New AI Reverse Engineering Tool REA Lets Claude Clone Any App

In an era where AI coding assistants are increasingly common, an open-source project called REA (Reverse Engineer Anything) has suddenly exploded on GitHub, surpassing 76,000 stars and shooting to the top of the trending list. It enables coding agents like Claude Code, Codex, or Cursor to delve deep into almost any application, understand its internal logic, and even reproduce its functionality. A Bilibili creator demonstrated REA's impressive capabilities through hands-on testing, while also exposing unexpected interception by AI safety mechanisms.

What is REA: Giving Coding Agents "X-ray Vision"

REA stands for "Reverse Engineer Anything." It is an MCP server (a standardized agent tool interface) that provides up to 139 tools, supporting Electron apps, websites, Android firmware, and native Mac, Windows, and Linux programs. Its ReadMe opens with: See a feature you like, understand exactly how it works all the way down to the binary, then build your own version.

Installation requires just one command: npx rea-agent setup. It will show you the plan and back up your configuration; confirm and restart your agent. The creator created a new folder on Mac, ran Claude Code's Opus 3.5 version, and chose the note-taking app Obsidian as the target—it's an Electron app with its actual code packaged as a 14MB compressed archive inside the application.

The creator entered the prompt: "Use REA to understand how Obsidian's quick switcher ranks and matches note titles as you type. Show me the evidence, then build a small web page that reproduces the same matching and ranking logic for these 30 note titles."

MCP (Model Context Protocol) is a standardized protocol proposed and open-sourced by Anthropic, designed to let large language models call external tools and data sources in a unified way. Before MCP, every coding agent had to write a separate adapter layer for each type of tool, fragmenting the tool ecosystem; MCP abstracts "tool description—invocation—result return" into a common interface, so an agent only needs to implement a client once to connect to any compliant server. REA is released as an MCP server, so it can be directly mounted and used by different agents like Claude Code, Codex, and Cursor. Understanding this is key: REA itself doesn't "understand" code—it organizes the app's internal structure (packaged files, syntax trees, IPC channels, etc.) into tools and evidence that the agent can query, while the actual reasoning is still done by the underlying large model.

Electron apps refer to software built with web technologies (HTML/CSS/JavaScript) for the interface and then packaged as desktop programs—Obsidian, VS Code, Slack, and others fall into this category. Their process model is divided into a main process and renderer processes: the main process has Node.js and operating system privileges and handles windows, files, menus, etc.; renderer processes run web code and are sandboxed by default, with the two communicating via IPC (inter-process communication). The "42 message channels" mentioned in the article are these IPC channels—they are the必经 gateways through which the app exerts influence on external systems. And precisely because JavaScript code is distributed with the app in bundled, compressed form, REA can unpack it and perform syntax-level analysis—this is the technical prerequisite for choosing Obsidian as its first demo target.

First Test: Perfectly Cloning the Search Ranking Logic

Initially, things went smoothly. Claude loaded the REA skill, and REA unpacked the entire compressed archive, parsing 3.9 million syntax nodes, 1,600 findings, and 42 message channels between the memory window and the main process—all in about a minute. But then, when Claude traced the word "Switcher" in the mapping graph, the feedback was empty—zero matches. REA's mapping graph did not index every string in the compressed archive.

Claude didn't give up, nor did it make things up. It unpacked the bundled files and read the 3.7MB minified JavaScript directly, byte by byte. Eventually it found the chain: the command is app.commands.executeCommand('switcher:open'), which performs a fuzzy search—your query is lowercased and split into words, and each word must appear in the title in order. If that fails, it falls back letter by letter, then scores: each match starts at zero and points are deducted—one point per extra fragment, one-tenth of a point for each word starting mid-word, a little for more scattered match positions, and a little more for later starting positions. Highest score wins.

Claude built the web page, and did something the creator didn't ask for: it ran Obsidian's original function and its own copy side by side, covering all 30 titles and 4,915 queries. Same ranked list, same scores, same highlights—every single time. The creator typed "rev", then "weekly review", then "design review", then "renovation"; then typed "DN" for the reading list, which beat out "daily notes"—a real Obsidian quirk—and the copy took only 2 minutes 11 seconds.

Second Test: Unexpected Interception by AI Safety Mechanisms

The second test was the key one. The creator wanted to know what Obsidian's window is allowed to make the system do behind the scenes. After entering the prompt, Claude found all 42 channels in one second and pinpointed each channel's handler location in the code. Claude began reading these handlers and writing the mapping graph, and then it happened—interrupted, blocked by a safety classifier. Opus 5.5's safety mechanism flagged the session with a note explaining that it sometimes flags work that has nothing to do with hacking, and suggested switching to Opus 4.8.

