Skip to content
AddMCP

Reverse Engineer Anything repo: official links and setup

REA (Reverse Engineer Anything) is an open-source MCP server that lets your AI coding agent inspect apps and binaries you don't have source code for. Find the real repo below, then get setup steps for your agent. Nothing you pick here leaves your browser.

Reverse Engineer Anything repo at a glance

GitHub repository
github.com/morluto/rea
npm package
rea-agents · latest 6.8.0, published Oct 25, 2026
Website
rea.tools
Repo facts
MIT license · 388.8K stars · last push Oct 26, 2026

Recent releases

  1. 6.8.0latest · Oct 25, 2026Release notes
  2. 6.7.0 · Oct 18, 2026Release notes
  3. 6.5.0 · Oct 14, 2026Release notes
  4. 6.4.0 · Oct 11, 2026Release notes
  5. 6.3.0 · Oct 10, 2026Release notes

Heads up: only these three sources are official. A repository with a similar name or a copied README is not proof that a download is genuine.

Checked against npm and GitHub on 2026-10-26.

Do you need to clone the repo?

No. You don't build REA from the GitHub repo to use it. One command downloads the published rea-agents package from npm and connects it to your agent:

Terminal
npx rea-agents setup

Setup registers REA with your agent, pinned to the exact version that ran setup (6.8.0 today). Clone the repository only if you want to contribute or build from source.

You may also see npx skills add morluto/rea --skill reverse-engineer-anything. That installs only the agent instructions, not the MCP server or any analysis engine, so most people should use setup instead.

Get your setup steps

1. Your AI agent pick one or more
2. Your OS
3. What to analyze
4. What you want to do
Advanced options
Install method

Used only for Ghidra. Paths stay in your browser.

Your setup steps

0/5

Official sources only: github.com/morluto/rea · rea.tools · npm rea-agents. REA 6.8.0. Legal use

  1. REA 6.8.0 needs Node.js 22.x (22.23.4 or later), 24.x (24.22.1 or later) or 26.12.1 or later. Node.js 23, 25 and prereleases are not supported.

    Terminal
    node -v
    My version is too old

    Install a supported release from nodejs.org or your version manager, open a new terminal, and run node -v again.

    REA uses the npm that comes with that Node.js and never upgrades Node.js for you.

  2. Setup asks which agents to connect, shows the exact files it will change, and waits for your approval.

    Terminal
    npx rea-agents setup
    Which files does setup change?

    It adds an rea entry to each selected agent's MCP configuration and, unless you turn it off, installs REA's workflow skill.

    Existing settings and other servers are kept, a backup is made, and nothing is written until you approve. Pressing Ctrl-C makes no changes.

    Full details: Review setup changes.

  3. Restart every agent named in setup's completion message. A running agent does not pick up the new server.

  4. Check only the parts you use. Each command reads your setup without changing anything.

    Without --client, doctor audits every agent and engine, so healthy can be false even when your setup works.

    Terminal
    npx rea-agents doctor --json
    What should I see?

    A scoped report has scope.mode: "explicit", and healthy: true means the checks you asked for passed.

    If a check fails, follow the remediation in its output. Doctor checks files and prerequisites, not the live connection, so restart the agent after any fix.

    More in Check readiness for your task.

  5. Paste this into your agent and replace the path with your own.

    Prompt
    I own this software or am authorized to analyze it. Use REA to analyze the Electron/JavaScript app at /absolute/path/to/app. Map its main modules, IPC channels and the code path behind the feature I describe next. Cite the file, location and hash for every claim, and list what you could not confirm.

    Legal use: Analyze only software you own or are authorized to examine. What REA can and can't do

Uninstall REA

Removes only REA's agent registrations and skill files. --purge-data also clears REA's cache in ~/.rea.

Terminal
npx rea-agents uninstall
Terminal
npx rea-agents uninstall --purge-data
View my setup steps

Setup notes by OS and target

Everything the wizard above can show, in one place.

Windows

Run the commands in PowerShell.

PowerShell
npx rea-agents setup

Note: If PowerShell blocks npx, run the same command with npx.cmd.

For native programs, set the Ghidra paths with $env: instead of export:

Download Ghidra 12.1.x and install a 64-bit full JDK 21 or newer. REA connects to an existing installation; it does not install either one.

Then set these variables in the same terminal you will run setup from, so setup can find and save the verified paths:

PowerShell
$env:GHIDRA_INSTALL_DIR = "C:\path\to\ghidra_12.1.4_PUBLIC"
$env:JAVA_HOME = "C:\path\to\jdk-21"

Heads up: Ghidra support on Windows is experimental and read-only. Windows scope

Heads up: Hopper is not available on Windows. Pick Ghidra or IDA instead.

macOS

For native programs with Ghidra, export both paths in the terminal you run setup from:

Download Ghidra 12.1.x and install a 64-bit full JDK 21 or newer. REA connects to an existing installation; it does not install either one.

Then set these variables in the same terminal you will run setup from, so setup can find and save the verified paths:

Terminal
export GHIDRA_INSTALL_DIR="/absolute/path/to/ghidra_12.1.4_PUBLIC"
export JAVA_HOME="/absolute/path/to/jdk-21"

REA checks the JDK range declared by your Ghidra installation. It was verified with Ghidra 12.1.4 and JDK 21.

The JDK must match your CPU: on Apple silicon, an x86_64 JDK running under Rosetta fails the check.

More in REA's Ghidra guide.

Linux

Note: On Linux, REA also needs a procps-compatible ps on its PATH (install procps or procps-ng). Details

Electron and JavaScript apps

No extra tools are needed beyond Node.js and npm. You can also run a static analysis straight from the terminal, without an agent:

Terminal
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Android APKs

APK analysis runs JADX headless and needs a full JDK. Install both from their official sources; REA does not install them for you.

For decoded resources (manifest, strings, locales), also install Apktool.

See REA's Android guide and Apktool guide.

Native programs with Hopper

If Hopper is already installed, setup reuses it. If not, setup can propose installing the official Hopper package and asks for a separate approval first.

Legal use: Hopper is commercial software with its own license. Its free demo has vendor-defined limits; use only a license you obtained legally.

macOS 12+ and x86_64 Linux. See REA's Hopper guide.

Native programs with IDA

Install IDA yourself, then follow REA's IDA guide to connect it.

Legal use: IDA is commercial software. REA grants no license or key; use only a license you obtained legally.

What's in the repo

The files worth reading before you install:

FileWhat it covers
README.mdOverview, quick start, supported targets, FAQ
docs/installation.mdSetup, supported agents, Ghidra / Hopper, update and uninstall
docs/client-configuration.mdPer-agent config paths and troubleshooting
docs/cli.mdTerminal commands, provider selection, exit codes
docs/mcp-contracts.mdMCP tools, results and the generated tool catalog
DISCLAIMER.mdResponsible-use rules

What REA can analyze

  • JavaScript and Electron apps: modules, source maps, IPC. Needs only Node.js and npm.
  • Native binaries: pseudocode, assembly, strings and calls, through Ghidra, Hopper or IDA.
  • Android APKs: manifest, classes and decompiled methods, through JADX and a full JDK.
  • .NET assemblies: metadata and CIL, with no extra tools.
  • Websites: page structure, scripts and network activity, with a Chrome-family browser.

REA does not decompile by itself; it gives your agent access to these existing tools. The full list is in the README's What you can analyze table.

Is it legal to use?

The project says REA is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine. Laws and license agreements differ, so read what REA can and can't do before you start.