English · 简体中文 · Back to the list
⭐ Star the list on GitHub to find it again, or Watch → Custom → Releases for the weekly digest.
Short answers to the questions people ask most about REA, with links to the sources. Facts were checked for the main list; star counts and versions change weekly, so read the date next to a number.
REA, short for Reverse Engineer Anything, is morluto/rea: an open-source (MIT) MCP server and CLI that lets coding agents inspect native binaries, Electron apps, .NET assemblies, Android APKs, firmware and websites without their source code, explain how a feature works with evidence, and rebuild it. It had 417k+ GitHub stars as of 2026-11-01.
No. REA orchestrates existing tools such as Hopper, Ghidra, IDA and JADX for the agent, and gathers their results as evidence.
The published package is rea-agents on npm. Run npx rea-agents setup to register it with your agent. The official docs are on rea.tools, with illustrated guides, and there is a Chinese README.
Only from morluto/rea, rea.tools and the npm package rea-agents. Some GitHub repositories with similar names offer an “official free download” as zip files. They are not official. Do not run archives or executables from anywhere else.
Analysis runs locally, but tool results pass through the agent to your model provider. REA’s own SECURITY.md says REA is not a sandbox. Commercial tools it can drive, such as IDA Pro, Hopper and JEB, must be licensed separately; REA provides no licenses.
Reverse engineering is governed by local law, software licenses and terms of service. REA’s DISCLAIMER.md lists permitted uses: learning, research, interoperability, preservation, security research, vulnerability disclosure and CTFs. It excludes copying proprietary software or reproducing its protected code and assets. More in Legal and controversy.
The official showcases include a byte-exact rebuild of one DX-Ball sound function, tracing Notion’s Electron clipboard bridge, and tracing TOTP code generation in the Aegis Android app. Community projects that say they used REA include hexgrab, a .NET colour picker, and rec-rs, a Rust screen recorder for macOS. See all community cases and the index by app.
Often not. Of the six most-shared cases, only DX-Ball says in its own repo that it used REA. Two more say so only in the author’s post, and the other three used other tools or are unverified. Did it really use REA? checks each claim against its source.
The official project does not claim either. The DX-Ball figures (3,205 matching test cases, 63 matching bytes) apply to one function, not the whole game.
The controlled tests we know of are mixed. rea-lab ran 482 Claude Code runs and found no significant gain in solve rate, with REA runs taking about twice the time and cost. leanrea found a plain-CLI skill came close to REA’s accuracy at lower cost. Details in Does REA help? The evidence.
REA explains how a program works and shows the evidence. Craft Anything has an agent build your own version of a target and checks the build against the original. See REA or Craft Anything?
On the official Discord (Q&A and Show and Tell) and in GitHub Discussions. This FAQ and list are unofficial and not affiliated with morluto/rea.