# Reverse Engineer Anything: What the Viral REA MCP Actually Does

> The REA MCP bridges AI coding agents to tools like Ghidra and Hopper, letting developers decompile, analyze, and rebuild app features locally.

Source: https://camnangai.com/en/for/developers/what-is-rea-mcp  
Published: 2026-10-12

The [**REA MCP**](https://rea.tools/) is an open-source Model Context Protocol server written in
  TypeScript that bridges AI coding agents—such as Claude Code, Cursor, Codex, and Gemini CLI—to
  mature binary disassemblers and static analysis engines, including
  [Ghidra](https://github.com/NationalSecurityAgency/ghidra), [Hopper](https://www.hopperapp.com/),
  and [IDA](https://hex-rays.com/ida-pro).

Designed as an extensible orchestration layer, it lets autonomous agents inspect compiled software,
extract structured evidence, decompile routines into readable pseudocode, and reconstruct complex
application behavior locally. By establishing a direct interface between large language models and
local disassemblers, REA allows developers to analyze third-party software, trace internal routines,
and write clean-room implementations of targeted app features without executing untrusted code or
sending target binaries to external cloud services.

![How the REA MCP bridges AI coding agents to mature disassemblers](https://camnangai.com/articles/rea-mcp-la-gi/01-infographic-en.webp)

While REA has achieved significant viral popularity, racking up 128.9k GitHub stars and 28.8k
forks, it is important to understand what it actually is under the hood. REA is not a new decompilation engine
or static analysis framework. Instead, it is an automated integration and tool-calling loop
that exposes proven binary disassemblers and application graph extractors to AI agents through a
standardized protocol. It packages decades-old binary analysis infrastructure into an autonomous agentic loop, replacing manual disassembler work with structured tool calls.

## What is the REA MCP and Why Did It Go Viral?

Created by developer [**morluto**](https://github.com/morluto) under the open-source MIT license, the **REA** project operates as an evidence-based reverse-engineering platform designed specifically for agentic development. It provides a dual interface: a terminal command-line interface (`rea`) for manual execution and an MCP server (`rea-agents`) that registers structured tool definitions directly into local AI coding clients. REA enforces an agent-driven mental model based on three distinct phases: point an agent at a target binary or application bundle, ask how a specific feature operates, and allow the agent to autonomously query REA to decompile routines, inspect evidence records, and write a functional clone in your language or framework of choice.

The framework's rapid viral adoption, reaching 128.9k GitHub stars, 28.8k forks, and 117 contributors, ignited wide industry commentary regarding the future of software development. Social media discourse frequently referenced sharp star-growth charts and claimed that traditional application development had been rendered obsolete. However, a systems-level analysis demonstrates that REA does not invent novel decompilation algorithms. Rather, it packages established, multi-decade static analysis tools—including NSA's Ghidra (released in 2019), Hopper Disassembler (2011), and IDA Pro (1990s)—into an autonomous feedback loop. By wrapping these engines in structured tool definitions, REA enables AI agents to execute multi-step disassembly tasks, follow cross-references, and synthesize software mechanics without manual disassembler operation.

Developers can initialize the environment and integrate **REA MCP** into supported AI clients by running its interactive setup wizard:

```bash
npx rea-agents@latest setup
```

The setup utility automatically scans the host system for compatible AI clients (including Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Devin, and OpenCode) and proposes precise configuration updates. To ensure environment stability and deterministic tool schemas, setup pins persistent MCP server definitions to explicit package releases (such as `rea-agents@6.4.0`). Configuration edits to agent JSON or TOML files are applied only after explicit user review and interactive approval, backing up existing configurations prior to modification.

## Technical Architecture: Bridging Ghidra, Hopper, and IDA into AI Agents

Architecturally, **REA MCP** functions as a translation and orchestration layer bridging high-level agent requests to deep-analysis binary engines. Its internal pipeline structures binary analysis into three phases: _Decompile_ (extracting assembly, decompiled pseudocode, embedded strings, and symbol tables), _Understand_ (mapping function call graphs, tracing control flow, and evaluating cross-references across routines), and _Recreate_ (generating clean, un-encumbered implementation code). REA supports a range of binary disassemblers, including Hopper, Ghidra 12.1.x (requiring a 64-bit JDK 21 runtime), and IDA Pro. Host OS support covers macOS 12+, Ubuntu 24.04+, Fedora 41+, Nobara 44+, Arch Linux, CachyOS, and Omarchy, alongside experimental, read-only Windows x64 Ghidra P0 integration.

