REA (Reverse Engineer Anything) is the viral GitHub repo that gives AI coding agents like Claude Code the tools to look inside an installed app — without the source code. I installed it on Windows, pointed it at VS Code, and wrote down every error I hit along the way.
🎥 Prefer video? Watch the full walkthrough here: [Walkthrough]
What is REA?
REA is an MCP server plus a set of workflow instructions (a "skill") for your AI agent. Instead of guessing how an app works from screenshots, the agent can call REA's analysis tools — 207 of them in version 6.7.0 — to inspect the real files.
Think of it like a restaurant:
- You are the customer — you ask a question in plain English.
- Claude Code is the chef — it decides what to do.
- REA is the chef's toolbox.
- The app is the ingredient being inspected.
It supports JavaScript and Electron apps out of the box. Native .exe/.dll analysis needs Ghidra, IDA or Hopper installed separately, and full Android APK analysis needs a Java JDK.
Hype vs reality
- ✅ It finds real evidence inside an app's files
- ✅ It explains that evidence in plain language
- ✅ It tells you what it couldn't figure out
- ❌ It is not a one-click "clone this app" button
- ❌ Heavily protected apps need extra tools and may still leave open questions
My favourite part: findings come with a confidence level. In my test, the Electron fuse check came back as "confidence": "observed" from the shipped artifact, with the file's SHA-256 attached as proof.
How to install REA
Prerequisite: Node.js 22.19+, 24.11+ or 26+.
Mac & Linux (guided)
npx rea-agents setup
The wizard asks which agent you use and registers REA for you.
Windows (manual — this is what worked for me)
On Windows, setup deliberately doesn't edit your agent's config, so register it yourself:
node -v
npm install -g rea-agents@6.7.0
rea doctor
claude mcp add --scope user rea -- cmd /c rea mcp
Then fully restart Claude Code and run /mcp — you should see rea · connected.
cmd /cmatters on Windows:reais a.cmdlauncher that Claude Code can't start directly.
⚠️ Install only from the official repo — github.com/morluto/rea — or the npm package rea-agents. Copycat repos are a real risk with tools like this.
Demo: reverse engineering VS Code
I gave Claude Code this prompt (static analysis only — nothing launched or modified):
Use the rea MCP server to statically analyse VS Code at
%LOCALAPPDATA%\Programs\Microsoft VS Code. Do not launch or modify it.
1. inspect_pe_resources and inspect_electron_fuses on Code.exe
2. Read resources\app\product.json and list every server it talks to
3. analyze_javascript_application on resources\app and map its processes
Explain each finding in plain English.
1. What Code.exe really is
| Component | Version |
|---|---|
| VS Code | 1.142.0 |
| Electron | 43.7.7 |
| Chromium | 150.0.7871.250 |
| Node.js | 24.21.0 |
| Size | 238 MB, 64-bit, signed by Microsoft |
The internal name? electron.exe. VS Code is a web app in a desktop wrapper.
2. Nine Electron security fuses
Fuses are on/off switches baked into the executable at build time. REA read all nine. Highlights:
-
On:
RunAsNode,EnableNodeOptionsEnvironmentVariable,EnableNodeCliInspectArguments— VS Code needs these for its CLI and helper processes. -
Off:
EnableEmbeddedAsarIntegrityValidation,OnlyLoadAppFromAsar— VS Code checks its own files with checksums inproduct.jsoninstead.
These are design trade-offs, not bugs — but they're exactly why Electron apps are interesting to study.
3. Who VS Code talks to
From product.json: the update server, the Extension Marketplace, a GitHub-hosted MCP server gallery, Settings Sync, an A/B experimentation service, Bing-powered settings search, a voice service, and a CDN hosting AI agent SDKs. Telemetry is on by default, with an opt-out.
4. Seven processes
Main process, workbench window, shared process, extension host, pty host (terminal), file watcher, and a newer agent host. That's why one frozen extension doesn't freeze your editor — extensions run in their own process.
Troubleshooting: every error I hit
| Error | Cause | Fix |
|---|---|---|
'claude' is not recognized |
claude.exe is in %USERPROFILE%\.local\bin, which wasn't on PATH |
Add that folder to your user PATH, open a new terminal |
MCP server rea already exists in user config |
Already registered | Nothing to fix — restart Claude Code |
rea missing from /mcp
|
Not restarted, or a different session/PC | Fully close and reopen Claude Code on the same PC |
provider_unavailable |
No Ghidra/IDA/Hopper found | Install Ghidra + JDK 21, set GHIDRA_INSTALL_DIR, run rea doctor
|
| Server won't start on Windows | Missing cmd /c
|
claude mcp add --scope user rea -- cmd /c rea mcp |
| APK analysis fails | JRE instead of JDK | Install a full Java JDK |
Pro tip: when anything breaks, run rea doctor first. It's read-only and tells you exactly what's missing.
My verdict
- For understanding apps — yes. What used to take hours in a disassembler took minutes, in plain English.
- Not a magic clone button. It gives your agent evidence; building is still your job.
- Always verify anything marked "inferred" or "unknown".
As an app developer, I'll use it to check my own release builds (what really ships in my APK), learn how good open-source apps solve a feature, and audit what the tools I install connect to.
Use it responsibly
From REA's README: it's for lawful research, education, interoperability, software preservation — and software you own or are authorized to examine. Learn from apps; don't copy paid ones.
Watch the full video: Full Detailed Video
What should I reverse engineer next? Drop it in the comments 👇
I'm Rajiv — I make videos about AI tools that actually work on The Code Street.
Top comments (0)