How to install Reverse Engineer Anything (REA): step-by-step guide
REA is an MCP server that lets your AI coding agent analyze apps and binaries you don't have source code for. This guide walks through the whole install once, in order, with the reason for each step. For a checklist tailored to your agent and OS, use the setup wizard.
Short version
If you already have a supported Node.js and only analyze JavaScript or Electron apps, this is all you need. Then restart your agent:
npx rea-agents setupStep 1: Check Node.js
REA 6.8.0 needs Node.js 22.x (22.23.4 or later), 24.x (24.22.1 or later) or 26.12.1 or later. Node.js 23, 25 and prereleases are not supported.
node -vInstall a supported release from nodejs.org or your version manager, open a new terminal, and run node -v again.
REA uses the npm that comes with that Node.js and never upgrades Node.js for you.
Note: On Linux, REA also needs a procps-compatible ps on its PATH (install procps or procps-ng). Details
Step 2: Run setup
One command connects REA to the agents you pick:
npx rea-agents setupIt adds an rea entry to each selected agent's MCP configuration and, unless you turn it off, installs REA's workflow skill.
Existing settings and other servers are kept, a backup is made, and nothing is written until you approve. Pressing Ctrl-C makes no changes.
Full details: Review setup changes.
To skip the question and configure specific agents, pass their REA client ids. You can repeat --client:
npx rea-agents setup --client cursor --client codexREA client ids for common agents:
| Agent | --client value | Guide |
|---|---|---|
| Claude Code | claude_code | Install REA in Claude Code |
| Cursor | cursor | Install REA in Cursor |
| Codex | codex | Install REA in Codex |
| Claude Desktop | claude_desktop | Install REA in Claude Desktop |
| Gemini CLI | gemini_cli | Install REA in Gemini CLI |
| VS Code | vscode | — |
| Windsurf | windsurf | — |
Prefer a global install, for example to script it or to avoid a separate npm launcher per agent session? Install the package once, preview the plan with --dry-run, then apply it:
npm install --global rea-agentsrea setup --client cursor --dry-runrea setup --client cursorStep 3: Add an analysis engine (only if you need one)
What you install next depends on what you want to analyze:
| Target | What REA needs |
|---|---|
| JavaScript / Electron apps | Nothing extra. Node.js and npm are enough. |
| .NET assemblies | Nothing extra (static analysis). |
| Android APKs | A full JDK 17+ and the jadx-headless-mcp 0.7.1 JAR; Apktool for decoded resources. |
| Native programs | One engine: Ghidra (free), Hopper or IDA (commercial). |
Ghidra (free)
Download Ghidra 12.1.x and install a 64-bit full JDK 21 or newer. REA connects to an existing installation; it does not install either one.
Then set these variables in the same terminal you will run setup from, so setup can find and save the verified paths:
export GHIDRA_INSTALL_DIR="/absolute/path/to/ghidra_12.1.4_PUBLIC"
export JAVA_HOME="/absolute/path/to/jdk-21"REA checks the JDK range declared by your Ghidra installation. It was verified with Ghidra 12.1.4 and JDK 21.
The JDK must match your CPU: on Apple silicon, an x86_64 JDK running under Rosetta fails the check.
More in REA's Ghidra guide.
On Windows, use PowerShell syntax instead:
$env:GHIDRA_INSTALL_DIR = "C:\path\to\ghidra_12.1.4_PUBLIC"
$env:JAVA_HOME = "C:\path\to\jdk-21"Heads up: Ghidra support on Windows is experimental and read-only. Windows scope
Hopper (commercial)
If Hopper is already installed, setup reuses it. If not, setup can propose installing the official Hopper package and asks for a separate approval first.
Legal use: Hopper is commercial software with its own license. Its free demo has vendor-defined limits; use only a license you obtained legally.
macOS 12+ and x86_64 Linux. See REA's Hopper guide.
IDA (commercial)
Install IDA yourself, then follow REA's IDA guide to connect it.
Legal use: IDA is commercial software. REA grants no license or key; use only a license you obtained legally.
Android APKs: jadx-headless-mcp
APK analysis needs a full JDK 17 or newer (with its compiler module) and the jadx-headless-mcp 0.7.1 JAR, a headless JADX build. REA installs neither.
Download the JAR, check it against the SHA-256 that REA pins, and point REA_JADX_MCP_JAR at it in the terminal you run setup from. Set JAVA_HOME too if java on your PATH isn't the JDK you want. Commands from REA's Android guide:
mkdir -p "$HOME/.local/share/rea/android" && cd "$HOME/.local/share/rea/android"
curl -fL -o jadx-headless-mcp-0.7.1-all.jar https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar
echo '6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75 jadx-headless-mcp-0.7.1-all.jar' | shasum -a 256 -c -
export REA_JADX_MCP_JAR="$PWD/jadx-headless-mcp-0.7.1-all.jar"For decoded resources (manifest, strings, locales), also install Apktool 3.0.2 or newer; earlier 3.0.x versions have a security advisory. REA uses apktool on your PATH, or the launcher in REA_APKTOOL_COMMAND. See REA's Apktool guide.
Step 4: Restart your agent
Restart every agent named in setup's completion message. A running agent does not pick up the new server.
Step 5: Verify with rea doctor
rea doctor only reads your setup. Without options it audits every agent and engine it finds, so check just the parts you use:
| To check | Command |
|---|---|
| One agent's registration | npx rea-agents doctor --client cursor --json |
| One analysis engine | npx rea-agents doctor --provider ghidra --json |
| The installed workflow skill | npx rea-agents doctor --skill --json |
A scoped report has scope.mode: "explicit", and healthy: true means the checks you asked for passed.
If a check fails, follow the remediation in its output. Doctor checks files and prerequisites, not the live connection, so restart the agent after any fix.
More in Check readiness for your task.
For JavaScript or Electron apps you can skip doctor and run a static analysis straight from the terminal:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --jsonStep 6: Try your first prompt
Paste a prompt like this into your agent and replace the path. More templates for security checks, interoperability and learning are in the setup wizard.
I own this software or am authorized to analyze it. Use REA to analyze the Electron/JavaScript app at /absolute/path/to/app. Map its main modules, IPC channels and the code path behind the feature I describe next. Cite the file, location and hash for every claim, and list what you could not confirm.Legal use: Analyze only software you own or are authorized to examine. What REA can and can't do
Update or remove REA
Setup pins your agent to the version that ran it, so to update you run setup again with the latest release and restart the agent:
npx rea-agents@latest setupFor a global install, rea update updates the CLI and prints the setup command to refresh your agents. To remove REA's registrations and skill files:
npx rea-agents uninstallnpx rea-agents uninstall --purge-dataIf something goes wrong
- REA doesn't show up in your agent: restart the agent fully; for Claude Desktop, quit it before running setup.
healthyis false in doctor: rerun it with--clientor--providerso it only checks what you use.- Node.js is rejected: install a supported version from the list in step 1, then run setup again.
- More answers: REA FAQ and the official installation guide.
Source: REA's official installation guide and README. Checked against REA 6.8.0 on 2026-10-26.