![Three-phase REA MCP pipeline: Decompile, Understand, and Recreate](https://camnangai.com/articles/rea-mcp-la-gi/02-en.webp)

To eliminate AI model hallucinations during binary investigation, REA structures all analysis outputs around its "Evidence v2" specification. Every tool invocation returns a cryptographically verifiable JSON record containing SHA-256 artifact digests, provider confidence metrics, exact file offsets, and explicit statements of unknown or missing facts. By isolating static code inferences from dynamic runtime observations and labeling unresolvable routines as explicit unknowns, REA prevents LLMs from inventing plausible pseudocode when binary data is incomplete or ambiguous.

Local execution is an absolute constraint of REA's design. Running on Node.js 22.19+, 24.11+, or 26+ runtimes, REA executes all analysis locally using stdio or authenticated local sockets. Binary artifacts, symbol maps, and extracted evidence remain entirely on the user's host hardware, guaranteeing that proprietary binaries are never uploaded to external analysis endpoints.

## Dissecting JavaScript and Electron Apps Without Executing Code

For web applications, JavaScript codebases, and Electron desktop suites, **REA MCP** delivers static analysis without executing untrusted target code or opening a native binary disassembler. It directly unpacks ASAR archives, identifies application entry points, maps Inter-Process Communication (IPC) main and renderer channels, isolates preload scripts, and resolves bundled source maps directly from application directories on disk.

![Static extraction and AST analysis of Electron packages without code execution](https://camnangai.com/articles/rea-mcp-la-gi/03-en.webp)

To trace execution flow across minified or obfuscated JavaScript codebases, REA constructs two complementary graph abstractions: the _JavaScript Application Graph_ and the _Semantic Relation Graph_. Using tools such as `trace_javascript_semantics`, REA performs execution-free AST scope analysis to track lexical definitions and reads, closure scope captures, static property slots, and explicit Promise construction, chaining, and await points. Furthermore, when evaluating version-to-version behavioral changes using `compare_application_versions`, REA pairs modules and entities across builds using a strict six-tier hierarchical matching algorithm: (1) exact content digest, (2) exact module-source digest, (3) exact node identity, (4) source-map identity, (5) structural fingerprint, and (6) semantic key for non-module entities. Higher tiers maintain priority, preventing fuzzy matches from overriding exact content digests.

Developers can execute this execution-free static analysis directly from the terminal without attaching an AI agent, generating structured JSON evidence for automated inspection pipelines:

```bash
npx -y rea-agents@latest analyze-javascript-application /path/to/app --json
```

The resulting JSON payload delivers a complete, verifiable record detailing extracted modules, import dependencies, route definitions, source-map relationships, and Electron IPC channel boundaries.

## Practical Benchmark: Rebuilding the macOS Preview App vs Vanilla Agents

Empirical evaluations highlight both the analytical precision and trade-offs of disassembler-backed agents. In a controlled benchmark tasked with cloning the macOS Preview application—including image viewing, zooming, rotation, drawing tools, annotations, and file export—an REA-assisted agent was evaluated against a vanilla coding agent relying solely on visual screenshots and multimodal reasoning. Both approaches successfully produced functional clones containing all required features. However, the vanilla agent completed the task faster by directly generating UI layouts from visual observations. In contrast, the agent powered by **REA MCP** used native decompilation, strings, and call graphs to achieve exact structural alignment with Preview's underlying application logic, verifying specific function boundaries at the cost of additional tool calls and disassembly processing latency.

![Benchmarking Vanilla Agent against REA MCP Agent in app reverse engineering](https://camnangai.com/articles/rea-mcp-la-gi/04-en.webp)

Beyond UI-driven desktop applications, REA demonstrates high fidelity in exact algorithmic reconstruction from compiled assembly. In a case study targeting the classic game _DX-Ball_, REA decompiled raw x86 assembly to recover a 16-bit positioning-to-audio-pan calculation in C; the reconstructed routine passed 3,205 test cases and matched all 63 compiled bytes of the original binary. Similarly, in an investigation of the PC-98 title _TH04_, REA recovered fixed-point and aimed bullet-ring angle calculations from 16-bit DOS assembly, accurately reproducing the historical C++ compiler's mathematical behavior.

