly dropping code to make things build. In the Electron lost-source recovery (Codex without REA), Codex skipped code to make builds pass until the author told it not to worry about compiling. The same risk applies when you ask an agent to rebuild a feature from REA's findings.
• Partial pseudocode. REA's native guide shows a DX-Ball function whose decompiler output was only a call to __ftol(). The arithmetic had to come from the instructions, the caller and constant bytes. If the pseudocode looks too short, ask for assembly and callers.
• Matching one function is not finishing the job. The DX-Ball reconstruction passes 3,205 behaviour cases for the sound-pan routine, but ball and paddle physics, power-ups and sound integration were still in progress. Test each recovered function against the original before moving on.
• Timeouts on large binaries. Ghidra's first query triggers import and analysis. The installation docs give a default provider startup deadline of 330,000 ms, adjustable with REA_GHIDRA_STARTUP_TIMEOUT_MS, and warn that your agent's own tool-call timeout can expire first.

Projects that use this#

• Notion clipboard trace: REA's JavaScript analysis follows a copy from the preload bridge through IPC to the main process.
• DX-Ball reconstruction: Codex used REA's Ghidra access to rebuild functions as C, checked against the original x86.
• TH04 bullet patterns: REA on a 16-bit PC-98 DOS binary, recovering bullet-ring maths as C++.
• REA iPhone app demo: a video comparing Claude Code with and without REA on a compiled iPhone app.
• Electron app lost source: recovering an Electron app's TypeScript from its bundle with Codex alone, useful for comparison.

Further reading#

• REA README and installation and setup
• REA guides and showcases
• REA IDA provider guide
• Claude Code MCP docs and Codex MCP docs
• Tool pages: REA, Claude Code, Codex CLI, Ghidra