REA: The MCP Server That Reverse Engineers Anything

By Indie Kings | October 26, 2026

Updated October 26, 2026: REA, Reverse Engineer Anything, is an MCP server that lets coding agents dissect native binaries, Electron apps, Android APKs and more, and the project authors say the community milestone has passed with GitHub's API showing the repository at a towering 391,795 stars.

Image: macro circuit board via Wikimedia Commons.

One MCP for the whole nightmare

The morluto/rea repository pitches itself as a single Model Context Protocol server for reverse engineering across binaries, applications and runtime behavior, under the slogan see a feature you like, understand how it works, down to the binary level. The workflow it imagines: ask your agent to investigate a feature in any app, and REA gives the agent tools to inspect the target without its source code, explain how the feature works, show the evidence, and build a version for your project. Setup is one command, npx rea-agents setup, which registers the MCP server and installs matching workflow instructions into agents including Claude Code, Codex, Cursor, Gemini CLI and Grok Build, with backups of existing configuration. The same tooling runs from the terminal as the rea command or via npx, and the project warns users to only install from its official GitHub, its rea.tools website or the rea-agents npm package, because a similar repository name or copied README does not establish that a download is official.

What it can open

The supported target list is wide enough to be its own syllabus. Deep native binary analysis plugs into Hopper, Ghidra or IDA and returns pseudocode, assembly, symbols and call references; JavaScript and Electron apps get module, import, source map, route and IPC analysis straight from Node; .NET assemblies read statically with no runtime; Android APKs decompile through headless JADX with a full JDK, and APK signatures, Flutter Dart snapshots, IL2CPP metadata versions 24 through 39 and Godot PCK archives decode with no engine install. The static niches are where it gets fun: Go binaries report compiler version and build settings, CUDA and HIP GPU code objects disclose kernel parameters and retained PTX, GGUF and safetensors model files yield tensor declarations, Erlang BEAM chunks, Linux kernel module .modinfo, Apple IPS crash reports, PyInstaller archives, SQLite schemas, WASM imports and exports, even offline EVM bytecode analysis. Requirements are Node.js 22.x, 24.x or 26.12.1 plus npm, and the README stresses that analysis runs locally, your agent receives the results, and nothing gets uploaded.

Showcases that prove it

Three case studies anchor the marketing in receipts. DX-Ball: follow a sound call into its position to pan helper and reconstruct it in C, a result that passes 3,205 original x86 test cases and reproduces all 63 compiled function bytes. Notion: trace the Electron clipboard bridge from renderer through preload and IPC into the main process. TH04: recover a 16 bit DOS era bullet ring calculation from the PC-98 game and compare reconstructed C++ against historical compiler output. The project also builds reinforcement learning environments: record a web app session as a HAR, let REA turn the recorded API requests and responses into agent tools via AgentEnv and Docker, then define task goals and reward checks for RL training, with the environment only supporting changes the recording confirms. The legal framing is explicit throughout: REA is for lawful research, education, interoperability and software preservation, on software you own or are authorized to examine, and commercial tools like IDA and Hopper must be properly licensed.

Project card

FAQ

What is REA?
An MCP server and CLI that gives coding agents tools to inspect native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs and more, returning findings with their evidence.

Do I need a decompiler installed?
Deep native analysis uses Hopper, Ghidra or IDA, which must be licensed and installed; simplified inspection of JavaScript and .NET targets runs with none of them.

How popular is the project?
GitHub's API reports 391,795 stars, a figure the README itself flags as having passed the 300,000 mark with a thank you to contributors.

Which agents can use it?
Any agent supporting local MCP servers; the setup command configures Claude Code, Codex, Cursor, Gemini CLI and Grok Build directly.

Does my code or app get uploaded?
No, analysis runs locally on your machine; the project notes only that your agent's model provider has its own data policy.

Where can I see real results?
The showcase documents a DX-Ball sound function reconstruction passing 3,205 x86 test cases, a Notion clipboard bridge trace, and a PC-98 TH04 math recovery.

Bottom Line

Reverse engineering has always been artisanal hour drills in IDA, and this package industrializes the junior part of it without pretending the hard part goes away: the vision of handing your boring, looking-at-a-feature-instance request to an agent and getting evidence, pseudocode and a working reimplementation in return is now concrete enough that the showcases can cite test case counts. The tool's real contribution is enforceable honesty, evidence on every claim and a stern stance on lawful use, making it the first agent tool in this space whose documentation reads like it was written by lawyers as well as engineers.

Sources

• GitHub morluto/rea README (pitch, target table, showcases, licensing and disclaimer), accessed 26 October 2026
• GitHub API repository metadata for morluto/rea, accessed 26 October 2026

Related: Metroid Dread: Unofficial PC Port Hits 240 FPS With Widescreen | Microsoft Database: Teen Exposes 17 Trillion Rows via Missing JWT