REA: Let agents investigate software from apps to binaries
A local reverse-engineering tool connecting MCP agents to Hopper, Ghidra, and app runtime behavior, with evidence and limitations.
GitHub morluto/rea Updated 2026-10-07 Branch main Stars 9.5K Forks 1.0K
TypeScript JavaScript Reverse engineering MCP Hopper Ghidra Local analysis

🧭 Decision Guide

Why trending now: The README presents REA as a local investigation workflow connecting AI agents, MCP, CLI, and reverse-engineering tools such as Hopper and Ghidra, while producing evidence and limitations from application behavior down to binaries. Alongside 2,956 stars gained today, 9,457 total stars, and the latest rea-agents v4.1.0, these are the documented attention signals; the exact reason for the trend cannot be confirmed from the materials alone.

Try it if you

  • You need code graphs and evidence from a JavaScript or Electron application tree or ASAR
    README「First result from the terminal」provides the analyze-javascript-application command and says it returns Evidence, a recovered graph, limitations, and unknowns.
  • Your AI coding assistant supports MCP and you want to investigate and recreate a feature in one session
    README「Why REA」and「The investigation model」describe MCP integration and the Decompile, Understand, and Recreate workflow.
  • You want the application sample to remain local instead of being uploaded to a hosted analysis service
    README「Why REA」under Local by design says analysis runs locally and the app is not uploaded.
  • You already have Hopper, Ghidra, or IDA and need native-binary analysis
    README「How it works」lists Hopper, Ghidra, and IDA MCP providers; Quick start says an existing Ghidra installation can be recorded.

Skip it if you

  • You need REA to recover original source code or automatically clone a complete application
    README「The investigation model」explicitly says REA does not claim to recover original source code or automatically clone an application.
  • You need runtime JavaScript behavior but plan to use only static analysis
    README「Security model」says static JavaScript analysis does not execute extracted modules; runtime behavior requires browser, Electron, or process capture.
  • Your Windows target is not a native x86-64 PE application on local NTFS
    README「Security model」limits Windows Ghidra P0 to native x86-64 PE applications on local NTFS.
  • You cannot grant macOS Accessibility or Screen Recording permissions while needing native UI capture
    README「Security model」says native UI capture depends on macOS Accessibility and Screen Recording access.

Requirements

  • The installer requires Node.js and npm to be installed already, as stated in README「Install the rea command」.
  • The first JavaScript/Electron analysis command expects an “extracted JavaScript/Electron application tree or ASAR.”
  • Native analysis requires an analysis engine configured first; the README names Hopper, Ghidra, and the IDA provider.
  • The Linux Hopper demo needs Xvfb, Python 3, X11, and XTEST; approved setup installs these dependencies.
  • macOS native UI capture requires Accessibility and Screen Recording permissions.

First step (verbatim from README)

npx rea-agents setup

Watch out

  • After curl installation, you may need to add ~/.local/bin to the shell PATH.
    README「Linux installation and troubleshooting」explicitly mentions the curl-installer scenario.
  • If the Hopper path is unusual, set HOPPER_LAUNCHER_PATH and run rea doctor --json.
    README「Linux installation and troubleshooting」provides the environment variable and doctor command.
  • The default Linux Hopper launcher path is /opt/hopper/bin/Hopper.
    README「Linux installation and troubleshooting」lists the default Linux HOPPER_LAUNCHER_PATH.
  • REA does not remove all runtime risk; tools and targets run with the user's permissions.
    README「Security model」states that analysis tools and launched targets use user permissions.

Alternatives

  • Hopper：More direct when you already have Hopper installed and want to use REA's native-analysis provider.
    Quick start; How it works
  • Ghidra：More appropriate when you need Ghidra inventory, function analysis, and annotation capabilities.
    How it works
  • IDA MCP provider：More appropriate when you have an IDA GUI or owned headless database and want the upstream MCP lifecycle.
    How it works

Not stated in the README

  • The omitted Requirements section does not provide the complete operating-system matrix, Node.js versions, or supported-agent list.
  • The omitted Current status section does not provide maturity, stability, or known-issue details for each provider.
  • The materials provide no performance data or large-sample timings for Hopper, Ghidra, IDA, CDP, or the JADX adapter.
  • The materials do not specify the compatibility matrix for the Native macOS provider, Android JADX adapter, and Firmware providers outside the stated environments.
  • The materials do not identify agent models, context limits, or feature differences among AI coding assistants.
  • The materials do not provide release dates, changes, or upgrade compatibility between the five releases and rea-agents v4.1.0.

💡 Deep Analysis

6
Yes I maintain an Electron application and only have an extracted ASAR and application directory, without Hopper or Ghidra. Can I use REA to statically trace a search or login feature without executing the analyzed JavaScript modules?
For: A TypeScript/JavaScript engineer maintaining an Electron application who has only an extracted ASAR and application directory, without Hopper or Ghidra

Yes: this is an explicitly supported low-dependency entry point. Static JavaScript/Electron analysis requires neither Hopper nor Ghidra and does not execute the analyzed modules.

