REA: Five-Step Reverse Engineering of Any App with AI Agents

What is REA?

REA (Reverse Engineer Anything) is an open-source project that enables AI coding agents to reverse engineer any application. According to the video, the project has already gained over 350,000 stars on GitHub. Its core idea is straightforward: you don't need to open Ghidra or IDA and analyze manually yourself—instead, you let a coding agent like ClaudeCode connect to REA via the MCP protocol, and REA drives your existing reverse engineering tools to complete the analysis.

This positioning solves a long-standing problem in reverse engineering: complex toolchains and a high barrier to entry. REA itself doesn't replace Ghidra, IDA, or Hopper—it acts as a scheduling layer between AI agents and these professional tools. You keep the analysis tools you're familiar with, while the AI issues commands, interprets results, and compiles reports.

Breaking Down the Five-Step Workflow

The video summarizes using REA in five steps, which logically fall into five phases: "request—connect—drive—target—output."

Step 1: Submit an analysis request to the coding agent

You describe the functionality you want to understand in ClaudeCode or another agent—for example, "how does this app handle login verification?" The agent translates the natural language request into a reverse engineering task.

Step 2: Connect to REA via the MCP server

The agent connects to REA as an MCP server. MCP (Model Context Protocol) is the protocol layer that lets AI agents invoke external tools, and REA uses it to expose reverse engineering capabilities to the agent.

MCP (Model Context Protocol) is an open protocol proposed by Anthropic in late 2024 to standardize interactions between AI agents and external tools and data sources. Its core abstraction is that a "server" exposes a set of tools or resources, and the agent executes specific operations and retrieves structured results through JSON-RPC-style calls. Compared with traditional function calling, MCP unifies tool discovery, parameter description, and the invocation lifecycle, allowing the same agent to plug into tools from different vendors. In the REA scenario, REA acts as an MCP server that wraps reverse engineering operations into agent-callable tools; the agent doesn't need to know the specific Ghidra or IDA commands—it simply makes requests according to the protocol.

Step 3: REA drives existing reverse engineering tools

REA doesn't call a self-developed engine—it uses industry-standard tools like Ghidra, IDA, and Hopper. The agent issues commands, REA translates and drives the tools to execute them, then returns the results to the agent.

Ghidra, IDA, and Hopper are the three mainstream tools in reverse engineering, with slightly different positioning. Ghidra, open-sourced by the NSA, is free and supports disassembly, decompilation, and multiple architectures—suitable for budget-constrained teams. IDA Pro is a commercial tool with high decompilation quality and deep debugging integration, and has long been the industry standard. Hopper targets the macOS ecosystem with a lower price and a friendly interface. All three share one thing: they provide scripting interfaces—Ghidra supports Java/Python scripts, IDA supports IDAPython, and Hopper offers a Python API. REA drives these tools essentially by calling their scripting interfaces to issue analysis commands and read results. So "reusing mature toolchains" doesn't mean reimplementing a decompiler—it means orchestrating existing capabilities.

Step 4: Support multiple target types

The analysis targets are broad: native binaries, Electron apps, .NET programs, and even websites. This extends REA's applicability beyond traditional binary reverse engineering.

Electron apps and .NET programs have fundamentally different analysis paths from native binaries. Electron apps bundle the Chromium and Node.js runtimes, and the actual business logic often resides in JavaScript files within the asar archive—so the analysis focus is on unpacking the asar and reconstructing the source structure rather than disassembling machine code. .NET programs compile to CIL intermediate language and can usually be decompiled into near-source C# code with tools like ILSpy, making them easier than native binaries. Website analysis involves front-end JavaScript and network requests. REA unifies these heterogeneous targets under a single natural language interaction layer, meaning the agent must choose different underlying tools and strategies based on target type—which reflects its role as a "scheduling layer."

Step 5: Output reports with evidence

The final output is a report where every conclusion comes with supporting evidence and a statement of limitations. This is more valuable than "giving an answer"—the reliability of reverse engineering depends on the chain of evidence, and AI-generated conclusions without traceable support are hard to trust.

Practical Usage Tips

The video's author shares their own approach: first complete the command configuration, then have ClaudeCode understand a particular function, show the evidence, and try to build similar functionality. This "understand—verify—reproduce" approach turns reverse engineering from mere prying into a learning method.

Be careful with installation sources

The author specifically warns to install only from official channels: GitHub, REA.tools, and NPM. Counterfeit versions exist. It's not uncommon for open-source tools to be squatted or impersonated, and the installation source directly affects code security.

Compliance boundaries

The most important rule: only analyze software you own or are authorized to analyze, and comply with relevant licenses. Reverse engineering occupies a legal gray area, and different jurisdictions have different exemptions for interoperability analysis and security research. The tool itself is neutral—the user's compliance awareness is the bottom line.

Reverse engineering's legal status varies by jurisdiction, with common exemption frameworks including interoperability purposes, security research, and academic analysis. In the United States, DMCA Section 1201 prohibits circumventing technological protection measures but provides several exceptions; the EU Software Directive permits decompilation for interoperability. In China, the Computer Software Protection Regulations allow using software to study and research the design ideas contained within, but not to infringe copyright. Additionally, many commercial software end-user license agreements (EULAs) explicitly prohibit reverse engineering—breach of contract and infringement are two different legal paths. Open-source licenses may also impose requirements on derivative analysis. Therefore "being authorized" refers not only to ownership but also to licensing and contractual permission; confirm each item before analysis.

A Few Details Worth Noting

Fully local operation. The video emphasizes that all analysis is done on your own machine. For teams handling sensitive binaries or unwilling to upload samples, this is a key selling point.

AI agent as the interaction layer. REA's value isn't in its degree of automation but in lowering the operational barrier of reverse engineering to the natural language level. You still need to understand the evidence in the report, but you don't have to memorize every tool's invocation details.

Evidence and limitations equally weighted. The report presents conclusions, evidence, and limitations together. This output design acknowledges the uncertainty of reverse engineering and is more aligned with engineering reality than giving definitive answers.

Target Audience and Use Cases

Security researchers can use it to speed up sample triage; developers doing interoperability work can use it to understand third-party protocol implementations; beginners learning reverse engineering can treat the AI as a guide to progressively understand tool output. However, it's important to recognize that REA won't judge the reliability of evidence for you—conclusions still require human review.

Open source, local operation, and reuse of mature toolchains—these three points make REA a noteworthy solution in the AI-assisted reverse engineering space. Whether it suits your workflow depends on your requirements for the evidence chain and your grasp of compliance boundaries.

One-line Summary

REA lets AI coding agents drive tools like Ghidra and IDA via MCP to complete reverse engineering locally.

Paragraph Summary

REA is an open-source project positioned as a scheduling layer between AI coding agents and traditional reverse engineering tools. It connects agents like ClaudeCode via the MCP protocol, translating natural language requests into calls to Ghidra, IDA, and Hopper, and supports targets including native binaries, Electron apps, .NET programs, and websites. The workflow consists of five steps: submitting requests, connecting to REA, driving tools, selecting targets, and outputting reports. The final report attaches evidence and limitations to each conclusion, and all analysis runs locally. The article advises installing only from the official GitHub, REA.tools, and NPM channels, and analyzing only software you own or are authorized to analyze.