宝玉 (@dotey) · 10/10/2026, 13:39:53
REA Open-Source MCP Service Enables AI Agents to Reverse Engineer Software Without Source Code
The open-source project REA integrates reverse engineering tools like Hopper and Ghidra into AI coding agents via the Model Context Protocol (MCP), enabling automated analysis from binaries to pseudocode. It supports native programs, Electron apps, and firmware, executing disassembly locally while delegating structured evidence interpretation to LLMs, significantly lowering barriers for security research and feature replication.
SOURCE COVERAGEFull Original Report
The open-source project REA (Reverse Engineer Anything) integrates reverse engineering tools with AI coding agents like Claude Code, Codex, and Cursor. If you see a great feature in someone else's app, you can have the agent deconstruct that program, explain how the feature is implemented with supporting evidence, and then write a similar implementation in your own project. Reverse engineering refers to deducing how a program was written from its compiled binary when source code is unavailable.
REA itself is an MCP service. MCP is a universal interface for AI agents to call external tools; once connected, agents can directly invoke REA's analysis capabilities within conversations. Installation requires just one command: npx rea-agents setup. It registers with agents such as Claude Code, Codex, Cursor, Gemini CLI, and Grok Build, backing up configurations and asking for confirmation before making changes. Without using an agent, you can also run commands directly in the terminal.
It supports analyzing a wide variety of targets. Native programs (software compiled directly into machine code) require disassembly tools like Hopper, Ghidra, or IDA to convert machine code back into assembly and pseudo-C code. Electron apps (desktop software built with web technologies, such as Notion) can be unpacked by extracting the ASAR archive from the installation package to clarify modules and inter-process communication, without needing additional tools. Additionally, it supports .NET programs, Android APKs, firmware, websites, packet captures, Ethereum contract bytecode, and recording runtime behavior on Linux and macOS.
Analysis is performed locally; REA does not upload target programs. However, analysis results are sent to the model providers behind the agents, so data handling depends on each provider's policies.
The project provides three case studies. First, the classic brick-breaking game DX-Ball: tracing from a single sound effect playback call to the function calculating left/right channel audio based on ball position, restoring incomplete pseudo-code into C code. 3,205 test groups matched the original, and the compiled 63 bytes were identical to the original. Second, the Notion desktop version: tracking the complete chain of copy-paste operations from the UI through preload scripts and inter-process communication to the main process. Third, the Touhou Fantasy Zone (TH04) game on the old Japanese PC-98 computer: restoring the angle algorithm for bullet rings in danmaku patterns from 16-bit instructions.
For security researchers, retro game remakers, and software preservationists, what previously required manually reading disassembly line-by-line and tracing calls layer-by-layer can now be handled by having agents trace first, with humans verifying the provided evidence. For ordinary developers wanting to study how competitors implement specific features, this offers another avenue.
The README indicates the project has already garnered 50,000 stars on GitHub. The npm package was first released in July this year, with the latest version 6.3.0 released today.