REA (Reverse Engineer Anything) is a free, locally-running tool that gives your AI agent the ability to inspect any app, trace how any feature works, and build a working copy. No source code access required. One command to install. Supports Claude or Codex and most other major AI coding tools.
You have seen an app feature that would save your team an hour a day if you had it in your own tool. Maybe it is the way a CRM handles pipeline stage notifications. Maybe it is the search behavior in a project management tool. Maybe it is the way a competitor's onboarding wizard sequences its steps.
In most cases, you cannot hire someone to build it because the quote is $5,000 and the timeline is three months. You cannot build it yourself because you do not have the code. And you cannot reverse engineer it because that used to require a software engineer with disassembly experience.
REA is a CLI and MCP server that gives your AI agent the tools to do that inspection work. You describe the feature you want. The agent uses REA to open the app, use it, take notes on what is happening at the code level, test its own reasoning, and explain how the feature works. From there, your agent writes and tests a working implementation in your own stack.
The analysis runs entirely on your machine. Your binaries and your code never leave your system.
REA is MIT-licensed and has 325,000+ stars on GitHub.
What REA Can Inspect
| Target type | What the agent can see |
|---|---|
| JavaScript / Electron apps | Modules, imports, source maps, routes, IPC relationships |
| Websites | Page structure, scripts, network requests, rendered screenshots |
| Native binaries | Pseudocode, assembly, symbols, call relationships (requires Hopper, Ghidra, or IDA) |
| .NET assemblies | Metadata, CIL instructions, native dependencies |
| Android APKs | Manifest, decompiled methods, class references |
| Go binaries | Embedded modules, build settings, dependency edges |
| Rust binaries | Crate names, versions, dependency graph |
| SQLite databases | Tables, columns, indexes, views, triggers |
| Network captures | Requests, responses, exposed payloads |
For a business building internal tools, the JavaScript and website targets cover most use cases. If you want to replicate a feature from a web app or an Electron desktop app (Notion, Slack, Linear, etc.), REA can trace it without requiring access to the source repository.
Setup: One Command
REA installs in a single command. Requirements: Node.js 22.x or higher and npm.
Install and configure:
Copy this.
npx rea-agents setup
This adds REA's MCP server and matching workflow instructions directly to your AI agent's configuration. It creates backups of your existing config before writing anything. After it runs, restart your agent.
Works with: Claude Code, Codex, Cursor, Gemini CLI, Grok Build.
Update when a new version ships:
Copy this.
npx rea-agents@latest setup
Verify the install:
Copy this.
rea --help
If the help output appears, REA is connected and ready.
How to Use It
Once REA is installed, your agent has access to its inspection tools automatically. You use it by asking your agent to reverse engineer a specific feature.
Copy: Feature inspection prompt
Copy this.
Reverse engineer [FEATURE NAME] in [APP NAME]. Use REA to inspect how it works. Trace the relevant code paths. Show me the evidence for your conclusions. Then build the equivalent feature in [YOUR STACK] based on what you find. Target audience: [WHO WILL USE THIS AND WHAT THEY NEED IT TO DO].
Example:
Copy this.
Reverse engineer the search ranking in Notion using REA. Trace how search results are ordered and weighted. Show me the evidence. Then build equivalent search ranking logic in my Node.js app using PostgreSQL full-text search. Target audience: internal team of 12 people, searching across project notes.
The agent will:
- Use REA to open the app and inspect the relevant modules.
- Trace the feature from its user-facing behavior back to the underlying implementation.
- Test its own conclusions by checking the evidence before reporting.
- Return an explanation with the evidence and the limitations of its analysis.
- Write an implementation in your stack based on those findings.
What Good Output Looks Like
REA-assisted analysis returns evidence alongside each conclusion. The agent does not just say "search ranking uses TF-IDF weighting." It shows you the function call, the relevant module, and the data structure it found.
The DX-Ball case study on rea.tools is the clearest published example: an agent used REA to follow a sound call into its position-to-pan helper, inspect the assembly, and turn incomplete pseudocode into C. The reconstruction passed 3,205 original test cases and reproduced all 63 compiled function bytes. That is the level of precision the tool enables on binary targets.
For web app features, the output is less surgical but still specific. You get the module structure, the IPC relationships in an Electron app, or the API routes the feature calls. Enough to build a working equivalent, even without a perfect 1:1 reconstruction.
What to Say When Output Is Wrong
If the agent's analysis comes back with wrong conclusions, type: "The conclusion about [SPECIFIC CLAIM] is incorrect. Use REA to look again at [SPECIFIC LOCATION]. Show me what it actually says."
REA returns evidence, not just answers. When the agent's interpretation of the evidence is wrong, you can point back to the evidence and ask it to re-derive the conclusion. That is the correction loop.
Do not start over with a new prompt. Point to the specific wrong claim and ask for a re-examination of the relevant code path.
Honest: What This Does Not Do
This is not magic. REA gives your agent inspection tools. The quality of the analysis depends on what the agent does with those tools. Complex multi-layered features in large apps may take several rounds of inspection to fully understand. Plan for that, especially the first time you use it on a new target.
Some targets require additional tools. Native binary analysis needs Hopper, Ghidra, or IDA installed separately. Android APK analysis needs headless JADX and a JDK. Website analysis needs a Chrome-family browser. Most JavaScript and Electron app targets work without extra tools.
Linux-only features. Firmware analysis, packet capture tools, and logic signal analysis require Linux. On macOS or Windows, those targets are unavailable.
The agent model provider receives tool results. Your binary inspection runs locally, but the agent model (Anthropic for Claude Code, OpenAI for Codex) receives the output of REA's tools during the session. Check your provider's data policy if you are inspecting software with sensitive intellectual property.
Reverse engineering may have legal implications. REA is a tool. Whether using it to inspect a specific target is legal in your jurisdiction and under the terms of service of the app you're inspecting is a question for your legal counsel, not for this article. Use it on your own software or software you have authorization to inspect.
What to Build This Week
Pick one feature in any tool your business uses daily that you wish you had in your own internal system. Something specific: the way a field auto-populates, the way a notification triggers, the way a search result ranks.
Write the feature inspection prompt above with that specific feature and app filled in. Run it through your agent with REA installed.
You do not have to deploy anything this week. Run the inspection, read what the agent finds, and see whether a working copy is something your agent can build from what it learned.
The GitHub repo and setup guide are below.