REA lets AI agents reverse engineer apps. Here's both sides of it

REA (Reverse Engineer Anything) went from a new repo in April to one of the most starred projects on GitHub this month, with close to 380K stars. It's MIT licensed and it runs on your own machine.

The idea is simple. You already have an AI coding agent like Claude Code, Codex, Cursor or Gemini CLI. REA gives that agent access to real reverse engineering tools such as Ghidra, IDA and Hopper, so it can open software you don't have the source for and tell you how it works, with evidence for each finding.

What it can open#

The list in the README is long. The parts most developers will care about are

• compiled binaries, where it gives pseudocode, strings, symbols and call graphs
• JavaScript and Electron apps, plus .NET assemblies (these need no native engine at all)
• Android APKs and Flutter apps
• websites and saved network captures (HAR files)

One showcase on InfoQ traced how Notion's desktop app handles copy and paste. Another rebuilt a sound function from the old game DX-Ball and matched all 3,205 original test cases.

Where it helps backend engineers#

This is the side I find interesting. A lot of backend pain comes from code you can't read.

• A vendor SDK or closed-source binary misbehaves in production and support takes a week to reply.
• You need to know what a third-party desktop app really sends over the network before you allow it on the company laptop.
• You inherit a legacy service and the source code is gone or doesn't match what's deployed.
• You ship dependencies you never wrote and want to check what they actually do.

All of these used to mean finding someone who knows Ghidra well. Now an agent can do the first pass and you check its work.

Why people are worried#

The other side is real too. Indie developers on Reddit are worried that copying a paid app, or getting around its licence check, just got a lot easier. Some people on Hacker News also asked what REA adds beyond telling an agent to install Ghidra and use it directly. Others said their results were better with REA.

And there's a limit people forget. REA doesn't recover the original source code. It gives you the agent's best reading of a binary, which can be wrong. Treat it like a junior engineer's notes, useful but worth checking.

The README is clear about the line. Use it for lawful research, learning, interoperability and software you own or are allowed to examine. Cracked tools and licence bypasses are not allowed.

Trying it safely#

Setup is one command.

npx rea-agents setup

Three things before you run it.

1. Install only from the official repo morluto/rea, the rea-agents npm package or rea.tools. Copies with similar names and a pasted README are already around, so check the owner.
2. It needs Node 22.23.4+, 24.22.1+ or 26.12.1+. Those happen to be the same versions that fix the HTTP2Shell Brotli bug, so if you're on an older Node this is a good reason to upgrade anyway.
3. Some features run the target app with your user permissions. Do that on a throwaway VM or container, not your main machine.

My take#

As a debugging aid for code you're allowed to look at, this is useful and I expect agents to ship with something like it built in. As a way to clone someone's paid app, it's the same old piracy problem with a faster tool. Where you draw that line is the interesting question, and I'd like to hear where you'd draw it.

Sources. REA on GitHub, InfoQ write-up.