REA: The Ultimate AI Agent Tool for Reverse Engineering Everything — 13K Stars in 6 Months

One Command. A Full Reverse Engineering Lab for Your AI Agent.

What did reverse engineering used to mean? Weeks spent in Ghidra, manually labeling functions line by line through assembly, scattering notes across wiki pages, burning days on every single target. REA (repo: Molludo/REA) bets on a simple premise: your coding agent already knows how to "investigate" — it just needs the right tools.

So REA packages 41+ analysis tools into a single MCP (Model Context Protocol) server, lets the agent do the digging, and leaves you to ask the questions. One npx rea-agents-setup command hands an entire reverse engineering lab to tools like CloudCode, Cursor, and Codex — native binaries, Electron apps, Android APKs, even firmware images, all fair game.

The project's numbers are striking: created in April, it hit 13,500 stars and 1,400 forks in under six months, with nearly 1,300 commits, 30 tagged releases, and a fresh 5.0 launch this week. It's written in pure TypeScript and MIT-licensed.

MCP (Model Context Protocol) is an open standard proposed and open-sourced by Anthropic in late 2024, designed to standardize how AI models interact with external tools and data sources. Think of it like a USB interface: any "tool server" that complies with the protocol can be called directly by any MCP-compatible AI client (Claude, Cursor, Codex, etc.) without per-model adaptation. Developers expose a set of callable "Tools" through an MCP server, and AI agents can autonomously decide when to call which tool, what parameters to pass, and how to incorporate the results into their reasoning chain. REA uses exactly this mechanism — wrapping 41 analysis tools into a single MCP server endpoint so that any MCP-connected coding agent can drive Ghidra or Hopper for disassembly tasks as naturally as calling a function.

41+ Tool Matrix: Coverage for Nearly Every Executable Format

REA's core selling point is breadth. It processes native binaries through Hopper, Ghidra, or IDA Pro, extracting functions, pseudocode, assembly, strings, and cross-references. It parses JavaScript and Electron apps directly from ASAR archives — modules, routes, and IPC channels — with no execution required. It also handles .NET assemblies, processes Android APKs via headless JADX, performs live browser analysis via the Chrome DevTools Protocol, and captures process behavior for cross-run comparison.

The new release this week adds firmware image support with binwalk and unblob integration. To put its ambition in one line: if it can execute somewhere, REA has a way in.

Architecture: A Target-Bound Session Router

Technically, REA is a "target-bound session router." The agent opens a session against a specific target — an app bundle, APK, URL, or running process — and REA routes each query to the appropriate provider: Hopper, Ghidra, or IDA for deep binary analysis; dedicated providers for artifacts, browser, and process capture.

Critically, the agent never needs to know which disassembler produced the answer. It simply receives functions, pseudocode, and cross-references it can reason over. Sessions preserve context across queries, making follow-up questions cheap and letting the investigation compound over time. From cold start to querying a function's pseudocode takes roughly two minutes.

Ghidra, Hopper, and IDA Pro are the three dominant disassemblers/decompilers in reverse engineering, each with distinct strengths. Ghidra is a free, open-source tool released by the NSA in 2019, supporting multiple architectures with full collaboration and scripting capabilities and an active community. Hopper is a commercial tool for macOS/Linux, known for being lightweight, fast, and producing excellent pseudocode. IDA Pro is the industry's most mature commercial disassembler — the widest architecture support, the richest plugin ecosystem — but licensing costs thousands of dollars and it's primarily used by professional security research organizations. REA's "target-bound routing" design means agents never need to know which underlying tool is in use; the system automatically selects the most appropriate provider based on target type and locally installed tools, dramatically reducing the friction of switching between them.

The Real Differentiator: Evidence-Backed Conclusions, No Hallucinations

In a field where a wrong conclusion can waste days, REA's most noteworthy design choice is "evidence first." Every finding it returns comes with a receipt: addresses, strings, call graphs, captured behavior. When it can't verify something, it records that limitation honestly rather than letting the agent confidently make things up.

This stands in sharp contrast to many AI tools that hallucinate with misplaced confidence. For scenarios involving proprietary software as the analysis target, REA also enforces a hard constraint: all analysis runs entirely on the local machine, and target files are never uploaded to any hosted service — exactly what legal teams care about.

The Jaw-Dropping Demo: Reconstructing a 1996 Game

The most striking proof of concept shown in the demo video is a reconstruction of DX-Ball. An agent pointed at the original 1996 Windows binary and rebuilt the game in C — 55 functions, still compilable and maintainable today.

The verification wasn't "gut feel": it ran 45,380 differential test cases comparing the original against the reconstruction function by function, with 33 functions producing machine code that is byte-for-byte identical to the 1996 binary. Along the way, the agent recovered the audio channel pan calculation logic directly from the original instructions.

In other words, an AI agent performed "decompilation archaeology" on a 30-year-old game and proved its work at the byte level. The documentation site has more real-world cases, such as tracing how a copy operation in Notion travels from the web layer through Electron's IPC channel all the way to the system clipboard.

Differential testing is a technique for verifying equivalence by comparing the outputs of two implementations against the same inputs. It's widely used in compiler validation, protocol implementation verification, and similar domains. In this case, the agent performed a byte-level, function-by-function comparison between the original DX-Ball binary and the compiled output of the reconstructed C code: identical inputs producing identical machine code means the reconstruction matches the original implementation at both the semantic and compiler optimization levels. The 45,380 test cases covered a wide range of boundary inputs per function, and the 33 functions that achieved bitwise identical output means not only that their logic is equivalent — the compiler's chosen instruction sequences also match the 1996 build environment. This quantified verification transforms "AI guesswork" into "auditable engineering conclusions," the most direct expression of REA's evidence-first design philosophy.

Use Cases and Positioning

REA's topic tags read like a CTF toolkit: Ghidra, Hopper, Decompiler, Disassembler, Static Analysis, MCP, and CTF. That really is its intended audience — giving CTF players and malware analysts an agent that can handle the tedious parts (triage, string hunting, cross-referencing) while leaving the judgment calls to the human. It even supports DeepSeek^Ad Harness as a plugin.

Four things worth remembering: everything runs locally and target files never leave your machine; outputs are evidence-based, with receipts and documented limitations; MIT-licensed, 30 releases in six months, with genuine momentum; and it's compatible with all major coding agents that communicate via MCP.

It's worth emphasizing that manual reverse engineering skills still matter — you're ultimately the one validating the conclusions. But the grunt work of triage and assembly-diving can now be handed off to an agent. The era of agents that can "only read source code handed to them" is over.

The project is maintained by Molludo, a developer with 162 public repositories. REA has accumulated nearly 1,300 commits since April, with fixes being merged even hours before the demo video was recorded. It's completely free, MIT-licensed, and ready to use with a single NPX command.