The model itself decided that analyzing what an app can do to a machine looked too much like an attack. The creator switched to Opus 4.8 and ran it again—this time it completed: the 42 channels fell into 4 groups—15 involve the file system (copying files into the app folder, writing icons, moving things to the trash, creating or renaming vault folders), one called RequestUrl lets the window send arbitrary network requests through the main process (any address, any headers, any content), and a Register command line executes a shell command to add Obsidian to your PATH—each line pointing to the exact location in the code.

None of these are flaws; Obsidian needs these entry points to be a note-taking app. The key point is that a complete map of what an app can do to your computer, connected to code locations, now takes just one prompt—and every app you publish can have the same map. Obsidian is still a simple case because JavaScript apps carry their own code. REA's own case studies go further: Notion's clipboard flow, sound calls in the 90s Windows game DXBall, the percentage logic in Windows Calculator—before REA you had to read assembly; now you just ask the agent.

A safety classifier is an independent discriminating component deployed on the model invocation chain; it scores input intent and output content before and after the main model generates, interrupting or rewriting sessions when high-risk patterns are hit. Unlike the model's own "refusal to answer," the classifier is an external filtering layer whose rules and training data can be updated independently, so false positives are common: in this session, analyzing app permission mappings was semantically close to attack-surface enumeration and was judged suspicious behavior. Vendors typically provide fallback paths such as downgrading or switching models (in this case, switching to Opus 4.8), but this means the same task's completability varies across model versions—something to consider in advance when doing reverse engineering or security research.

Limitations and Ethics: What REA Can and Cannot Do

REA has three clear limitations. First, it won't give you the original source code—no one can. What you get is pseudocode, maps, call paths, and evidence; the agent still has to think for itself. Second, evidence files are large—Obsidian's exceeds 500MB. REA stores them and gives the agent a summary, but you need to plan disk space ahead of time. Third, inspecting software internals to understand how it works is normal engineering practice, and many places allow it for learning and compatibility purposes, but copying someone else's code into your product or cracking license checks is not okay. Read the license of the app you're pointing it at first.

The creator put every prompt from the video into a free one-page sheet, including setup lines, two Obsidian prompts, one website prompt, and one native binary prompt.

REA's explosive popularity reflects developers' long-standing frustration with "black-box apps"—some app you use every day has a feature you'd love to add to your own project, but it's closed; you can see what it does but have no idea how it does it. REA compresses this reverse-engineering process into minutes while putting ethical and safety issues on the table: will you point this at your own app before someone else does?

The legal boundaries of reverse engineering vary widely across jurisdictions. In the US, for example, Section 1201 of the Digital Millennium Copyright Act generally prohibits circumventing technological protection measures, but provides exceptions for interoperability and security research; the EU Software Directive allows decompilation for interoperability purposes and prohibits use for copying expression. China's Computer Software Protection Regulations similarly distinguish "study and research" from "commercial copying." In practice, the criteria usually come down to three points: purpose (compatibility/learning vs. plagiarism/circumventing authorization), means (whether encryption or license checks are circumvented), and result (whether substantially similar code is produced). REA outputs pseudocode and call paths rather than original source code, reducing the risk of direct copying, but rewriting an implementation with the same functionality and similar structure based on its evidence may still fall into a gray area of infringement or license violation.

One-line Summary

Open-source MCP tool REA gives coding agents X-ray vision into app internals; hands-on tests cloned Obsidian's logic and exposed safety interception.

Paragraph Summary

The open-source project REA (Reverse Engineer Anything) provides 139 tools as an MCP server, enabling coding agents like Claude Code, Codex, and Cursor to deeply analyze Electron apps, websites, Android firmware, and native programs. In hands-on tests, Claude used REA to unpack Obsidian's 14MB code package; when the mapping graph missed, it read the minified JavaScript byte by byte, ultimately reproducing its fuzzy search ranking logic—verified across 4,915 queries with identical results, taking 2 minutes 11 seconds. A second test analyzing the window's 42 IPC channels was falsely flagged and blocked by Opus 5.5's safety classifier, completing after switching to Opus 4.8. REA does not return original source code, only pseudocode and call paths; evidence files can exceed 500MB, and its capabilities raise ethical questions about the line between learning/compatibility and plagiarism/cracking.