What Is REA (Reverse Engineer Anything)? The MCP Server That Hit 115K GitHub Stars in a Week

REA, short for Reverse Engineer Anything, is an open-source MCP server and CLI that gives a coding agent the tools to take software apart without its source code. Point Claude Code, Codex, Cursor, or another agent at a native binary, an Electron app, a .NET assembly, an Android APK, a website, or a saved network capture, ask how a feature works, and REA returns pseudocode, module graphs, request logs, and the evidence behind each claim. The agent then explains the behavior or rebuilds it.

Try Apidog today

The morluto/rea repository was created in April 2026 and sat mostly unnoticed until the first week of October. By October 12 it had passed 115,000 stars and 25,000 forks, one of the fastest climbs GitHub has seen. This guide covers what REA does, how to install it, where it is strong and where the hype outruns it, and the part most coverage skips: REA reads HAR and mitmproxy captures, which makes it a front end for API reverse engineering you can finish in Apidog.

The numbers behind the hype

Trendshift's daily tracking shows the shape of the spike. REA first appeared on the trending list on October 4 with about 1,400 new stars in a day. It then compounded for a week.

Date	New stars that day
Oct 4	1,373
Oct 7	5,602
Oct 9	19,375
Oct 10	26,572
Oct 11	31,255

The repo held the number one spot on GitHub Trending for five of the seven days from October 6 to 12. Releases kept pace: version 3.2 shipped on October 3, 4.0 on October 5, 5.0 on October 7, 6.0 on October 8, and 6.1 through 6.4 between October 9 and 11. That cadence matters for anyone adopting it, and we'll come back to it.

No single tweet or launch post explains the jump. The pitch did the work: "See a feature you like. Understand how it works, down to the binary level." Demo videos of agents rebuilding desktop apps from their binaries spread fast, along with the usual claims that software is finished. The more useful read is narrower. REA is a well-packaged connector between agents and reverse-engineering tools that already existed.

What REA does

REA runs as a local MCP server. Your agent calls its tools, REA inspects the target with the right engine, and the agent gets structured findings plus their limitations and unknowns. The same workflows are available as CLI commands, so you can script them without an agent at all.

What it analyzes, from the README's target table:

Target	What REA returns	Needs
Native binaries	Pseudocode, assembly, strings, symbols, cross-references	Hopper, Ghidra, or IDA
Go binaries	Compiler version, modules, build settings	Nothing extra
JavaScript and Electron apps	Modules, imports, source maps, routes, IPC boundaries	Node.js only
Websites	Page structure, scripts, network observations, screenshots	A Chrome-family browser
Saved network captures	Requests, responses, payloads, source locations	HAR; mitmdump on Linux for mitmproxy
.NET assemblies	Metadata, CIL, native dependencies	Nothing extra
Android APKs and devices	Manifest, decompiled methods, logs, screen captures	JADX plus a JDK; adb
Firmware	Regions, extraction results	Binwalk or Unblob on Linux
WASM and EVM bytecode	Sections, imports and exports, dispatch selectors	WABT; Linux x64

The design choice that distinguishes REA from a thin wrapper is the evidence model. Every result carries its provenance: file digests, byte ranges, JSON pointers into the capture, and an explicit list of what the analysis could not establish. The project calls this out repeatedly in its docs. Analysis runs on your machine, and the README's FAQ is direct that the agent's model provider still receives the tool results under its own data policy.

How to install REA

You need Node.js 22.19 or later (23 and 25 are unsupported) and npm. One command registers the MCP server and installs the matching skill instructions for your agent:

npx rea-agents setup

Setup shows a plan, backs up existing config, and writes only after you approve. Per the installation guide, it supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, VS Code, Grok Build, Hermes, and more, each selectable with a --client flag. Restart the agent afterwards, then ask it something like:

Understand how search works in the Notes app, show me the evidence,
and build a similar feature for my project.

For a global CLI:

npm install --global rea-agents
rea doctor --json

Static JavaScript, .NET, website, and capture analysis work with no extra engine. Deep native analysis needs Hopper, Ghidra 12.1 with a JDK 21 or newer, or IDA. Setup can install Hopper with your approval, but Hopper is separate commercial software with its own license. Ghidra on Windows is marked experimental.

What it's good at, from the showcases

The project's own case studies are the honest benchmark. In the DX-Ball study, the agent followed a sound call into its position-to-pan helper, turned incomplete pseudocode into C, and the reconstruction passed 3,205 original x86 test cases while reproducing all 63 compiled function bytes. In the Notion study, it traced the clipboard API from the renderer through preload and IPC into the Electron main process. A third recovered a bullet-ring angle calculation from a 1990s PC-98 game's 16-bit instructions.

