Skip to content
Get packs

Guide · Open source

How to use REA: set up an MCP agent to reverse engineer apps

Updated · written with AI from the project's own documentation and checked against our catalogue data

REA (rea-agents) is an MCP server that connects an AI agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies and websites. This guide shows you how to set it up with your agent, how to run its analysis from the terminal, and what to check before you start. After reading it you will be able to install REA, ask an agent a question about an app's behavior, and analyze an extracted Electron app directory or ASAR file.

REAmorluto/rea · ★ 421k · MIT

Quick start

  1. 1Check prerequisites. Confirm you have Node.js 22.x (22.23.4+), 24.x (24.22.1+) or 26.12.1+, and npm. On Linux, confirm a procps-compatible ps is on your PATH.
  2. 2Run setup. From a trusted directory outside your target project, run npx rea-agents setup and approve the proposed changes.
  3. 3Restart your agent. Restart the agent so it loads REA's MCP server and workflow instructions.
  4. 4Ask a question. Describe the app and the feature you want to understand, and ask the agent to show the evidence.
  5. 5Run a terminal analysis. Point analyze-javascript-application at an absolute path to an extracted app directory or ASAR and add --json for structured output.
  6. 6Install the CLI. Optionally run npm install --global rea-agents, then check rea --help.

Check the requirements before you install

REA requires Node.js 22.x (version 22.23.4 or newer), 24.x (version 24.22.1 or newer), or 26.12.1 or newer, plus npm. Install these first, because setup runs through npx.

  • On Linux, Ghidra, JADX, firmware tool launches and static JavaScript/Electron analysis need a procps-compatible ps command on REA's PATH.
  • Native analysis needs an existing Hopper, Ghidra, IDA or Kuna installation. Static JavaScript analysis does not need a native engine.

Set up REA with your agent

Run setup from a trusted directory outside the project you want to analyze. Setup lists the agents it supports, shows the proposed changes and asks you to approve them. It adds REA's MCP server and matching workflow instructions, and it keeps backups of existing configuration.

After setup finishes, restart your agent. REA works with Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents listed in the installation guide.

  • If you acquired REA through a package runner, keep its cache entry available, because setup records the runtime and REA entry script directly.
  • For provider configuration, manual MCP registration or the Claude Code and Codex plugin, see docs/installation.md.
npx rea-agents setup

Ask your agent to investigate a feature

Once REA is registered, describe the feature you want to understand and the app it lives in. REA returns the code it found along with the evidence and limitations behind each conclusion, so you can check the reasoning rather than trust a single answer.

Replace the example app and feature with your own target.

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

Analyze an Electron app or ASAR from the terminal

You can run REA's tools without an agent. The JavaScript analysis command inspects an extracted JavaScript or Electron app directory, or an ASAR file. Use an absolute path to the target. The result lists modules, imports, Electron boundaries and the evidence for each.

On Windows, the path looks like "D:/apps/example" and can be substituted into the same command.

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Install the rea command globally

If you use REA often, install the rea command globally so you do not need to type npx each time. Run rea --help to see the available commands. For native commands, provider selection, snapshots and scripting, read the CLI and Evidence guide in docs/cli.md.

npm install --global rea-agents rea --help

Keep REA up to date

REA changes quickly and new releases include frequent bug fixes. If you installed the CLI globally with npm or Bun, run the update command. If you use npx, rerun setup with the latest tag and review the changes. Bun global updates require Bun 1.2.17 or later.

  • Updater commands keep at most 4 MiB of combined stdout and stderr.
  • After an update, restart your agent so it loads the refreshed registration.
rea update

What people use it for

  • Finding out how a feature in an existing desktop app works without access to its source code.
  • Inspecting an Electron app's modules, imports and Electron boundaries from an extracted directory or ASAR file.
  • Letting an agent trace relevant code in a JavaScript app and then write and test a similar feature in your own project.
  • Security research on binaries and Electron or JavaScript apps, with results that list their evidence and limitations.

Frequently asked questions

Is REA free and open source?

Yes. REA is released under the MIT licence, and its source is on GitHub at morluto/rea. The README says analysis runs locally on your machine.

What do I need to install REA?

You need Node.js 22.x (22.23.4 or newer), 24.x (24.22.1 or newer), or 26.12.1 or newer, plus npm. Setup is run with npx rea-agents setup.

How do I use REA with Claude Code or Cursor?

Run npx rea-agents setup from a trusted directory outside your project, choose your agent, approve the changes and restart the agent. Setup supports Claude Code, Codex, Cursor and Gemini CLI, among others.

Can REA analyze a native binary without extra software?

No. The README says native analysis needs an existing Hopper, Ghidra, IDA or Kuna installation. Setup can optionally install Hopper with your approval.

Why does REA fail on Linux when analyzing JavaScript or Ghidra?

On Linux, Ghidra, JADX, firmware launches and static JavaScript/Electron analysis require a procps-compatible ps command on REA's PATH. The installation guide has the recovery steps under Linux owned-process prerequisite.

What are the alternatives to REA?

The project lists Ghidra, radare2, Binary Ninja and Frida as comparable projects. REA differs in that it is an MCP server for AI agents, while those are primarily analysis tools you operate yourself.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

REA suits developers and security researchers who already use an MCP-compatible agent and want help studying how an app's feature works, especially Electron and JavaScript apps. Pick something else if you need native binary analysis without installing an external engine, a downloadable packaged binary, or a plain-language introduction to reverse engineering.

Install options & downloads