REA review

Q: How do I install REA?

Run npx rea-agents setup. It needs Node.js ^22.19.0 || ^24.11.0 || >=26.0.0. The install section above has the other options from the project's README.

REA is an MCP server and CLI that lets coding agents reverse engineer native binaries, JavaScript and Electron apps, .NET assemblies, and websites.

Updated Nov 1, 2026. Review written Oct 22, 2026 from the project's own sources; usage data refreshed every Monday.

TL;DR

REA is an MCP server and CLI that connects coding agents to reverse-engineering tools. It suits developers who want to understand how an app feature works without its source code. Analysis runs locally, and results include the evidence and limitations behind each conclusion.

415.5kGitHub stars
+36.9knew stars, week of Oct 25
~760.6kdownloads a week, +257% vs 4-week avg
#1in MCP and agent tools this week

REA at a glance

Category: MCP and agent tools
Maintained by: morluto (individual, @morluto on GitHub)
License: MIT
Language: TypeScript, JavaScript, Python
Repository: github.com/morluto/rea
Website: rea.tools
npm package: rea-agents 6.7.0
Latest release: rea-agents-6.7.0 on GitHub, Oct 18, 2026
First published: Apr 14, 2026

What REA does

REA inspects native binaries through Hopper, Ghidra or IDA and returns pseudocode, assembly, strings, symbols, calls and references.
REA analyzes JavaScript and Electron apps statically, returning modules, imports, source maps, routes, IPC and native add-on relationships.
REA reads .NET assemblies statically, returning metadata, CIL instructions, declared native dependencies and build comparisons.
REA observes websites in a Chrome-family browser, capturing page structure, scripts, network observations and requested screenshots.
REA inspects Android APKs with JADX and Android devices through adb, including logs, screen captures and file transfers.
REA decodes formats such as Go and Rust binaries, WASM, GGUF and safetensors model files, SQLite databases and PyInstaller executables.
REA returns findings with their evidence, so the agent can explain behavior or write and test an implementation.

How it works

Setup registers REA's MCP server with your agent and installs matching workflow instructions, backing up existing configuration. The agent then calls REA through MCP to inspect a target and trace relevant code. The same workflows are available as CLI commands. Native analysis uses an existing Hopper, Ghidra or IDA installation, while static JavaScript analysis needs no native engine.

How to install and start using REA

Set up your agent with npx

npx rea-agents setup

Install the CLI globally with npm

npm install --global rea-agents

Set up with the latest release

npx rea-agents@latest setup

Requirements

Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, plus npm.
Hopper, Ghidra or IDA for native binary analysis.
On Linux, a procps-compatible ps on PATH for Ghidra, JADX, firmware tools and static JavaScript/Electron analysis.
A Chrome-family browser for website analysis.

First steps

Run the setup command, choose your agents, review the proposed changes, and approve them.
Restart your agent after setup so it loads the REA MCP server.
Ask your agent to explain how a feature works in a target app, show the evidence, and build a similar feature.
For native analysis, configure a provider such as Hopper, Ghidra or IDA first.

Who REA is for

Developers who want to understand how a feature in another app works and build a version for their own project.
Users of Claude Code, Codex, Cursor, Gemini CLI or Grok Build who want reverse-engineering tools inside their agent.
Analysts inspecting Electron apps, Android APKs, .NET assemblies or native binaries without source code.

Limitations to know

REA releases can include breaking changes; version 6.2 states it is not a backward-compatibility promise.
Several targets require caller-supplied tools such as pwntools, WABT, adb, Apktool, TShark or JEB, which REA does not install.
Some analyses are Linux-only or Linux x64-only, including offline ELF layout, EVM bytecode, firmware and recorded packets.
Runtime capture runs or interacts with the selected target using your user permissions.

Is REA growing? Usage data

In the week of Oct 25–31, 2026, REA ranked #7 on the Devtoolwatch Board and #1 in MCP and agent tools, with a momentum score of 96 out of 100. Its main package had about 760.6k downloads that week, +257% against its own 4-week average.

New GitHub stars per week for the last 12 weeks, from GitHub's stargazer history (today's stargazers by the week they starred).

