REA: reverse engineering with AI agents

What REA does

REA gives coding agents tools for understanding how existing software works. You can ask an agent to investigate a particular behavior, inspect the relevant parts of an application, and explain what it found with references to the underlying evidence. It also offers a command-line interface for working with the same inspection workflows directly.

That makes it useful when a repository search cannot answer your question because you do not have the application's source code. An investigation might follow a native function, trace a JavaScript application's modules, or examine the requests a website makes. The result gives the agent material to reason from, rather than relying on a guess about the implementation.

What you can inspect

The project documents several kinds of targets, each with its own workflow:

• Native binaries: inspect pseudocode, assembly, strings, symbols, calls and references through a supported analysis engine.
• JavaScript and Electron applications: explore modules, imports, source maps and the connections between different application processes.
• Websites and saved network captures: examine page structure, scripts, observed network activity or previously recorded requests and responses.
• Managed code and packaged artifacts: inspect .NET metadata and instructions, Android packages, application resources and other supported formats.

The distinction between these workflows matters. Reading a supplied artifact is different from interacting with a running application, and the available evidence depends on the target and the tools you have configured.

How an agent uses it

REA connects to compatible agents through MCP. The agent requests an inspection, reads the returned findings, then follows up on the parts that matter to your question. You can ask it to trace a behavior, explain the relevant code, or use what it has learned to help build and test an implementation in your own project.

The project's setup supports agents including Claude Code, Codex and Cursor. Terminal users can run inspections without making an agent the interface for every step.

A useful first investigation

Start with one behavior you can recognize: how an Electron app handles a clipboard operation, for example, or where a native application calculates a particular value. Give the agent the target and a clear question, and ask it to show the references behind its explanation.

The practical value comes from being able to retrace the answer. Compare the reported findings with the referenced code or a controlled observation before treating an explanation as an implementation specification. A plausible description alone is not the same as evidence that a feature works that way.

What to know before setting it up

REA is intended for technical work such as software research, interoperability and understanding applications you own or are authorized to examine. Native binary analysis can require an existing Hopper, Ghidra or IDA installation. Other targets have different dependencies; installing REA does not automatically supply every analysis engine.

The documentation distinguishes static JavaScript and .NET inspection, which read the supplied files, from runtime capture, which runs or interacts with the target. Analysis runs locally, while an agent's model provider handles the tool results according to its own data policy.

Use the official README or REA's project website for installation instructions and target-specific guides. Those links lead to the maintained instructions without tying this overview to a particular package version.