morluto/rea

What it claims

REA presents its analysis as local, evidence-backed reverse engineering for coding agents, and it is MIT-licensed. Its showcases put numbers on the result. In one, a reconstructed x86 sound helper (position-to-pan) passes 3,205 original-x86 test cases and reproduces all 63 compiled function bytes. In another, a PC-98 game's 16-bit angle calculations were recovered and the reconstructed C++ compared against historical compiler output. A third traces an Electron clipboard API from renderer through preload and IPC into the main process.

How it works

The analysis path depends on the target type. Only tool results leave the machine, and they go to the agent's model provider.

flowchart LR
  A[Agent via MCP / rea CLI] --> B{Target type}
  B -->|JS/Electron, ASAR, .NET| C[Static read, no engine]
  B -->|Native binary| D[Hopper / Ghidra / IDA<br/>or objdump / Rizin]
  B -->|Runtime capture| E[Runs target as your user]
  C & D & E --> F[Findings + evidence + limits]
  F -->|tool results| G[Model provider's data policy]

• Native analysis returns pseudocode and assembly. The agent writes the C itself.
• JavaScript/Electron analysis returns modules, imports and Electron boundaries.
• Ghidra also covers 16-bit DOS binaries.
• Runtime capture is a different mode from static inspection. It executes or interacts with the target under your user permissions.

How to use it

Requirements: Node.js 22.x (≥22.19), 24.x (≥24.11) or 26+, plus npm.

Agent setup. Setup shows proposed config changes, backs up existing config, and needs an agent restart afterwards:

npx rea-agents setup

Static JS/Electron analysis needs no native engine:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Global CLI:

npm install --global rea-agents
rea --help
rea update

Updating:

• Bun global installs: rea update needs Bun ≥1.2.17.
• npx users: refresh with npx rea-agents@latest setup. With Bun, use bunx rea-agents@latest instead.
• Release cadence: the README says releases change quickly and carry frequent bug fixes. Its first troubleshooting step is to update.

Native providers:

• Setup can install Hopper with your approval.
• Ghidra and IDA must already be installed. IDA has an optional native MCP bridge.
• REA does not install or update objdump or Rizin.

For large binaries, raise the provider startup timeout with REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.

Limits

• Linux: Ghidra, JADX, firmware tools and static JS/Electron analysis require a procps-compatible ps on REA's PATH. The fix is in docs/installation.md under "Linux owned-process prerequisite".
• Windows: Ghidra support is marked experimental. Native format and host support vary by provider.
• macOS Hopper: a first-run dialog (demo mode or license) must be completed in the same user session before any CLI/MCP or unattended job.
• npm lag: some features may be ahead of the latest npm release. Check release availability before relying on them.
• Commercial tools: IDA Pro/Hex-Rays, Hopper and JEB must be legally licensed by you, and REA grants no keys. Trial and demo terms, including restrictions on automation and output sharing, still apply.
• Responsible use: the stated scope is lawful research, interoperability, preservation, and software you own or are authorized to examine.
• Lookalike copies: the README warns that lookalike repositories and copied READMEs exist. The official sources are only morluto/rea, rea.tools and the rea-agents npm package.