# REA review

> REA is an MCP server and CLI that lets coding agents reverse engineer native binaries, JavaScript and Electron apps, .NET assemblies, and websites.

Devtoolwatch Board, the week of Oct 25–31, 2026. Canonical page: https://index.devtoolwatch.com/tools/morluto-rea/

## TL;DR

REA is an MCP server and CLI that connects coding agents to reverse-engineering tools. It suits developers who want to understand how an app feature works without its source code. Analysis runs locally, and results include the evidence and limitations behind each conclusion.

## REA at a glance

- **Category:** [MCP and agent tools](https://index.devtoolwatch.com/categories/mcp-servers/)
- **Maintained by:** morluto (individual, [@morluto](https://github.com/morluto) on GitHub)
- **License:** MIT
- **Language:** TypeScript, JavaScript, Python
- **Repository:** [github.com/morluto/rea](https://github.com/morluto/rea)
- **Website:** [rea.tools](https://rea.tools)
- **npm package:** [rea-agents](https://www.npmjs.com/package/rea-agents) 6.7.0
- **Latest release:** [rea-agents-6.7.0](https://github.com/morluto/rea/releases/tag/rea-agents-6.7.0) on GitHub, Oct 18, 2026
- **First published:** Apr 14, 2026

## What REA does

- REA inspects native binaries through Hopper, Ghidra or IDA and returns pseudocode, assembly, strings, symbols, calls and references.
- REA analyzes JavaScript and Electron apps statically, returning modules, imports, source maps, routes, IPC and native add-on relationships.
- REA reads .NET assemblies statically, returning metadata, CIL instructions, declared native dependencies and build comparisons.
- REA observes websites in a Chrome-family browser, capturing page structure, scripts, network observations and requested screenshots.
- REA inspects Android APKs with JADX and Android devices through adb, including logs, screen captures and file transfers.
- REA decodes formats such as Go and Rust binaries, WASM, GGUF and safetensors model files, SQLite databases and PyInstaller executables.
- REA returns findings with their evidence, so the agent can explain behavior or write and test an implementation.

### How it works

Setup registers REA's MCP server with your agent and installs matching workflow instructions, backing up existing configuration. The agent then calls REA through MCP to inspect a target and trace relevant code. The same workflows are available as CLI commands. Native analysis uses an existing Hopper, Ghidra or IDA installation, while static JavaScript analysis needs no native engine.

## How to install REA

**Set up your agent with npx**

```
npx rea-agents setup
```

**Install the CLI globally with npm**

```
npm install --global rea-agents
```

**Set up with the latest release**

```
npx rea-agents@latest setup
```

### Requirements

- Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, plus npm.
- Hopper, Ghidra or IDA for native binary analysis.
- On Linux, a procps-compatible ps on PATH for Ghidra, JADX, firmware tools and static JavaScript/Electron analysis.
- A Chrome-family browser for website analysis.

### First steps

1. Run the setup command, choose your agents, review the proposed changes, and approve them.
2. Restart your agent after setup so it loads the REA MCP server.
3. Ask your agent to explain how a feature works in a target app, show the evidence, and build a similar feature.
4. For native analysis, configure a provider such as Hopper, Ghidra or IDA first.

## Who REA is for

- Developers who want to understand how a feature in another app works and build a version for their own project.
- Users of Claude Code, Codex, Cursor, Gemini CLI or Grok Build who want reverse-engineering tools inside their agent.
- Analysts inspecting Electron apps, Android APKs, .NET assemblies or native binaries without source code.

### Limitations

- REA releases can include breaking changes; version 6.2 states it is not a backward-compatibility promise.
- Several targets require caller-supplied tools such as pwntools, WABT, adb, Apktool, TShark or JEB, which REA does not install.
- Some analyses are Linux-only or Linux x64-only, including offline ELF layout, EVM bytecode, firmware and recorded packets.
- Runtime capture runs or interacts with the selected target using your user permissions.

