The open-source project REA from the morluto/rea repository connects agents like Claude Code and Codex to the classic reverse engineering arsenal: websites, JavaScript and Electron apps, .NET assemblies, Android APKs, firmware, and native binaries via Ghidra, Hopper, and IDA. The MIT-licensed repository has become one of the fastest-growing on GitHub, with approximately 240,000 stars and 60,000 forks by mid-October 2026. In the only independent test, an agent with REA correctly reconstructed the feature structure of a third-party iOS screen where an agent without REA made errors, although the REA-based analysis cost approximately 3.5 times more. The project's main engineering innovation is the Evidence Contract, which separates observations, inferences, and unknowns, directly targeting the primary weakness of agents in reverse engineering: hallucinations.

image
image
image

What happened

The REA project from the morluto/rea repository is structured as an MCP server and CLI combination, allowing agents like Claude Code and Codex to perform software reverse engineering without access to source code. The declared modes cover native binaries via Hopper, Ghidra, and IDA disassemblers, JavaScript and Electron apps, .NET assemblies, Android APKs, firmware, and websites. Analysis is performed locally, distributed under the MIT license, and version v6.5.0 was released on October 13, 2026. The star growth on GitHub stands out even against typical viral projects: approximately 79,000 at the start of the MG AI Blog test on October 11, 2026, over 100,000 the next day, around 109,000 at the time of material preparation, and, according to Data Dynamics' analysis for v6.5.0, 240,000 stars and 60,000 forks by mid-October. Concurrently, MG AI Blog conducted a direct comparison on a single iOS screen: Claude Code with REA correctly reconstructed the functional structure, including card order, the chronotype block, streaks series, and sleep and HRV cards, while the same agent without REA erred in the order and missed some features.

Context

Reverse engineering has been and remains largely a manual craft: an analyst works in a disassembler like Ghidra, Hopper, or IDA, reconstructing the program's structure from fragments, a skill that is narrow and expensive. LLM agents promise to accelerate this work, but their weak point in such tasks has long been known: hallucinations and the conflation of two different messages, "we didn't look" and "there is nothing there," when the model confidently reports the absence of a mechanism that simply didn't fall within its field of vision. REA's answer lies in its architecture: the tool serves as an MCP wrapper over classic analysis tools, returning results in the Evidence Contract format, where observations, derivations, inferences, and unknowns are explicitly separated. The provenance of each statement becomes part of the output, and the unknown stops masquerading as emptiness. There is also a fundamental limit to its capabilities: REA does not restore the actual source code; the output remains pseudocode and collected evidence.

Why this matters for the industry

For the industry, REA is valuable not as a promise of reverse engineering for everyone, but as a working example of a new layer of agent infrastructure. Teams designing their own MCP tools have access to a ready-made template: wrappers over proven professional analysis tools plus a response format where observations and inferences are separated, and the unknown is explicitly tracked as part of the contract. Simultaneously, the value structure shifts: analyzing third-party apps and websites transforms from a manual skill of individual specialists into a cheap entry point for agent products, and teardown and analysis of third-party software become a prototyping option rather than a separate profession. If adoption continues, it is likely that the Evidence Contract approach will be copied in other MCP tools and public benchmarks for agent reverse engineering will emerge; however, this is a predictive interpretation, not an established fact.

Why this matters for users

In practice, analyzing a third-party product comes down to a single command: npx rea-agents setup connects REA to Claude Code or Codex, after which the agent can be tasked with analyzing a website or app to obtain feature structures, design tokens, colors, fonts, and animation parameters. A coherent scenario then unfolds: extracted rules are turned into a prototype or clone, for example in the form of a DESIGN.md file, and the analysis material is suitable for teardown reports on third-party products. The economics should be known in advance: in the MG AI Blog test, analysis via REA cost approximately $40.60 and took about an hour and twelve minutes, while the same agent without REA spent about $11.76 and forty minutes, meaning the REA setup was 3.5 times more expensive. Hence a practical strategy confirmed by the test: REA handles the precise functional structure, while visual fidelity is better achieved with screenshots.

What is still unknown / limitations

The confirmed base remains narrow: the entire quantitative argument is a single comparison on one iOS screen, without testing for robustness to prompt variations or repeated runs, so the assessment of "qualitatively better" is currently inseparable from this single case. The declared breadth of modes, including native binaries, .NET, Android APKs, and firmware, has been practically verified only on websites and one iOS app according to available materials, and the gap between declarations and verification remains the main open question. For production integration, data on latency and run stability is lacking, and price and speed after the v6.5.0 release may change rapidly from version to version. Finally, expectations that the agent layer over disassemblers will become a standard in engineering pipelines in the coming years are interpretations with high uncertainty, not established facts.

Sources

Author

Look at AI, editorial team