  • The documented tool coverage includes JavaScript, Electron, and extracted application directories or ASAR files.
  • The README states that static JavaScript analysis needs neither engine, so lacking a native decompiler is not a blocker.
  • This is suitable for locating strings, module relationships, and code clues. If the question depends on live network behavior, user actions, or Electron runtime state, you need CDP or the Node/Electron V8 Inspector instead.
  • Results remain evidence, inferences, and limitations rather than a guarantee of recovered source code.
  • Quick start: "Static JavaScript analysis needs neither engine."
  • How it works: "Artifact graph provider" and "Browser CDP provider"
  • Current status / Tool catalog: JavaScript/Electron static analysis can target extracted application directories or ASAR files
  • The investigation model: "Decompile / Understand / Recreate"
npx rea-agents setup
Not stated in the README：The excerpt does not provide the complete command syntax for analyze-javascript-application.；It does not specify the Electron version, whether the ASAR is complete, or whether the code is obfuscated or dynamically loaded.
Yes I use an AI coding agent that supports MCP. I want to investigate a search feature in the same closed-source application across multiple steps, then adapt the result to my own TypeScript product. Is REA more suitable than running separate CLI commands each time?
For: A software engineer using an AI coding agent who wants to investigate a closed-source feature through MCP and recreate it in a TypeScript stack

Yes: your use case directly matches REA’s persistent MCP sessions and Decompile–Understand–Recreate workflow, provided you treat the output as implementation guidance rather than copied closed-source code.

  • The README says an MCP session can retain the active target and evidence ledger, so you can follow the search entry point, call relationships, and runtime observations without rebuilding the target each time.
  • CLI and MCP use the same application workflows and evidence contracts, giving terminal and agent usage a shared output contract.
  • The Recreate stage adapts what was learned to your own stack, interface, and requirements; the README explicitly says REA does not automatically clone an application.
  • The agent must correctly support MCP tool calls, session context, and configuration formats; continuity still depends on that agent.
  • The investigation model: "Decompile / Understand / Recreate"
  • Why REA: "Keeps context" and "From insight to code"
  • How it works: "an MCP session can retain an active target and evidence ledger for the session"
  • The investigation model: "It does not claim to recover original source code or automatically clone an application."
npx rea-agents setup
Not stated in the README：The excerpt does not confirm whether your specific agent has been tested with REA's MCP configuration and persistent sessions.；It does not explain how REA handles server-side logic, login credentials, or external search-index dependencies.
Yes I work on both Android applications and firmware samples, and my existing workflow depends on headless JADX, Binwalk, and Unblob. Can REA connect these providers to one agent investigation instead of supporting only Hopper or Ghidra?
For: A reverse-engineering researcher analyzing Android APKs and firmware files who wants to keep using JADX, Binwalk, or Unblob instead of replacing the whole toolchain

Yes: REA’s provider architecture is not limited to Hopper or Ghidra; the README explicitly lists Android JADX and Binwalk/Unblob firmware adapters.

  • The architecture includes an Android static provider described as a headless JADX adapter, plus firmware adapters for Binwalk and Unblob.
  • The provider registry uses declared capabilities and deterministic selection, making one investigation entry point suitable for different target types.
  • CLI and MCP share workflows and evidence contracts, so Android code clues and firmware filesystem findings can be returned through a common format.
  • This does not guarantee complete recovery for every sample. Format recognition, encryption, compression, architecture, and backend-tool state can still limit the result.
  • How it works: "Android static provider headless JADX adapter"
  • How it works: "Firmware providers Binwalk / Unblob adapters"
  • How it works: "A provider declares which capabilities it supports"
  • How it works: "The CLI and MCP server use the same application workflows and evidence contracts."
npx rea-agents setup
Not stated in the README：The excerpt does not specify minimum versions for JADX, Binwalk, or Unblob or their coverage of specific APK and firmware formats.；It does not state whether encrypted firmware, custom containers, or split APKs have dedicated handling.
It depends I handle proprietary enterprise binaries that cannot be sent to the cloud, and agent configuration changes on my workstation must be reviewable before application. Do REA's local-first architecture and setup flow satisfy both constraints?
For: A security researcher handling sensitive closed-source applications on an enterprise workstation who requires local execution and reviewable agent configuration changes

It depends: REA meets the product-level requirements for local analysis and reviewable configuration changes, but it does not replace enterprise review of the target, third-party analyzers, or permissions.

