How to reverse engineer an app feature with your coding agent using REA (MCP)

You see a feature in someone else's app and want to know how it works. No source code, no docs. REA (Reverse Engineer Anything) gives your coding agent an MCP server full of reverse engineering tools so it can inspect the app, explain the feature with evidence, and build a version for your project. It has passed 300,000 GitHub stars, which makes it one of the most starred agent tools of the year.

What it can read: native binaries (through Hopper, Ghidra or IDA), JavaScript and Electron apps, .NET assemblies, websites, Go and Rust binaries, GGUF and safetensors model headers, Godot PCK archives, and Unity IL2CPP global-metadata.dat files. Analysis runs locally, and every result comes with the evidence and limitations behind each conclusion.

This guide sets it up with Claude Code, Codex or Cursor and walks through three practical jobs.

Requirements

• Node.js 22.x (22.23.4+), 24.x (24.22.1+) or 26.12.1+, plus npm
• An agent that supports local MCP servers: Claude Code, Codex, Cursor, Gemini CLI and others
• For deep native analysis only: Hopper, Ghidra or IDA. Static JavaScript, Electron, .NET and IL2CPP metadata inspection need none of them.
• On Linux: a procps compatible ps on the PATH (Ghidra, JADX and static JavaScript analysis use it)

Get it only from the official sources: the morluto/rea repo, rea.tools, or the rea-agents npm package. The README itself warns that look-alike repos exist.

Set up your agent

npx rea-agents setup

Pick your agents, review the proposed changes and approve. Setup registers the REA MCP server and installs matching workflow instructions, backing up your existing config first. Restart your agent afterwards.

For regular terminal use, install the CLI too:

npm install --global rea-agents
rea --help

REA ships fixes often. Keep it current with rea update, or rerun npx rea-agents@latest setup if you installed through npx.

Job 1: understand a feature and rebuild it

This is the headline workflow. Ask your agent:

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

Swap in your target app and feature. The agent calls REA over MCP to inspect the target, trace the relevant code and collect evidence, then explains the behavior and writes and tests an implementation in your repo. Native targets return pseudocode, assembly, strings, symbols and call references; JavaScript targets return modules and how they connect.

Job 2: map an Electron app from the terminal

Point the CLI at an extracted Electron app directory or an .asar file:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

The JSON lists modules, imports and Electron boundaries (main versus renderer, preload bridges) with evidence for each. It is a quick way to see how a desktop app is wired before you dig into a specific feature. On Windows use a path like "D:/apps/example".

Job 3: read Unity IL2CPP metadata without Unity

Unity games built with IL2CPP ship a global-metadata.dat file that holds assembly images, type and method names and index ranges. REA decodes metadata versions 24, 27, 29, 31 and 39 statically, with no Unity install. Ask your agent:

Use REA to decode the IL2CPP global-metadata.dat in /absolute/path/to/Game_Data/il2cpp_data/Metadata, list the assembly images, and find the types and methods related to save games. Show the evidence for each finding.

This is useful for modders and for anyone checking what a build actually contains, as long as you are allowed to examine it (see the caveats).

Tips

• MCP uses compact input schemas by default to save context. Set REA_MCP_INPUT_SCHEMA_PROFILE=full in your MCP registration if your agent needs the full field guidance.
• On macOS, Hopper may show a first run dialog (demo mode or license). Complete it once in the same user session before unattended jobs.
• Your agent's model provider still sees the tool results, so check its data policy before analyzing anything sensitive.

Honest caveats

REA is for lawful research, education, interoperability, preservation and analysis of software you own or are authorized to examine. Many apps and games forbid reverse engineering in their terms. Deep native work needs a disassembler, and IDA and full Hopper are paid products, while Ghidra is free.

Use cases with copy-paste prompts

Each page has who it is for, the steps and a prompt you can paste into your coding agent.

Use case: Build a similar feature for your project from an app you can inspect

Use case: Analyze an Electron app directory

Use case: Understand what a native binary does

---

Get one email every Monday with the week's hottest AI repos and exactly how to use them: subscribe free at dedupedai.com