rea: Reverse Engineer Apps and Binaries with AI Agents

Overview

REA is a TypeScript MCP server and CLI for reverse engineering across binaries, applications, and runtime behavior. It connects AI agents to analysis tools so they can investigate how a feature works, trace relevant code, and use the findings to explain or implement similar behavior, even when the target's source code is unavailable.

Analysis runs locally, and results include evidence and limitations. REA covers targets ranging from native binaries and JavaScript/Electron apps to .NET assemblies, Android packages, websites, firmware, and recorded network traffic. Its wide tool support makes it useful when an investigation spans application layers, rather than only one file format or platform.

Key Features

• Connects local MCP-compatible agents to reverse-engineering workflows, with a CLI for the same workflows.
• Inspects native binaries for pseudocode, assembly, strings, symbols, calls, and references through supported analysis providers.
• Analyzes JavaScript and Electron applications for modules, imports, routes, IPC, and native add-on relationships.
• Provides static inspection for formats including .NET assemblies, Android APKs, Go and Rust binaries, GPU code objects, and model artifacts.
• Supports runtime and device investigations, including process behavior, Android devices, browser observations, and recorded network captures.
• Returns findings with evidence and limitations, helping agents trace behavior and distinguish conclusions from unknowns.
• Can turn recorded web requests and responses into an environment for agent practice and evaluation.

Use Cases

• A developer wants to reproduce a feature from an application they cannot inspect at source level, and needs evidence about its behavior first.
• A reverse engineer needs an agent to trace a native function through pseudocode, assembly, and references using an installed analysis provider.
• An Electron developer needs to follow a feature across renderer, preload, and main-process boundaries.
• A security or preservation researcher needs static facts from an authorized binary, package, crash record, or network capture.
• An agent or RL practitioner wants to build a practice environment from recorded web-app traffic instead of running the original app.

Getting Started

With Node.js and npm installed, run:

npx rea-agents setup

Choose the agents to configure, review and approve the proposed changes, then restart your agent. See the README and installation guide for provider setup and target-specific requirements.

Alternatives

• leanrea: leanrea guides agents through reverse engineering with ordinary CLI tools, while rea provides dedicated MCP and CLI tools for gathering evidence.

Considerations

• The project is actively maintained, with recent commits and frequent releases; its contributor base is broad rather than concentrated around one person. This is a positive maintenance signal, though the breadth of supported formats means capabilities and prerequisites vary by target.
• Node.js and npm are required. Some workflows also need caller-supplied tools such as Hopper, Ghidra, IDA, JADX, adb, or browser and packet-analysis utilities. REA does not install or update every provider.
• Runtime capture can run or interact with a selected target using the user's permissions. Static analysis and runtime analysis have different effects, so check the relevant guide before running an investigation.
• REA analyzes targets locally, but the agent's model provider receives tool results and follows its own data policy.
• REA's code is MIT-licensed, but commercial analysis tools retain their own terms. Users must obtain authorization to use them and to examine the target software.
• The project is intended for lawful research, education, interoperability, preservation, and analysis of software the user owns or is authorized to examine.