  • The README explicitly says that analysis runs locally and that REA does not upload the application to a hosted analysis service.
  • Setup shows the exact paths and changes before applying them and backs up existing configuration; Hopper installation has separate consent.
  • The doctor command can check the agent, analysis engines, paths, and parts of the runtime environment, which helps identify setup gaps.
  • However, the target and analyzers generally run with the current user’s permissions. Local execution does not eliminate file, network, process, or system side effects, and authorization and licensing remain organizational responsibilities.
  • Quick start: "Analysis runs locally" and "REA does not upload the app to a hosted analysis service."
  • Quick start: "Choose which supported agents should use REA, then review the exact paths and changes before approving."
  • Quick start: "Setup shows its changes before applying them and backs up existing configuration."
  • Security model / Usage limitations: the target generally runs with current-user permissions and local execution can still have system side effects
npx rea-agents setup
Not stated in the README：The excerpt does not specify the impact of enterprise proxies, offline environments, endpoint protection, or network isolation on setup or providers.；It does not state whether every third-party analyzer offers licensing and audit capabilities compatible with organizational policy.
It depends I analyze a native x86-64 PE application on local NTFS storage under Windows, already have Ghidra, and cannot upload samples to a hosted analysis service. Can REA combine static analysis and evidence tracking in one agent session?
For: A reverse engineer analyzing a local native x86-64 PE application on Windows, with Ghidra already installed and no permission to upload samples to the cloud

It depends: REA fits local orchestration and evidence continuity, but its Windows Ghidra scope and environment requirements must match your case.

  • The README describes a Ghidra provider, a target-bound session router, and an evidence ledger; an MCP session can retain the active target and evidence context.
  • Analysis runs locally, and REA does not upload the application to a hosted analysis service, which matches the sample-handling constraint.
  • The documented Windows Ghidra scope is experimental and mainly covers native x86-64 PE applications on local NTFS storage; it should not be treated as universal PE support.
  • Result quality still depends on Ghidra, available symbols, and the sample. REA explicitly does not claim to recover original source code.
  • How it works: "an MCP session can retain an active target and evidence ledger for the session"
  • Quick start: "Analysis runs locally, and results include the evidence and limitations behind each conclusion."
  • Ghidra analysis provider / Current status: experimental Windows Ghidra support is primarily for native x86-64 PE applications on local NTFS
  • The investigation model: "It does not claim to recover original source code"
npx rea-agents setup
Not stated in the README：The provided README excerpt does not specify whether your Ghidra version, Java runtime, and Windows version are compatible.；It does not state whether the target uses packing, obfuscation, anti-debugging, or dynamically generated code.
It depends Static JavaScript graphs are not enough for my Electron application: I need to observe how Node modules handle user input and network state at runtime. Do REA's V8 Inspector and evidence sessions fit this constraint?
For: An application engineer maintaining a TypeScript implementation who needs to verify actual Electron/Node runtime behavior

It depends: REA exposes the relevant Electron/Node V8 Inspector, but runtime observation requires the target to start and accept the debugging connection; static analysis alone is insufficient.

  • The architecture lists the Node and Electron V8 Inspector and separates the static Artifact graph from runtime observation, which helps distinguish code clues from actual behavior.
  • An MCP session can retain the active target and evidence ledger, allowing runtime observations to remain part of the same investigation.
  • Execution may be affected by permissions, network dependencies, sandboxes, anti-debugging, or crashes; the target normally runs with the current user’s permissions.
  • If behavior is implemented by server responses or unsupported dynamic loading, the README does not guarantee that the Inspector can explain it completely.
  • How it works: "Node and Electron V8 Inspector observation"
  • How it works: "The CLI and MCP server use the same application workflows and evidence contracts."
  • Common pitfalls: static JavaScript analysis does not execute code and runtime observation is needed for real behavior
  • Usage limitations: runtime observation may be affected by permissions, anti-debugging, sandboxes, network dependencies, and target crashes
npx rea-agents setup
Not stated in the README：The excerpt does not specify supported Electron/Node versions, debug-port discovery, or compatibility with your packaging method.；It does not state whether the required network requests can be reproduced in your test environment.

✨ Highlights

  • MCP and CLI share the same reverse-engineering workflows
  • JavaScript analysis needs neither Hopper, Ghidra, nor app execution
  • Outputs Evidence, recovered graphs, limitations, and unknowns
  • Supports Hopper, Ghidra, IDA, and browser CDP
  • Windows Ghidra P0 only covers x86-64 PE on local NTFS

🔧 Engineering

  • Use npx to analyze JavaScript or Electron apps and return evidence
  • Use the REA investigation model for decompilation, understanding, and recreation
  • A target-bound session retains the target and evidence ledger

⚠️ Risks

  • Native analysis requires a Hopper, Ghidra, or IDA analysis engine
  • Static JavaScript analysis does not execute modules; runtime needs CDP or process capture
  • macOS native UI capture depends on Accessibility and Screen Recording permissions
  • Analysis tools run with user permissions, and target lifecycles can still have runtime effects

👥 For who?

  • Developers investigating JavaScript, Electron, or native-binary behavior
  • Teams using an AI coding assistant and wanting an MCP workflow
  • Reverse engineers with Hopper, Ghidra, or IDA environments