Rea

Rea (Reverse Engineer Anything) is an open-source MCP toolkit with 350,000+ stars on GitHub that lets AI agents reverse engineer software — from high-level app behavior down to native binaries.

Overview

See a feature in an app and want to understand exactly how it works, without source code? Rea connects your agent to professional analysis tools through a single MCP server: the agent inspects the target, traces the relevant code and returns findings together with the evidence and limitations behind each conclusion, so you can explain the behavior or rebuild the feature in your own project. Analysis runs locally, and static JavaScript and .NET inspection never executes the target. Native analysis builds on your existing Hopper, Ghidra or IDA installation, and the same workflows are available from a terminal CLI. Documented showcases include reconstructing a sound-pan calculation in DX-Ball, tracing Notion’s Electron clipboard bridge and recovering a bullet-ring calculation from a DOS game.

Key Features

• One MCP for reverse engineering – a single interface across binaries, applications and runtime behavior.
• Native binary analysis – pseudocode, assembly, strings, symbols, calls and references via Hopper, Ghidra or IDA.
• App and managed-code analysis – JavaScript and Electron apps, .NET assemblies, Android APKs, Flutter apps and Unity IL2CPP metadata.
• Evidence-based findings – every conclusion ships with supporting evidence and stated unknowns, not guesses.
• Broad artifact coverage – firmware, WASM, EVM bytecode, SQLite databases, packet captures, network recordings and PyInstaller executables.
• Terminal CLI – run the same analysis workflows outside an agent with the rea command.
• Works with major agents – one-command setup for Claude Code, Codex, Cursor, Gemini CLI and Grok Build.

💳 Pricing

Rea is free and open source under the MIT license, distributed through the rea-agents npm package. Native analysis uses your own existing Hopper, Ghidra or IDA setup — Ghidra is itself free — so there is no Rea subscription or usage fee.

Who Is It For

Security researchers, reverse engineers and developers who need to understand how closed software behaves — for interoperability, security auditing, malware analysis or reimplementing a feature they admire.