Show the weekly numbers

New GitHub stars per week for REA
Week of	New stars
Aug 9, 2026	165
Aug 16, 2026	34
Aug 23, 2026	17
Aug 30, 2026	8
Sep 6, 2026	5
Sep 13, 2026	8
Sep 20, 2026	6
Sep 27, 2026	144
Oct 4, 2026	77.9k
Oct 11, 2026	231.6k
Oct 18, 2026	69.2k
Oct 25, 2026	36.9k

On Hacker News

REA Reverse – Engineer Anything, 814 points and 339 comments (Oct 10, 2026)
Reverse engineer anything with agents, from app behavior down to native binaries, 100 points and 38 comments (Oct 12, 2026)

The Board ranks tools by four signals each week: new stars, new stars for the repo's size, added downloads and download growth beyond the market. How the ranking works.

REA alternatives

Other MCP servers and agent tools on the Board in the week of Oct 25–31, 2026, by momentum:

MCP and agent tools ranked by momentum, the week of Oct 25–31, 2026
Rank	Tool	Stars	Downloads/wk
#2	ha-mcpha-mcp is an unofficial Model Context Protocol server that lets AI assistants control and manage Home Assistant using natural language.	5.4k	118.1k
#3	TregTreg is a registry and proxy that gives AI agents one token for a catalog of paid third-party API endpoints and team-shared tools.	6.9k	6.7k
#4	Chrome DevTools MCPChrome DevTools MCP is an MCP server and CLI that lets coding agents control and inspect a live Chrome browser using Chrome DevTools.	54.6k	2.7M
#5	codebase-memory-mcpHigh-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 162…	47.9k	–
#6	open-computer-use👾 Open Computer Use – Open-Source Alternative to Codex Computer Use	2.8k	–
#7	Unity MCPUnity MCP is an open-source bridge that lets AI assistants control the Unity Editor through the Model Context Protocol.	15.6k	–

All MCP servers and agent tools, ranked

Recent REA releases

rea-agents-6.7.0, Oct 18, 2026
rea-agents-6.6.0, Oct 18, 2026
rea-agents-6.5.0, Oct 14, 2026
rea-agents-6.4.0, Oct 11, 2026
rea-agents-6.3.0, Oct 9, 2026

REA FAQ

Is REA free and open source?

Yes. REA's source code is on GitHub (morluto/rea) under the MIT license, so you can use it for free.

How do I install REA?

Run npx rea-agents setup. It needs Node.js ^22.19.0 || ^24.11.0 || >=26.0.0. The install section above has the other options from the project's README.

Is REA still maintained?

Yes. The morluto/rea repository was last updated on Oct 21, 2026, and the latest release, rea-agents-6.7.0 on GitHub, came out on Oct 18, 2026.

How popular is REA?

REA has 415.5k GitHub stars as of Nov 1, 2026. It gained 36.9k new stars in the week of Oct 25–31, 2026, against a 12-week average of 34.7k a week. Its main package had about 760.6k downloads that week, +257% against its own 4-week average. That made it #1 among MCP servers and agent tools on the Devtoolwatch Board.

What are the best alternatives to REA?

Other MCP servers and agent tools on the Devtoolwatch Board in the week of Oct 25–31, 2026, by momentum: ha-mcp (#2), Treg (#3), Chrome DevTools MCP (#4), codebase-memory-mcp (#5), open-computer-use (#6). The alternatives table above has their numbers.

Which coding agents does REA support?

REA setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents listed in its installation guide. Setup adds the MCP server and workflow instructions to the agents you choose.

Does REA run analysis locally?

Yes. REA runs analysis locally, and results include the evidence and limitations behind each conclusion.

Does REA need Ghidra or IDA?

REA needs Hopper, Ghidra or IDA only for native binary analysis. Static JavaScript analysis needs no native analysis engine, and setup can optionally install Hopper with your approval.

Can REA be used without an AI agent?

Yes. REA exposes the same workflows as CLI commands, such as analyze-javascript-application, which you can run from a terminal with npx or a global install.

Does REA execute the apps it inspects?

REA's static JavaScript and .NET inspection reads the supplied files without running the application. Runtime capture does run or interact with the target using your user permissions.

How do I keep REA up to date?

For a global install, REA provides rea update. With npx, run the setup command again using rea-agents@latest, review the changes, and restart your agent.

Sources

REA README badge

Maintainers can show the tool's weekly Board rank in their README:

[![Devtoolwatch](https://index.devtoolwatch.com/badge/morluto-rea.svg)](https://index.devtoolwatch.com/tools/morluto-rea/)

How this page is made: Devtoolwatch writes each review from the project's README, releases, package metadata and website, with an AI model, then checks every claim against the source it cites and drops what the sources don't support. The numbers come from Devtoolwatch's daily GitHub snapshots, GitHub's stargazer history, and the npm and PyPI download APIs. Spotted an error? Email [email protected].