I recently came across REA, short for Reverse Engineer Anything. It connects a coding agent to tools for inspecting a finished app, so you can ask how a particular feature works.
REA is an open-source MCP server under the MIT license. It connects Claude Code, Codex, Cursor, Gemini CLI and other agents to reverse-engineering tools. You point the agent at an app, ask about one feature, and it traces the code behind it.
I haven't run it myself yet. Everything below comes from the project's documentation, plus how I plan to check it.
The documented targets include:
| Target | What comes back |
|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls and references (Hopper, Ghidra or IDA for deep analysis) |
| JavaScript and Electron apps | Modules, imports, source maps, routes and IPC |
| .NET assemblies | Metadata and CIL instructions, static analysis only |
| Android APKs | Manifest, classes and decompiled methods (needs JADX and a JDK) |
| Websites | Page structure, scripts and network observations |
With Node.js and npm installed, run:
npx rea-agents setup
Review and approve the proposed configuration changes, then restart your agent. Setup registers the MCP server and installs matching workflow instructions. Static JavaScript and .NET analysis work without a native engine. The FAQ says analysis runs locally, although your agent still sends the tool results to its model provider.
REA returns each finding together with the evidence and the limitations behind it. One showcase follows Notion's clipboard API from the renderer, through preload and IPC, into the main process.
In another, REA supplies the instructions and data reads behind a sound-pan function in the old game DX-Ball, and a reconstruction project rewrites it in C. That version passes 3,205 test cases against the original x86 code and reproduces all 63 compiled bytes of the function.
That's the level of detail I want from an engineering agent. You can follow the path behind a feature and ask where each conclusion came from.
The example prompt in the README asks the agent to understand how search works in the Notes app, show the evidence, and build a similar feature for your project. That gives the agent a way to use what it finds when writing an implementation. I'd still test that implementation against the behavior I wanted to reproduce.
The README is explicit that REA is for lawful research, interoperability, software preservation, and software you own or are authorized to examine. Commercial tools such as IDA, Hopper and JEB need your own valid licenses.
Install it only from the official sources (the GitHub repo, rea.tools or the rea-agents npm package), because the project warns about look-alike repositories.
I'd start with one narrow question on an Electron app I'm authorized to inspect: which code path produces this behavior? Then I'd check whether another engineer can reproduce the finding from REA's evidence alone, and whether the app behaves the way the explanation predicts when I change the input.