A notable example of logic recovery involved analyzing the Windows Calculator (`calc.exe`) percentage (`%`) button logic. By decompiling instructions at offset `0x180124945`, REA identified specific operator comparison branches (`CMP EAX, 0x5c` for multiplication / `IDC_MUL 92` and `0x5b` for division / `IDC_DIV 91`). This static analysis revealed why the input sequence `200 + 10%` evaluates to `220`: when an addition or subtraction operator precedes the percentage key, the handler branches to calculate `10%` of the primary operand (`200 * 10 / 100`, yielding `20`) and adds it to the base value `200`, whereas following a multiplication operator it simply calculates `10 / 100` (`0.1`).

## Security Constraints, Legal Boundaries, and Software Defensibility

Because reverse-engineering tools handle untrusted target binaries, **REA MCP** incorporates strict operational security boundaries. Dynamic analysis capabilities (such as process capture, Chrome DevTools Protocol browser observation, and runtime execution) are disabled by default. Enabling these features requires explicit environment variable declarations alongside per-invocation user approval. Furthermore, file-system access is gated by variables such as `REA_EVIDENCE_ROOTS_JSON`, restricting static analysis and evidence generation to explicit, pre-approved target directories.

From a legal and licensing perspective, REA supplies no software licenses or DRM bypasses for commercial disassemblers; users must maintain valid, legal authorizations to run Hopper, IDA Pro, or [JEB](https://www.pnfsoftware.com/). REA is designed specifically for lawful research, software preservation, system interoperability, and educational analysis. Engineers are instructed to rely on REA for clean-room reverse engineering—extracting behavioral specifications and functional mechanics to author independent implementations—rather than copying copyrighted source code or proprietary software assets directly.

The rapid emergence of agentic reverse-engineering tools alters the landscape of software defensibility. Thin wrapper applications, basic frontend clients, and simple UI utilities offer virtually no defensibility when general-purpose coding agents equipped with disassembler MCP servers can rapidly decompile and reconstruct their client-side logic. Consequently, long-term software defensibility shifts away from superficial client layouts and toward proprietary backend infrastructure, custom data models, complex runtime state synchronization, and core system architectures.

## When Should Developers Actually Use REA?

**REA MCP** is most effective when an engineering objective demands precise, evidence-backed structural understanding of compiled or obfuscated code. Senior architects should deploy REA when documenting un-documented local file formats, auditing complex offline application logic (such as embedded search indices or CRDT synchronization engines), performing automated behavioral diffing across application updates, or analyzing native desktop and Electron applications lacking source code.

Conversely, teams should hold off on adopting REA when working on Windows environments (where support remains experimental and Ghidra-only) or when attempting to recreate standard web interfaces. For simple frontend UIs, vision-capable coding agents operate faster without the overhead of disassembler tool loops. In practice, REA acts as an automated evidence gatherer to reveal inner system mechanics, but senior engineering judgment remains essential to architect maintainable, production-grade implementations.

## References

- [GitHub - morluto/rea: Reverse engineer anything with agents, from app behavior down to native binaries.](https://github.com/morluto/rea)
- [REA — Reverse Engineering for Your Coding Agent](https://rea.tools/)
- [REA: Let Your AI Agent Reverse Engineer the App Features You Wish You Had — DEV Community](https://dev.to/arshtechpro/rea-let-your-ai-agent-reverse-engineer-the-app-features-you-wish-you-had-3en7)
- [Reverse Engineer Anything: What the Viral REA MCP Actually Does — MindStudio](https://www.mindstudio.ai/blog/reverse-engineer-anything-mcp)
- [Installation and Agent Integration Guide — morluto/rea](https://github.com/morluto/rea/blob/main/docs/installation.md)
- [JavaScript Application Workflows and Graph Specification — morluto/rea](https://github.com/morluto/rea/blob/main/docs/javascript-application-workflows.md)