Description
You spot a feature in someone else's app and want to know exactly how it works. There's no source, so it's you, Ghidra and a wall of assembly — or, for an Electron app, unpacking the asar and digging through minified JavaScript until you finally find the entry point hours later.
REA hands that job to your AI agent. It's an MCP server: once installed, you tell Claude Code, Codex or Cursor something like "figure out how search works in Notes, show me the evidence, then build something similar in my project". The agent drives the disassembler, follows the call chain, reads the pseudocode and comes back with findings and their sources — and can go on to implement the feature for you.
What sets it apart from asking a model to guess is that every conclusion comes with evidence: the function, the instructions, the IPC channel, plus an honest list of what's still unknown. Everything runs locally, so your targets never leave your machine.
One-command agent setup: run npx rea-agents setup, pick your agents, and it registers the MCP server and installs matching workflow instructions, backing up your existing config first.
Native binaries: pseudocode, assembly, strings, symbols and cross-references through Hopper, Ghidra or IDA — down to 16-bit DOS programs.
Electron and JavaScript apps: no disassembler needed. Point it at an extracted folder or asar and it maps out modules, imports, source maps, routes, IPC channels and native add-ons.
.NET and Android: static reading of .NET assembly metadata and CIL instructions; APK manifests, classes and decompiled methods via JADX.
Websites and captures: inspect page structure, scripts and network traffic in a Chrome-family browser, or analyze a saved HAR file.
Off-the-beaten-path targets: firmware region extraction, EVM bytecode selectors, and per-thread registers from recorded Linux crashes — handy for CTFs.
Works from the terminal too: every capability is also a rea command, with --json output for scripting.
REA hands that job to your AI agent. It's an MCP server: once installed, you tell Claude Code, Codex or Cursor something like "figure out how search works in Notes, show me the evidence, then build something similar in my project". The agent drives the disassembler, follows the call chain, reads the pseudocode and comes back with findings and their sources — and can go on to implement the feature for you.
What sets it apart from asking a model to guess is that every conclusion comes with evidence: the function, the instructions, the IPC channel, plus an honest list of what's still unknown. Everything runs locally, so your targets never leave your machine.
Features
One-command agent setup: run npx rea-agents setup, pick your agents, and it registers the MCP server and installs matching workflow instructions, backing up your existing config first.
Native binaries: pseudocode, assembly, strings, symbols and cross-references through Hopper, Ghidra or IDA — down to 16-bit DOS programs.
Electron and JavaScript apps: no disassembler needed. Point it at an extracted folder or asar and it maps out modules, imports, source maps, routes, IPC channels and native add-ons.
.NET and Android: static reading of .NET assembly metadata and CIL instructions; APK manifests, classes and decompiled methods via JADX.
Websites and captures: inspect page structure, scripts and network traffic in a Chrome-family browser, or analyze a saved HAR file.
Off-the-beaten-path targets: firmware region extraction, EVM bytecode selectors, and per-thread registers from recorded Linux crashes — handy for CTFs.
Works from the terminal too: every capability is also a rea command, with --json output for scripting.