## Usage data (the week of Oct 25–31, 2026)

- Board rank: #7 overall, #1 in MCP and agent tools, momentum score 96
- Downloads that week: 760.6k (+257% vs 4-week average)
- New GitHub stars per week (last 12 weeks): Aug 9: 165; Aug 16: 34; Aug 23: 17; Aug 30: 8; Sep 6: 5; Sep 13: 8; Sep 20: 6; Sep 27: 144; Oct 4: 77.9k; Oct 11: 231.6k; Oct 18: 69.2k; Oct 25: 36.9k

## REA alternatives

| Rank | Tool | Stars | Downloads/wk |
|---|---|---|---|
| #2 | [ha-mcp](https://index.devtoolwatch.com/tools/homeassistant-ai-ha-mcp/) | 5.4k | 118.1k |
| #3 | [Treg](https://index.devtoolwatch.com/tools/superdesigndev-treg/) | 6.9k | 6.7k |
| #4 | [Chrome DevTools MCP](https://index.devtoolwatch.com/tools/chrome-devtools-mcp/) | 54.6k | 2.7M |
| #5 | [codebase-memory-mcp](https://index.devtoolwatch.com/tools/deusdata-codebase-memory-mcp/) | 47.9k | – |
| #6 | [open-computer-use](https://index.devtoolwatch.com/tools/ifuryst-open-computer-use/) | 2.8k | – |
| #7 | [Unity MCP](https://index.devtoolwatch.com/tools/unity-mcp/) | 15.6k | – |

## REA FAQ

### Is REA free and open source?

Yes. REA's source code is on GitHub (morluto/rea) under the MIT license, so you can use it for free.

### How do I install REA?

Run `npx rea-agents setup`. It needs Node.js ^22.19.0 || ^24.11.0 || >=26.0.0. The install section above has the other options from the project's README.

### Is REA still maintained?

Yes. The morluto/rea repository was last updated on Oct 21, 2026, and the latest release, rea-agents-6.7.0 on GitHub, came out on Oct 18, 2026.

### How popular is REA?

REA has 415.5k GitHub stars as of Nov 1, 2026. It gained 36.9k new stars in the week of Oct 25–31, 2026, against a 12-week average of 34.7k a week. Its main package had about 760.6k downloads that week, +257% against its own 4-week average. That made it #1 among MCP servers and agent tools on the Devtoolwatch Board.

### What are the best alternatives to REA?

Other MCP servers and agent tools on the Devtoolwatch Board in the week of Oct 25–31, 2026, by momentum: ha-mcp (#2), Treg (#3), Chrome DevTools MCP (#4), codebase-memory-mcp (#5), open-computer-use (#6). The alternatives table above has their numbers.

### Which coding agents does REA support?

REA setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents listed in its installation guide. Setup adds the MCP server and workflow instructions to the agents you choose.

### Does REA run analysis locally?

Yes. REA runs analysis locally, and results include the evidence and limitations behind each conclusion.

### Does REA need Ghidra or IDA?

REA needs Hopper, Ghidra or IDA only for native binary analysis. Static JavaScript analysis needs no native analysis engine, and setup can optionally install Hopper with your approval.

### Can REA be used without an AI agent?

Yes. REA exposes the same workflows as CLI commands, such as analyze-javascript-application, which you can run from a terminal with npx or a global install.

### Does REA execute the apps it inspects?

REA's static JavaScript and .NET inspection reads the supplied files without running the application. Runtime capture does run or interact with the target using your user permissions.

### How do I keep REA up to date?

For a global install, REA provides rea update. With npx, run the setup command again using rea-agents@latest, review the changes, and restart your agent.

## Sources

1. [morluto/rea on GitHub](https://github.com/morluto/rea)
2. [REA README](https://github.com/morluto/rea/blob/main/README.md)
3. [rea-agents on npm](https://www.npmjs.com/package/rea-agents)
4. [REA website](https://rea.tools)
5. [Release rea-agents-6.7.0 (Oct 18, 2026)](https://github.com/morluto/rea/releases/tag/rea-agents-6.7.0)
6. [Release rea-agents-6.6.0 (Oct 18, 2026)](https://github.com/morluto/rea/releases/tag/rea-agents-6.6.0)
7. [Release rea-agents-6.5.0 (Oct 14, 2026)](https://github.com/morluto/rea/releases/tag/rea-agents-6.5.0)
8. [Hacker News: REA Reverse – Engineer Anything](https://news.ycombinator.com/item?id=50028275)
9. [Hacker News: Reverse engineer anything with agents, from app behavior down to native binaries](https://news.ycombinator.com/item?id=50058850)
10. [Devtoolwatch Board, the week of Oct 25–31, 2026](https://index.devtoolwatch.com/)