morluto/rea

What it is

REA (rea-agents on npm, repo morluto/rea) is an MCP server plus local CLI that lets an AI agent inspect compiled or packaged software without source: native binaries, JavaScript/Electron apps (including ASAR), .NET assemblies, and websites. The intended workflow is to ask the agent how a feature in an existing app works, get the evidence, and have it write and test an equivalent implementation. The README warns that only morluto/rea, rea.tools and the rea-agents npm package are official; similarly named repos or copied READMEs are not.

Preconditions / Affected

• Node.js 22.x (>=22.19), 24.x (>=24.11) or 26+, plus npm.
• Native analysis needs a provider: Hopper, Ghidra or IDA (existing installs; setup can install Hopper after approval). Caller-supplied GNU objdump and Rizin work for offline native inspection, and REA does not install or update them. Static JavaScript and .NET inspection need no native engine.
• Linux: Ghidra, JADX, firmware tool launches and static JS/Electron analysis require a procps-compatible ps on REA's PATH for process-ownership checks (see docs/installation.md, "Linux owned-process prerequisite").
• macOS Hopper: a first-run dialog asks for demo mode or license activation. Complete it in the same user session before the first CLI/MCP call or unattended job.
• Large binaries: raise REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.
• Commercial tools (IDA Pro/Hex-Rays, Hopper, JEB) must be legally obtained by you. Demo and trial terms may restrict automation and output sharing.

What to do

Register with your agent (Claude Code, Codex, Cursor, Gemini CLI, Grok Build, others). Setup shows proposed changes, backs up existing config, and needs an agent restart:

npx rea-agents setup

Static JS/Electron analysis from the CLI, with no native engine:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Output includes modules, imports, Electron boundaries and their evidence.

Permanent install and updates:

npm install --global rea-agents
rea --help
rea update
npx rea-agents@latest setup

rea update covers global npm or bun installs, and Bun needs 1.2.17 or later. Rerun the setup command it prints to refresh agent registrations. The project says releases are fast-moving, so update before filing a bug. Bug reports should include REA version, target type, repro steps and error output. Vulnerabilities go through SECURITY.md.

Caveats

• Static JS and .NET inspection read files without running the app. Runtime capture executes or interacts with the target under your user permissions, so check each runtime guide first.
• Analysis is local, but your agent receives tool results and its model provider's data policy applies.
• Provider and native format support varies. Windows Ghidra support is labeled experimental, and some features may be on main but not yet in the latest npm release.
• Showcase claims (the x86 audio helper reconstruction passing 3,205 original-x86 cases and matching all 63 compiled function bytes) are the project's own and were not checked here.
• The stated acceptable use is lawful research, interoperability, preservation, education, and software you own or are authorized to examine. Cloning a competitor's feature from its binary raises licensing questions that the README leaves to you.