REA: A Reverse Engineering MCP Server Born in April 2026 Crosses 300,000 GitHub Stars
By Indie Kings | October 18, 2026
Updated October 18, 2026: REA is a Model Context Protocol server that lets AI agents reverse engineer software across native binaries, applications, and runtime behavior, using standard analysis tools such as Hopper, Ghidra, and IDA. Measured today against the official GitHub API, the project, which went live on April 14, 2026, stands at 319,213 stars, 80,961 forks, and 1,147 watchers.
Understanding how a piece of software works, without its source code, has been wrapped into a single protocol setup: run one command, and your AI agent inspects the target through the same disassembler class tools professionals already use. The tool is called REA, short for Reverse Engineer Anything, and six months after its April 2026 launch it carries a star count that older, established projects took years to reach. Per the official README, the pitch is one line: "See a feature you like. Understand how it works, down to the binary level."
What REA Is, in the README's Own Words
Per the official repository README, REA is "one MCP for reverse engineering across binaries, applications, and runtime behavior." The GitHub repository description, verified today, reads: "Reverse engineer anything with agents, from app behavior down to native binaries." MCP is the Model Context Protocol, the standard layer that connects AI agents to external tools, and REA is a server on that protocol dedicated to software analysis.
The project is written in TypeScript, licensed under MIT, and hosted at morluto/rea by a maintainer named morluto. The official site is rea.tools, and the README directs readers there for setup instructions, illustrated guides, and worked case studies.
What that means in practice is a developer's microscope. Point an AI agent at an app or a binary, ask how a specific feature works, and REA connects that agent to inspection tools, returns findings with their evidence, and lets the agent explain the behavior or write and test an implementation. The README is explicit that analysis runs locally and that results include "the evidence and limitations behind each conclusion."
The Scale: 319,213 Stars Six Months In
Here are the numbers measured today, October 18, 2026, straight from the GitHub API for the repository:
| Repository metric | Value (measured Oct 18, 2026) |
|---|---|
| Stars | 319,213 |
| Forks | 80,961 |
| Watchers | 1,147 |
| Created | April 14, 2026 |
| Last push | October 18, 2026 |
| Primary language | TypeScript |
| License | MIT |
| Homepage | rea.tools |
The README's own star history section celebrates a 300,000 star milestone with a public thank you to users, bug reporters, feature requesters, testers, and contributors. A project crossing 300,000 stars at all is rare; one doing it within six months of its first commit, as REA has, is a scale we can state honestly without ranking claims. For comparison, projects that sit in GitHub's all time most starred tier generally needed years of accumulation, not one April to one October.
How the Workflow Works: One MCP Bridge into Standard Tools
The install posture, per the README, is a single command: npx rea-agents setup. That registers REA's MCP server with your agent and installs matching workflow instructions, with backups of existing configuration before anything is overwritten. The project markets itself through an npm package named rea-agents and a listing on skills.sh, alongside the rea.tools site.
Per the README, setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and other agents, and any client that supports local MCP servers can use manual registration. Those names come straight from the README's supported agent list; the project does not endorse a single model provider, and the README notes separately that whatever model you use has its own data policy.
On the analysis side, the README is explicit that REA does not replace the classic reverse engineering tools. It bridges to them. Native analysis can use an existing Hopper, Ghidra, or IDA installation, and setup can optionally install Hopper with user approval. Caller-supplied GNU objdump and Rizin are supported for offline native inspection, and the README states REA does not install or update either provider.
The featured screenshot on the README shows REA launching its analysis bridge inside Hopper while inspecting a native binary, with alt text on the image saying exactly that. In other words, the released product story is agents driving established disassembler class tooling through one protocol surface, not a from-scratch decompiler.
Image credit: morluto/rea, official repository README (image described per its own alt text: REA launching its analysis bridge inside Hopper while inspecting a native binary).
A representative example from the README's quick start asks the agent to "understand how search works in the Notes app, show me the evidence, and build a similar feature for my project." Findings come back with evidence attached, and the agent can follow up, explain, or implement.