Notice the pattern. These are tightly scoped questions about one function or one data path, with a way to verify the answer. That is where agent-driven reverse engineering works today. "Rebuild this whole app" demos look good on video and produce something that resembles the target, but one early review that tested REA against a vanilla agent on a simple Mac app found the gap narrow and the REA run slower. The value shows up when the question is specific and the target is complex.

REA for API work: from capture to tested spec

Here is the part relevant to anyone who builds against APIs. REA's inspect_web_network_capture tool reads a HAR file (or a native mitmproxy capture on Linux) offline. It never refetches recorded URLs. It validates every entry, preserves request and response bodies with their digests, and structurally excludes authorization headers, cookies, and URL credentials from the evidence.

Then it does something an API team will recognize. Pass the retained evidence to inspect_analysis_view with the api-surface view and REA groups every request by method, origin, and inferred path template. Numeric IDs become {numeric}, UUIDs become {uuid}, long hex strings become {hex}, and dates become {iso-date}. Each group cites the records it came from and flags mixed statuses or content types. The capture guide is careful to say the view makes no schema or handler claim. It is an inferred inventory, not a spec.

That inventory is exactly the starting point for the workflow in our reverse engineering APIs guide, and Apidog finishes it:

1. Capture once. In Chrome DevTools, reproduce the flow and save all requests as a HAR with content. Record on a test account; a HAR carries live tokens.
2. Let the agent map it. Ask your agent to run REA on the HAR and summarize the API surface. You get the endpoint list, the ID patterns, and which calls returned errors, with pointers back to the raw records.
3. Import the same HAR into Apidog. Apidog turns captured requests into endpoints, with an option to generate a default test case per endpoint and to drop static assets at import time. Our HAR import walkthrough covers the cleanup.
4. Promote the inferred templates to real path parameters. REA's {numeric} and {uuid} placeholders tell you which segments to parameterize in the Apidog endpoint definitions.
5. Mock and test. Switch on Apidog's smart mock so your client code can run against the reconstructed API before you touch the real one, then write assertions against the captured response shapes and run them from the Apidog CLI in CI.

The split is clean. REA is good at reading evidence and explaining it. Apidog is where the endpoints become a documented, mocked, tested contract your team can share. Neither does the other's job.

Caveats before you adopt it

Release velocity cuts both ways. Seven minor versions shipped in nine days, and the project's always-bump-minor policy means a minor bump can be breaking. The 6.2 migration guide changed the shape of every MCP result. If you script against REA's JSON output, pin a version and read the changelog before updating.

It is a connector, not a sandbox. The project's security policy states that its local provider bridge is not a sandbox and that opening an untrusted binary runs its parsing with your user permissions. Analyze untrusted targets inside an isolated environment, the same way you would isolate any agent's tool calls.

Platform limits are specific. Native mitmproxy decoding needs mitmdump 12.2.3 exactly, on Linux, supplied by you. Firmware extraction, EVM, and WASM paths are Linux x64. Hopper has no Windows build.

Legal responsibility stays with you. The README limits REA to lawful research, analysis, and reconstruction and says you are responsible for authorization. Copying a competitor's feature is the same legal question it was before the tool existed. The project has also had to state that it has issued no token and that coins using its name are unaffiliated.

It's early. Over 100 contributors and more than 170 open issues and pull requests as of this writing. The docs are thorough, but expect rough edges on anything outside the showcased paths.

Frequently asked questions

Is REA free? Yes. The code is MIT licensed and the npm package is free. Hopper is a paid product if you choose it for native analysis; Ghidra is free.

Does REA upload my app or binary? No. Analysis runs locally. The tool results go to whichever model your agent uses, so that provider's data policy applies.

Do I need Ghidra or IDA to get started? Not for JavaScript, Electron, .NET, website, or capture analysis. Only native binary decompilation needs an engine.

Can REA produce an OpenAPI spec from traffic? No. Its api-surface view is an inferred inventory with path templates. Import the HAR into Apidog to get editable endpoint definitions, then export OpenAPI from there. Download Apidog to try the import on a capture you already have.

Where this leaves you

REA earned its stars by packaging real reverse-engineering engines behind one MCP server and documenting the evidence it returns. Use it for scoped questions: how one function works, which IPC channel carries a message, what an app's traffic looks like. Treat the rebuild-everything demos as demos.

For API teams, the practical win is the capture path. Let the agent read the HAR with REA, then import the same file into Apidog and turn the inventory into endpoints you can mock, test, and document.

Comments

[DEV SUPPORTS]

You need to verify your account.

tr.ee/dev-to