A third-party, plain-English walkthrough of REA (morluto/rea) — what it actually is, how it fits into your agent workflow, and what it deliberately does not do. Written for developers who just saw the star count and want a sober starting point.
Note on links: this article links to reaguide.online, a small independent learning hub (Phase 1 is live). It is third-party, non-affiliated educational material.
What is REA, in one paragraph?
REA is an open-source (MIT) MCP server + CLI, written in TypeScript, that sits between your AI coding agent and the binary-analysis tools you already have. It does not decompile anything itself — you bring your own Hopper, Ghidra, IDA, JADX, Binwalk, or one of ~26 other supported providers — and REA orchestrates them, feeding structured results back to agents like Claude Code, Codex, Cursor, or Gemini CLI (14 agent integrations at the time of writing).
The useful mental model: REA is an orchestration layer over decompilers, not a decompiler. If your agent is the intern, REA is the desk that hands the intern properly labeled folders instead of raw hex dumps.
Why the "evidence contract" is the interesting part
Most agent-tooling demos stop at "look, it runs a command." REA's core design choice is that every tool result comes back with three fields:
-
result— the actual output -
evidence_id— a pointer to where the claim came from -
limitations— what the tool could not determine
And it's fail-closed: if evidence can't be produced, the result is marked incomplete rather than silently guessed. For anyone who has watched an LLM hallucinate a plausible-sounding function name from a mangled decompilation, this is the difference between "fun demo" and "tool you can put in a review workflow." Your agent is forced to cite its work.
What REA is good for (lawful use cases)
Staying squarely inside what you're allowed to analyze — software you own, open-source binaries, the project's published demo targets, legacy apps you maintain, or anything you otherwise have the right to inspect:
- Onboarding archaeology: you inherited a service with no docs and half the source. Point an agent at the binary you deploy and ask "map the module boundaries."
- Dependency due diligence: understand what a vendor-shipped binary actually links against and exports before you sign the contract.
- Malware analysis / CTF education: structured triage with an evidence trail, in your isolated lab.
- Legacy interop: recovering interface definitions from your own old builds so you can rewrite them.
What it's not: a "point at any app on your phone" magic wand. The project's own SECURITY.md is explicit — "This is not a sandbox" — the operator is responsible for authorization. Treat that as the license terms of common sense, not fine print.
The 5-minute setup sketch
# prerequisites: an MCP-capable agent (Claude Code, Cursor, Codex, …)
# and at least one analysis engine you're licensed to use
npm install -g rea-agents # v5.x, ~139 MCP tools / 94 CLI commands
# register with your agent's MCP config (example: Claude Code)
claude mcp add rea -- rea mcp
# sanity check from the CLI
rea doctor
Then, in your agent, the interaction is just natural language: "list the exports of ./build/liblegacy.so and summarize the entry points with evidence." The agent calls REA tools; REA calls your decompiler; you get a cited answer instead of a 4,000-line raw dump pasted into chat.
Where it sits vs. the alternatives
| Layer | Tool | REA's relationship to it |
|---|---|---|
| Disassembler/decompiler | Ghidra, IDA, Hopper, Binary Ninja | REA drives them; you supply the license |
| Agent protocol | MCP | REA is an MCP server — the agent-native part |
| Orchestration/evidence | REA | the actual product |
| Raw scripting | pwntools, binwalk scripts | also wrapped as REA providers |
In other words, REA isn't competing with Ghidra the way a new GUI would. It's competing with the copy-paste-into-ChatGPT workflow you were doing last month.
Honest caveats (the part most launch-week posts skip)
- Velocity risk. The repo went from ~40 stars to 128K+ in six days (Oct 4–12, 2026). Projects that grow that fast churn APIs. Pin your version; expect breaking changes.
- The author is a pseudonym (morluto) with a fleet of small "for agents" repos. Not disqualifying — MIT code you can read — but worth knowing before you pipe production binaries through it.
- Privacy is local-then-leaky. Analysis happens locally, but results flow through your agent to your model provider. If the binary is confidential, that's a data-governance question, not a tooling detail.
- It's still early on the learning curve. Developer-published docs are thin; most third-party material is launch-week hype or ethics threads. Structured beginner content is the current gap — which is exactly why articles like this one exist.
A note on responsible framing
"AI reverse engineering" content tends to attract two bad framings: breathless "reverse engineer anything" hype, and assume-criminalistic tutorials. Both miss the actual audience: professional developers who need to understand binaries they're legitimately responsible for, and who want their AI assistant to stop hallucinating. REA's evidence-contract design is interesting because it's built for that serious use case — fail-closed, cited, limitations declared. That's the framing worth amplifying.
What's next
This article is the first piece of a small independent effort to build structured, beginner-friendly learning material around AI-assisted binary analysis — setup guides, tool comparisons (REA vs. plain Ghidra workflows), and legality explainers.
- ✅ REA setup guide (step-by-step, with real terminal sessions) → realearn setup guide
- ✅ REA vs. Ghidra-MCP workflows → REA vs. Ghidra-MCP
- ✅ "Is AI-assisted reverse engineering legal?" a plain-English explainer → Is Reverse Engineering Legal?
Anchor URLs above point to the live companion site, reaguide.online.
Written by an independent contributor. Not affiliated with the REA project or morluto. Facts above (star counts, npm numbers, provider counts) reflect checks on 2026-10-12 and will age — verify against the repo before quoting. Use every tool discussed only on software you have the right to analyze.
Tags: ai, reverseengineering, mcp, aiagents, tutorial
Top comments (0)