What You Can Analyze: The Surfaces the README Names
Per the README, native analysis returns pseudocode, assembly, strings, symbols, calls, and references. The "What you can analyze" table lists 23 target categories. The major surfaces, at the wording the README itself uses:
| Target (per README) | What REA returns | Key requirement |
|---|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls and references | Hopper, Ghidra or IDA |
| JavaScript / Electron apps | Modules, imports, source maps, routes, IPC and native add-on relationships | Node.js and npm, static, no native engine |
| .NET assemblies | Metadata, CIL instructions, declared native dependencies | None, static only |
| Android APKs | Manifest declarations, classes, decompiled methods and references | Headless JADX and a full JDK |
| Websites | Page structure, scripts, network observations, requested screenshots | A Chrome-family browser |
| Firmware | Regions, extraction results and native-analysis handoffs | Binwalk or Unblob on Linux |
| Go and Rust binaries | Embedded build metadata, modules, crate names and dependency edges | Built-in static inspection, no install |
| WASM artifacts and EVM bytecode | Sections, decoded WAT, dispatch selectors and offsets | Caller-supplied WABT |
| SQLite databases | Tables, columns, indexes, views, triggers and selected rows | Local database/WAL snapshot |
| Process behavior | Terminal output, interactions, exit and filesystem observations | Linux/macOS with a native PTY |
The remaining rows cover saved network captures, recorded packets, recorded Linux crashes, Android devices and resources, JEB projects, Flutter app snapshots, recorded logic signals, and package inventories. The README separates static inspection, which reads supplied files without running anything, from runtime capture, which runs or interacts with a target under your own user permissions, with each runtime guide describing its effects.
Version requirements, per the README: Node.js 22.x (22.19 or later), 24.x (24.11 or later), or 26 or newer, plus npm. That detail matters for a six month old project moving this fast; the README also warns that "REA changes quickly" and that releases include frequent bug fixes.
The Showcases, From a DOS Era Game to a Modern App
The README's showcase section is where the workflow gets concrete, and all three examples keep the focus on understanding and reconstructing, which is the project's legal framing of lawful research, education, interoperability, and software preservation.
The first showcase targets DX-Ball, a 1990s Windows game. Per the README case study summary, the workflow follows a sound call into its position-to-pan helper, inspects the instructions, and turns incomplete pseudocode into C. The reconstruction then passes 3,205 original x86 test cases and reproduces all 63 compiled function bytes. That is a full replication of one compiled function, verified numerically.
The second is Notion, a modern Electron app. The walkthrough finds the renderer's clipboard API, follows it through preload and IPC into the main process, and inspects the rich clipboard format.
The third, TH04, goes back to 16 bit DOS. Per the README, the target is the original PC-98 game's instructions, and the work recovers fixed and aimed angle calculations for what the README calls the bullet-ring, then compares reconstructed C++ against historical compiler output. Three showcases, three decades of compiled software, one workflow.
A README in 21 Languages
The repository ships 21 versions of its README, counting the English original plus 20 translations. The translated set includes simplified and traditional Chinese, Japanese, Korean, Turkish, Arabic, Persian, Vietnamese, Thai, Greek, and Malayalam, alongside Russian, Ukrainian, Polish, Brazilian Portuguese, Indonesian, Italian, Spanish, French, and German.
Localization at that depth is itself a signal. A tool for understanding binaries has an audience that spans every region where software ships compiled, and the maintainer clearly sized that audience from day one. Six months in, the translation effort has kept pace with the star count.
The Warning the Project Ships With
Given the scale of the star count, impersonation risk grows with it, and the README carries its own warning at the top under an "IMPORTANT" banner. Its safety spine, quoted verbatim from the README: "Get REA from morluto/rea, rea.tools, or the rea-agents npm package. Follow the installation and release links from these official sources. A similar repository name or copied README does not establish that a download is official."
The disclaimer goes further, per the README: REA is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine, and that position covers all versions, distribution channels, and platforms. The license section adds that users must legally obtain and be authorized to use commercial tools including IDA Pro, Hex-Rays, Hopper, and JEB, and states plainly that cracked copies, stolen keys, unauthorized key sharing, and bypassing license restrictions are not authorized. A tool this large stating its boundaries this explicitly is worth reading as shipped.
Where REA Sits in This Month's AI Reverse Engineering Conversation
REA did not appear in a vacuum, and our own coverage this month maps the neighbors. Earlier this month we covered the preservation side of AI decompilation at the altitude of the Ars reported bill story on October 16, where the legal and archival questions around machine generated decompilation were being argued in public.
Separately, our DLSS NR piece earlier this month looked at a vendor model story from NVIDIA's side, where the vendor owns the model and ships it inside the driver. And this week's ssrecomp beat says openly that an AI agent wrote nearly all of that project's code. REA is the tooling layer underneath the same AI era practice, general purpose analysis aimed at any binary or app rather than one vendor's models or one reconstruction project.
The pattern across all four stories is the same shape: agents that can read compiled software are now producing code, recreating features, and raising the same questions, and REA's six month star count shows how many developers want that capability wired into their workflow.
Our take: We think the star count is the headline but not the insight. What REA actually proves is that the last mile of reverse engineering, wrapping Hopper or Ghidra class tools so an agent can drive them and cite its evidence, was the missing user interface, not the decompilation itself. A project with this growth rate and an explicit lawful use disclaimer is also a test case for whether general purpose binary literacy becomes an ordinary developer skill this cycle. We would watch the showcase pipeline and the supported-agent list for what six more months brings.
FAQ
What is REA?
REA, short for Reverse Engineer Anything, is a Model Context Protocol server per its official README that lets AI agents inspect native binaries, JavaScript and Electron apps, .NET assemblies, websites, and more, with analysis running locally. It is TypeScript code under the MIT license, hosted at morluto/rea.
How popular is REA on GitHub?
Measured today, October 18, 2026, via the GitHub API, the repository has 319,213 stars, 80,961 forks, and 1,147 watchers. The project launched on April 14, 2026, and its README separately celebrates a 300,000 star milestone.
Do I need Hopper, Ghidra, or IDA to use REA?
Per the README, deep native analysis uses one of those three, and setup can optionally install Hopper after your approval while Ghidra and IDA use existing installations. Static JavaScript and .NET inspection work without any native analysis engine.
Which AI agents can use REA?
Per the README, setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and other agents, and any client that supports local MCP servers can register REA manually. Node.js 22.x, 24.x, or 26 or newer is required.
Where should I download REA?
The README's own warning names the official sources: the morluto/rea repository, rea.tools, and the rea-agents npm package, and states that a similar repository name or copied README does not establish that a download is official. Follow installation and release links from those official pages.
Does REA upload my app somewhere?
Per the README, REA analyzes targets locally. Your agent receives the tool results, and the README notes that your model provider has its own separate data policy.
Bottom Line
REA wraps professional grade binary analysis into one MCP server that any local MCP capable agent can drive, and the market's verdict is visible in the numbers measured today: 319,213 stars and 80,961 forks for a project that went live on April 14, 2026. Per the README, the product story is a bridge into Hopper, Ghidra, and IDA with evidence attached to every answer, and the project states its own lawful use boundaries and official source warning in public. Six months from first commit to this scale is the kind of number that reshapes a niche.
Sources
- Official repository README, morluto/rea, fetched in full from raw.githubusercontent.com on October 18, 2026 (taglines, workflow, supported agents, analysis surfaces, showcases, languages, warning text, disclaimer)
- GitHub API, repository morluto/rea, queried October 18, 2026 (stars 319,213, forks 80,961, watchers 1,147, created April 14, 2026, pushed October 18, 2026, TypeScript, MIT, homepage rea.tools)
- Indie Kings earlier coverage this month: AI decompilation preservation bill story (October 16), the DLSS NR vendor model story, and the ssrecomp AI written code beat
Related: Universal Modder Gives AI Agents A Safe Modding Playbook | Alibaba Open Code Review Prioritizes Deterministic Checks Over Vibes | NVIDIA: 415 Signed Agent Skills Now Ship for Claude Code and Codex